@takosjp/yurucommu-core 3.2.0 → 3.2.1

package/src/backend/lib/unread-counts.ts

@@ -0,0 +1,79 @@
+/**
+ * Shared Yurume unread totals.
+ *
+ * SINGLE owner of the DM + community-chat unread COUNT(*) SQL. It is consumed
+ * by BOTH:
+ *   - GET /api/dm/unread/count (the Messages nav badge), and
+ *   - the notification push payload's `counts.unread`
+ * so the app badge a push sets can never drift from the badge the client
+ * computes when it opens. A parity test pins this helper to the endpoint.
+ *
+ * - DM unread: direct Notes addressed TO the actor (via the object_recipients
+ *   `to` index), not authored by the actor, published after the actor's
+ *   per-conversation read time (epoch if never read), excluding archived
+ *   conversations.
+ * - Community unread: group-CHAT Notes (audience-linked, communityApId IS NULL
+ *   — NOT feed posts) in communities the actor belongs to, not the actor's
+ *   own, after the later of the per-community read time and the join time.
+ */
+
+import { sql } from "drizzle-orm";
+import type { Database } from "../../db/index.ts";
+
+export interface YurumeUnreadCounts {
+  readonly dm: number;
+  readonly community: number;
+  readonly total: number;
+}
+
+export async function yurumeUnreadCounts(
+  db: Database,
+  actorApId: string,
+): Promise<YurumeUnreadCounts> {
+  const dmRow = await db.get<{ c: number }>(sql`
+    SELECT COUNT(*) AS c
+    FROM objects o
+    JOIN object_recipients orp
+      ON orp.object_ap_id = o.ap_id
+      AND orp.recipient_ap_id = ${actorApId}
+      AND orp.type = 'to'
+    LEFT JOIN dm_read_status r
+      ON r.conversation_id = o.conversation
+      AND r.actor_ap_id = ${actorApId}
+    WHERE o.visibility = 'direct'
+      AND o.type = 'Note'
+      AND o.conversation IS NOT NULL
+      AND o.attributed_to != ${actorApId}
+      AND o.published > COALESCE(r.last_read_at, '1970-01-01T00:00:00Z')
+      AND o.conversation NOT IN (
+        SELECT conversation_id FROM dm_archived_conversations
+        WHERE actor_ap_id = ${actorApId}
+      )
+  `);
+
+  const communityRow = await db.get<{ c: number }>(sql`
+    SELECT COUNT(*) AS c
+    FROM community_members cm
+    JOIN object_recipients orp
+      ON orp.recipient_ap_id = cm.community_ap_id
+      AND orp.type = 'audience'
+    JOIN objects o
+      ON o.ap_id = orp.object_ap_id
+      AND o.type = 'Note'
+      AND o.community_ap_id IS NULL
+      AND o.attributed_to != ${actorApId}
+    LEFT JOIN dm_community_read_status r
+      ON r.community_ap_id = cm.community_ap_id
+      AND r.actor_ap_id = ${actorApId}
+    WHERE cm.actor_ap_id = ${actorApId}
+      AND o.published > COALESCE(
+        r.last_read_at,
+        cm.joined_at,
+        '1970-01-01T00:00:00Z'
+      )
+  `);
+
+  const dm = Number(dmRow?.c ?? 0);
+  const community = Number(communityRow?.c ?? 0);
+  return { dm, community, total: dm + community };
+}

package/src/backend/middleware/csrf.ts

@@ -69,6 +69,16 @@ function isBearerApiRequest(
   return !c.req.header("Cookie");
 }
 
+function isCookieLessNativeAuthRequest(
+  c: Context<{ Bindings: Env; Variables: Variables }>,
+) {
+  return (
+    !c.req.header("Cookie") &&
+    (c.req.path === "/api/auth/mobile/login" ||
+      c.req.path === "/api/auth/mobile/oidc")
+  );
+}
+
 /**
  * CSRF protection middleware.
  * Validates Origin/Referer for state-changing requests as defense-in-depth
@@ -82,6 +92,7 @@ export function csrfProtection() {
     if (!STATE_CHANGING_METHODS.has(c.req.method.toUpperCase())) return next();
     if (isActivityPubInbox(c.req.path)) return next();
     if (isBearerApiRequest(c)) return next();
+    if (isCookieLessNativeAuthRequest(c)) return next();
 
     const appUrl = c.env.APP_URL;
     const allowedOrigins = buildAllowedOrigins(c.env);

package/src/backend/routes/account-teardown.ts

@@ -19,6 +19,8 @@ import {
   mediaUploads,
   mutes,
   notificationArchived,
+  notificationPushers,
+  notificationPushJobs,
   nowIso,
   objectRecipients,
   objects,
@@ -244,6 +246,17 @@ export async function teardownActor(
     .delete(notificationArchived)
     .where(eq(notificationArchived.actorApId, apId));
 
+  // Notification push state (no FK cascade — these tables intentionally declare
+  // no actors FK; see migrations/0019). Remove the actor's registered pushers
+  // (their pushkey is an external push endpoint that must stop being woken) and
+  // any durable outbox rows keyed to the actor.
+  await db
+    .delete(notificationPushers)
+    .where(eq(notificationPushers.actorApId, apId));
+  await db
+    .delete(notificationPushJobs)
+    .where(eq(notificationPushJobs.actorApId, apId));
+
   // Media: hard-delete the actor's uploads + best-effort purge backing R2.
   await purgeActorMediaUploads(db, env.MEDIA, apId);
 

package/src/backend/routes/auth-helpers.ts

@@ -139,6 +139,7 @@ export async function rotateSession(
   tokens: OAuthTokens | null,
   encryptionKey: string | undefined,
   rotationContext: string,
+  options: { setCookie?: boolean } = {},
 ): Promise<string> {
   const db = c.get("db");
 
@@ -184,13 +185,15 @@ export async function rotateSession(
   // served over plain http:// — a hardcoded Secure made an http self-host
   // un-loginnable (the browser never sends a Secure cookie over http), so honour
   // the operator's APP_URL protocol while defaulting to Secure for https/unknown.
-  setCookie(c, "session", sessionId, {
-    httpOnly: true,
-    secure: !(c.env.APP_URL ?? "").startsWith("http://"),
-    sameSite: "Strict",
-    path: "/",
-    maxAge: SESSION_MAX_AGE_SECONDS,
-  });
+  if (options.setCookie !== false) {
+    setCookie(c, "session", sessionId, {
+      httpOnly: true,
+      secure: !(c.env.APP_URL ?? "").startsWith("http://"),
+      sameSite: "Strict",
+      path: "/",
+      maxAge: SESSION_MAX_AGE_SECONDS,
+    });
+  }
 
   return sessionId;
 }

package/src/backend/routes/auth.ts

@@ -40,6 +40,7 @@ import {
   rotateSession,
 } from "./auth-helpers.ts";
 import { logger } from "../lib/logger.ts";
+import { rawSessionCredential } from "../lib/session-actor.ts";
 
 const log = logger.child({ component: "auth" });
 
@@ -75,12 +76,20 @@ auth.get("/providers", async (c) => {
   });
 });
 
+function mobileSessionResponse(sessionId: string) {
+  return {
+    access_token: sessionId,
+    token_type: "Bearer",
+    expires_in: 30 * 24 * 60 * 60,
+  };
+}
+
 // 現在のユーザー情報
 auth.get("/me", async (c) => {
   const actor = c.get("actor");
   if (!actor) return c.json({ error: "Not authenticated" }, 401);
 
-  const sessionId = getCookie(c, "session");
+  const sessionId = rawSessionCredential(c);
   let provider: string | null = null;
   let hasTakosAccess = false;
 
@@ -206,6 +215,119 @@ auth.post("/login", async (c) => {
   return c.json({ success: true });
 });
 
+// Native password authentication. The credential is a host-owned session,
+// not the password itself and not a browser cookie, so Tauri/native clients can
+// call the same API safely from any app origin.
+auth.post("/mobile/login", async (c) => {
+  const config = getAuthConfig(c.env);
+  if (!config.passwordEnabled) {
+    return c.json({ error: "Password auth not enabled" }, 400);
+  }
+
+  const clientIp = getClientIP(c);
+  const lockoutKey = `password:${clientIp}`;
+  const lockoutStatus = await getLoginLockoutStatus(c.env.KV, lockoutKey);
+  if (lockoutStatus.locked) {
+    c.header("Retry-After", String(lockoutStatus.retryAfterSeconds));
+    return c.json(lockoutErrorResponse(lockoutStatus.retryAfterSeconds), 429);
+  }
+
+  const body = await parseJsonObject(c);
+  const password = body ? parseNonEmptyString(body.password) : undefined;
+  if (!password) {
+    return c.json({ error: "password is required", code: "BAD_REQUEST" }, 400);
+  }
+  const isValid = c.env.AUTH_PASSWORD_HASH?.trim()
+    ? await verifyBootstrapOrPassword(password, c.env.AUTH_PASSWORD_HASH)
+    : false;
+  if (!isValid) {
+    const failedStatus = await recordFailedLoginAttempt(c.env.KV, lockoutKey);
+    if (failedStatus.locked) {
+      c.header("Retry-After", String(failedStatus.retryAfterSeconds));
+      return c.json(lockoutErrorResponse(failedStatus.retryAfterSeconds), 429);
+    }
+    return c.json({ error: "Invalid password" }, 401);
+  }
+
+  const db = c.get("db");
+  const actorData =
+    (await db
+      .select()
+      .from(actors)
+      .where(and(eq(actors.role, "owner"), notDeleted(actors)))
+      .get()) ??
+    (await createActor(db, c.env, {
+      username: "tako",
+      name: "tako",
+      takosUserId: "password:owner",
+      role: "owner",
+    }));
+  const sessionId = await rotateSession(
+    c,
+    actorData.apId,
+    null,
+    null,
+    c.env.ENCRYPTION_KEY,
+    "mobile password login rotation",
+    { setCookie: false },
+  );
+  await clearLoginLockout(c.env.KV, lockoutKey);
+  return c.json(mobileSessionResponse(sessionId));
+});
+
+// Exchange a verified native OIDC ID token for the same host-owned session
+// used by password login. This keeps product APIs independent from the
+// operator's token format and makes session revocation host-local.
+auth.post("/mobile/oidc", async (c) => {
+  const provider = getProvider(c.env, "takos");
+  if (!provider?.issuer || !provider.jwksUrl) {
+    return c.json({ error: "OIDC auth not enabled" }, 400);
+  }
+  const body = await parseJsonObject(c);
+  const idToken = body ? parseNonEmptyString(body.id_token) : undefined;
+  if (!idToken) {
+    return c.json({ error: "id_token is required", code: "BAD_REQUEST" }, 400);
+  }
+
+  try {
+    const { clientId } = getClientCredentials(c.env, "takos");
+    const claims = await verifyOidcIdToken(idToken, {
+      issuer: provider.issuer,
+      clientId,
+      jwksUrl: provider.jwksUrl,
+    });
+    const actorData = await findOrCreateOAuthActor(
+      c.get("db"),
+      c.env,
+      "takos",
+      {
+        id: claims.sub,
+        name:
+          claims.name ?? claims.preferred_username ?? claims.email ?? "user",
+        email: claims.email,
+        username: claims.preferred_username,
+      },
+    );
+    if (!actorData) return c.json({ error: "actor_creation_failed" }, 403);
+    const sessionId = await rotateSession(
+      c,
+      actorData.apId,
+      "takos",
+      null,
+      c.env.ENCRYPTION_KEY,
+      "mobile oidc login rotation",
+      { setCookie: false },
+    );
+    return c.json(mobileSessionResponse(sessionId));
+  } catch (error) {
+    log.warn("Mobile OIDC exchange failed", {
+      event: "auth.mobile.oidc_exchange_failed",
+      error,
+    });
+    return c.json({ error: "invalid_id_token" }, 401);
+  }
+});
+
 // OAuth: 認証開始
 auth.get("/login/:provider", async (c) => {
   const providerId = c.req.param("provider");
@@ -388,7 +510,7 @@ auth.get("/callback/:provider", async (c) => {
 
 // ログアウト
 auth.post("/logout", async (c) => {
-  const sessionId = getCookie(c, "session");
+  const sessionId = rawSessionCredential(c);
   if (sessionId) {
     await deleteSessionSafely(c.get("db"), c.env, sessionId, "logout");
     deleteCookie(c, "session");

package/src/backend/routes/communities/messages.ts

@@ -18,9 +18,9 @@ import {
 } from "../../federation-helpers.ts";
 import { feedCursorWhere } from "../../lib/feed-cursor.ts";
 import {
-  MAX_ATTACHMENTS,
-  MAX_ATTACHMENTS_JSON_LENGTH,
-} from "../posts/transformers.ts";
+  type ChatAttachment,
+  validateChatAttachments,
+} from "../../lib/attachments.ts";
 import { communityRequiresMembership } from "../../lib/community-visibility.ts";
 import { rateLimit, RateLimitConfigs } from "../../middleware/rate-limit.ts";
 import {
@@ -38,30 +38,9 @@ import {
 
 const MAX_COMMUNITY_MESSAGE_LENGTH = 5000;
 const MAX_COMMUNITY_MESSAGES_LIMIT = 100;
-
-type ChatAttachment = Record<string, unknown>;
-
-/**
- * Validate a chat message's attachments array (mirrors the post-create and DM
- * bounds: records only, capped count + serialized size). Returns the validated
- * array ([] when absent) or an error message.
- */
-function validateAttachments(
-  raw: unknown,
-): ChatAttachment[] | { error: string } {
-  if (raw === undefined || raw === null) return [];
-  if (!Array.isArray(raw)) return { error: "attachments must be an array" };
-  if (raw.some((a) => !a || typeof a !== "object" || Array.isArray(a))) {
-    return { error: "attachments must be objects" };
-  }
-  if (raw.length > MAX_ATTACHMENTS) {
-    return { error: `Too many attachments (max ${MAX_ATTACHMENTS})` };
-  }
-  if (JSON.stringify(raw).length > MAX_ATTACHMENTS_JSON_LENGTH) {
-    return { error: "attachments payload too large" };
-  }
-  return raw as ChatAttachment[];
-}
+// Cap the per-member read receipts returned alongside a page so a very large
+// community's chat reader stays bounded regardless of local-member count.
+const MAX_COMMUNITY_READ_STATES = 200;
 
 // D1's batch() (atomic multi-statement) is only on the concrete D1/libsql
 // driver, not the shared `Database` union; reach it through a narrow cast.
@@ -220,7 +199,9 @@ messagesRouter.get("/:identifier/messages", async (c) => {
   // Per-member read positions (LOCAL-ONLY read receipts): rows exist only for
   // local members that marked the chat read — read state is never federated,
   // so remote members simply never appear here. Restricted to CURRENT members
-  // so a kicked member's stale row doesn't leak into the read count.
+  // so a kicked member's stale row doesn't leak into the read count, and capped
+  // (most-recently-read first) so a huge community can't return an unbounded
+  // receipt list on every page fetch.
   const readStates = await db
     .select({
       actorApId: dmCommunityReadStatus.actorApId,
@@ -234,7 +215,9 @@ messagesRouter.get("/:identifier/messages", async (c) => {
         eq(communityMembers.actorApId, dmCommunityReadStatus.actorApId),
       ),
     )
-    .where(eq(dmCommunityReadStatus.communityApId, community.apId));
+    .where(eq(dmCommunityReadStatus.communityApId, community.apId))
+    .orderBy(desc(dmCommunityReadStatus.lastReadAt))
+    .limit(MAX_COMMUNITY_READ_STATES);
 
   return c.json({
     messages: result,
@@ -264,11 +247,11 @@ messagesRouter.post(
       attachments?: unknown;
     }>();
 
-    const attachmentsOrError = validateAttachments(body.attachments);
-    if (!Array.isArray(attachmentsOrError)) {
-      return c.json({ error: attachmentsOrError.error }, 400);
+    const attachmentsResult = validateChatAttachments(body.attachments);
+    if (!attachmentsResult.ok) {
+      return c.json({ error: attachmentsResult.error }, 400);
     }
-    const attachments = attachmentsOrError;
+    const attachments = attachmentsResult.attachments;
 
     // Guard non-string content before .trim() (else TypeError → 500). An
     // attachment-only message (image send) carries no text.

package/src/backend/routes/dm/contacts.ts

@@ -23,6 +23,7 @@ import {
 } from "../../../db/index.ts";
 import { formatUsername } from "../../federation-helpers.ts";
 import { chunkForInClause } from "../../lib/chunk.ts";
+import { yurumeUnreadCounts } from "../../lib/unread-counts.ts";
 import {
   buildActorInfoMap,
   byTimeDesc,
@@ -476,50 +477,11 @@ contacts.get("/unread/count", async (c) => {
   const actor = c.get("actor");
   if (!actor) return c.json({ error: "Unauthorized" }, 401);
   const db = c.get("db");
-  const me = actor.ap_id;
-
-  const dmRow = await db.get<{ c: number }>(sql`
-    SELECT COUNT(*) AS c
-    FROM objects o
-    JOIN object_recipients orp
-      ON orp.object_ap_id = o.ap_id
-      AND orp.recipient_ap_id = ${me}
-      AND orp.type = 'to'
-    LEFT JOIN dm_read_status r
-      ON r.conversation_id = o.conversation
-      AND r.actor_ap_id = ${me}
-    WHERE o.visibility = 'direct'
-      AND o.type = 'Note'
-      AND o.conversation IS NOT NULL
-      AND o.attributed_to != ${me}
-      AND o.published > COALESCE(r.last_read_at, '1970-01-01T00:00:00Z')
-      AND o.conversation NOT IN (
-        SELECT conversation_id FROM dm_archived_conversations
-        WHERE actor_ap_id = ${me}
-      )
-  `);
-
-  const communityRow = await db.get<{ c: number }>(sql`
-    SELECT COUNT(*) AS c
-    FROM community_members cm
-    JOIN object_recipients orp
-      ON orp.recipient_ap_id = cm.community_ap_id
-      AND orp.type = 'audience'
-    JOIN objects o
-      ON o.ap_id = orp.object_ap_id
-      AND o.type = 'Note'
-      AND o.community_ap_id IS NULL
-      AND o.attributed_to != ${me}
-    LEFT JOIN dm_community_read_status r
-      ON r.community_ap_id = cm.community_ap_id
-      AND r.actor_ap_id = ${me}
-    WHERE cm.actor_ap_id = ${me}
-      AND o.published > COALESCE(r.last_read_at, cm.joined_at, '1970-01-01T00:00:00Z')
-  `);
-
-  const dm = Number(dmRow?.c ?? 0);
-  const community = Number(communityRow?.c ?? 0);
-  return c.json({ total: dm + community, dm, community });
+
+  // Single owner of the DM + community-chat unread SQL (lib/unread-counts.ts),
+  // shared with the notification push payload's badge so the two cannot drift.
+  const { total, dm, community } = await yurumeUnreadCounts(db, actor.ap_id);
+  return c.json({ total, dm, community });
 });
 
 export default contacts;

package/src/backend/routes/dm/messages.ts

@@ -37,10 +37,7 @@ import {
 import { enqueueDeliveryToActor } from "../../lib/delivery/queue.ts";
 import { feedCursorWhere } from "../../lib/feed-cursor.ts";
 import { toApAttachments } from "../../lib/activitypub-helpers.ts";
-import {
-  MAX_ATTACHMENTS,
-  MAX_ATTACHMENTS_JSON_LENGTH,
-} from "../posts/transformers.ts";
+import { validateChatAttachments } from "../../lib/attachments.ts";
 import { logger } from "../../lib/logger.ts";
 
 const log = logger.child({ component: "dm.messages" });
@@ -127,34 +124,6 @@ function validateContent(
   return content;
 }
 
-/**
- * Validate a chat message's attachments array (mirrors the post-create bounds:
- * records only, capped count + serialized size — the size cap bounds row and
- * federated-doc bloat regardless of internal shape). Returns the validated
- * array ([] when absent) or an error response.
- */
-function validateAttachments(
-  raw: unknown,
-): Attachment[] | { error: string; status: 400 } {
-  if (raw === undefined || raw === null) return [];
-  if (!Array.isArray(raw)) {
-    return { error: "attachments must be an array", status: 400 };
-  }
-  if (raw.some((a) => !a || typeof a !== "object" || Array.isArray(a))) {
-    return { error: "attachments must be objects", status: 400 };
-  }
-  if (raw.length > MAX_ATTACHMENTS) {
-    return {
-      error: `Too many attachments (max ${MAX_ATTACHMENTS})`,
-      status: 400,
-    };
-  }
-  if (JSON.stringify(raw).length > MAX_ATTACHMENTS_JSON_LENGTH) {
-    return { error: "attachments payload too large", status: 400 };
-  }
-  return raw as Attachment[];
-}
-
 /**
  * Resolve a `user@domain` handle for a DM recipient. Prefers the stored
  * preferredUsername paired with the recipient's host, falling back to
@@ -462,14 +431,11 @@ dm.post("/user/:encodedApId/messages", async (c) => {
   }>();
   const baseUrl = c.env.APP_URL;
 
-  const attachmentsOrError = validateAttachments(body.attachments);
-  if (!Array.isArray(attachmentsOrError)) {
-    return c.json(
-      { error: attachmentsOrError.error },
-      attachmentsOrError.status,
-    );
+  const attachmentsResult = validateChatAttachments(body.attachments);
+  if (!attachmentsResult.ok) {
+    return c.json({ error: attachmentsResult.error }, 400);
   }
-  const attachments = attachmentsOrError;
+  const attachments = attachmentsResult.attachments as Attachment[];
 
   // An attachment-only message (LINE-style image send) carries no text.
   const contentOrError = validateContent(body.content, attachments.length > 0);