fedipod-server 0.10.0 → 0.11.0

package/lib/intake.mjs

@@ -15,6 +15,9 @@
 // a poll every POLL_MS as fallback, plus a drain at startup.
 
 import * as $rdf from 'rdflib';
+import * as podInbox from './pod/inbox.mjs';
+import * as podNotifications from './pod/notifications.mjs';
+import * as podNotes from './pod/notes.mjs';
 import { USER_AGENT } from './ua.mjs';
 import { PUBLIC } from './wire.mjs';
 import { HTTP_TIMEOUT_MS, readCapped } from './safefetch.mjs';
@@ -96,10 +99,39 @@ const CONTENT_TYPES = new Set(['Note', 'Article', 'Question', 'Page', 'Video', '
 // several), each carrying the tally its author's server maintains.
 // Custom emojis ride the tag list; the images live at the author's server and
 // the client fetches them from there.
+// Content, name and summary were capped; nothing else was. One remote Question
+// with thousands of options, or thousands of emoji, mention or attachment
+// entries, put megabytes into a single statuses.json row — a document rewritten
+// whole on every change. These are display lists: past a few dozen, nothing can
+// render them and nobody meant them to be rendered.
+// http(s) only. An emoji, attachment or mention URL is written straight into
+// the client's markup, so `javascript:` and `data:` have no business in one.
+// The store has guarded avatars this way all along (safeUrl, lib/store.mjs);
+// these three lists were simply never put through it.
+const httpOnly = (u) => {
+  if (!u) return null;
+  try {
+    const p = new URL(String(u));
+    return (p.protocol === 'https:' || p.protocol === 'http:') ? String(u) : null;
+  } catch { return null; }
+};
+
+const MAX_MODQUEUE = 200;
+const MAX_EMOJIS = 60;
+const MAX_POLL_OPTIONS = 50;
+const MAX_OPTION_CHARS = 200;
+const MAX_MENTIONS = 60;
+const MAX_URL_CHARS = 2048;
+
 function emojisOf(note) {
   return [].concat(note?.tag || [])
     .filter(t => t?.type === 'Emoji' && t.icon?.url && t.name)
-    .map(t => ({ shortcode: String(t.name).replace(/^:|:$/g, ''), url: String(t.icon.url) }));
+    .slice(0, MAX_EMOJIS)
+    .map(t => ({
+      shortcode: String(t.name).replace(/^:|:$/g, '').slice(0, 64),
+      url: httpOnly(String(t.icon.url).slice(0, MAX_URL_CHARS)),
+    }))
+    .filter(e => e.url);
 }
 
 function pollOf(note) {
@@ -109,8 +141,8 @@ function pollOf(note) {
     multiple: !!note.anyOf,
     expiresAt: note.endTime || null,
     closed: !!note.closed,
-    options: opts.map(o => ({
-      title: String(o?.name ?? ''),
+    options: opts.slice(0, MAX_POLL_OPTIONS).map(o => ({
+      title: String(o?.name ?? '').slice(0, MAX_OPTION_CHARS),
       votes: Number(o?.replies?.totalItems) || 0,
     })),
   };
@@ -128,8 +160,77 @@ const isActorType = (t) => typesOf(t).some(x => ACTOR_TYPES.has(x));
 // stranger could have anything at all, of a type nothing here reads,
 // re-delivered to every follower over our signature.
 const FORWARDABLE = new Set(['Create', 'Update', 'Delete', 'Like', 'Announce', 'Undo']);
+// Of those, the ones we may re-deliver to our own followers over our own
+// signature (§7.1.2). Deliberately narrower than FORWARDABLE: these three are
+// the ones whose object this drain fetched from the author's origin and checked
+// before accepting. A Like, an Announce or an Undo is taken on the envelope's
+// word alone — relaying one is signing for a claim nothing corroborated.
+const FORWARD_TYPES = new Set(['Create', 'Update', 'Delete']);
+// How many forwards one drain may send. A reply into a busy thread of ours is a
+// handful; anything near this is a flood using us as an amplifier.
+const MAX_FORWARDS_PER_DRAIN = 20;
 const ACCEPT_AP = 'application/activity+json, application/ld+json; profile="https://www.w3.org/ns/activitystreams"';
 
+// What is worth keeping of an activity we are filing rather than acting on.
+//
+// A dead letter, a moderation entry and a waiting follow request each used to
+// hold the WHOLE delivered activity — up to the 512 KB item cap — in documents
+// that are serialized and PUT whole on every change. A stranger could inflate
+// deadletter.json to ~100 MB and requests.json to ~250 MB and make us rewrite
+// them on every batch.
+//
+// Everything the consumers need survives: `acceptActivity` wraps this as the
+// Accept's object (and {id, type, actor, object} IS the standard Follow shape),
+// `applyModeration` reads only `object`, and a dead letter is read by a human
+// who wants to know what arrived, not to replay it.
+export function trimActivity(a) {
+  if (!a || typeof a !== 'object') return a ?? null;
+  const idOf = (v) => (typeof v === 'string' ? v : v?.id ?? null);
+  const out = {};
+  for (const k of ['id', 'type', 'actor', 'target']) {
+    const v = idOf(a[k]);
+    if (v) out[k] = String(v).slice(0, 2048);
+  }
+  const obj = idOf(a.object);
+  if (obj) out.object = String(obj).slice(0, 2048);
+  // A typed object with no id still says what it was — a Block of nobody, an
+  // Undo of a Follow — and that is the whole of what the queue reads.
+  else if (a.object && typeof a.object === 'object' && a.object.type) {
+    out.object = { type: String(a.object.type).slice(0, 64) };
+  }
+  return out;
+}
+
+// Same origin AND, where the origin holds more than one identity, the same
+// identity within it.
+//
+// Origin alone is the right test when an origin is one person — the ordinary
+// fediverse server, and a subdomain pod. It is the WRONG test on a path-based
+// host, and above all on a multi-tenant front: every tenant of fedipod.net has
+// ids under `https://fedipod.net/u/<name>/`, so origin-equality made every
+// tenant able to vouch for every other. One tenant could publish posts
+// attributed to another, Update a neighbour's post, or Delete it — and a
+// receiving Mastodon would believe it for the same reason we did.
+//
+// So when both ids carry an identity prefix, the prefixes must match too. The
+// two shapes that exist here are the front's `/u/<name>/` and a pod's own AP
+// root (`…/<root>/ap/…`); anything else has no prefix and falls back to origin,
+// which is what a plain remote server should be judged by.
+function identityPrefix(u) {
+  const m = /^(https?:\/\/[^/]+\/u\/[^/]+\/)/u.exec(u);
+  if (m) return m[1];
+  const ap = /^(https?:\/\/[^/]+\/(?:[^/]+\/)*?)ap\//u.exec(u);
+  return ap ? ap[1] : null;
+}
+
+export function sameIdentity(a, b) {
+  if (!sameOrigin(a, b)) return false;
+  const pa = identityPrefix(String(a));
+  const pb = identityPrefix(String(b));
+  if (!pa || !pb) return true;              // no prefix to compare: origin is the answer
+  return pa === pb;
+}
+
 export function sameOrigin(a, b) {
   try { return new URL(a).origin === new URL(b).origin; } catch { return false; }
 }
@@ -149,13 +250,21 @@ export function sameOrigin(a, b) {
 // and two labels minimum so `.live` cannot pose as everyone's parent. Not a
 // public-suffix list — that is a dependency and a data file to keep current,
 // and the party this guards against is the pod you already chose to trust.
+//
+// `localhost` is the one single-label parent allowed, because it is the one that
+// cannot be anybody else: it is reserved to the loopback interface (RFC 6761),
+// so `alice.localhost` and `localhost` are the same machine by definition and
+// there is no stranger for the rule to keep out. Without this a pod served from
+// a subdomain of localhost — which is how a Solid server with subdomain pods
+// runs on a developer's machine — refused its own socket and fell back to
+// polling, so every delivery waited up to two minutes.
 export function sameSocketOrigin(socketUrl, podBase) {
   let s, p;
   try { s = new URL(socketUrl); p = new URL(podBase); } catch { return false; }
   if (s.protocol !== (p.protocol === 'https:' ? 'wss:' : 'ws:')) return false;
   if (s.host === p.host) return true;
   const parent = s.hostname.toLowerCase();
-  return parent.split('.').length >= 2
+  return (parent.split('.').length >= 2 || parent === 'localhost')
     && s.port === p.port
     && p.hostname.toLowerCase().endsWith('.' + parent);
 }
@@ -186,16 +295,20 @@ export function authorOf(note, delivered = null) {
     .map(a => (typeof a === 'string' ? a : a?.id)).find(Boolean) || null;
   const author = claimed || delivered;
   if (!author) return null;
-  return sameOrigin(note?.id, author) ? author : null;
+  // sameIdentity, not sameOrigin: on a multi-tenant front every tenant shares
+  // an origin, so origin-equality let any of them be credited with any other's
+  // post. See sameIdentity.
+  return sameIdentity(note?.id, author) ? author : null;
 }
 
 export class Intake {
-  constructor({ config, urls, remote, local, store, deliverer, publisher, log = console.log, lease = null, archive = null, push = true, pollSeconds = null }) {
-    Object.assign(this, { config, urls, remote, local, store, deliverer, publisher, log, lease, archive, push, pollSeconds });
+  constructor({ config, urls, remote, store, deliverer, publisher, log = console.log, lease = null, archive = null, push = true, pollSeconds = null }) {
+    Object.assign(this, { config, urls, remote, store, deliverer, publisher, log, lease, archive, push, pollSeconds });
     this.serial = Date.now();
     this.stopped = false;
     // (attempt counts are kept in pod state — see _bumpAttempt)
     this.lastDrain = null;
+    this._forwardBudget = MAX_FORWARDS_PER_DRAIN;
     this.lastDrainAtMs = 0;
     this.reconnectTries = 0;
     this.drainCooldownUntil = 0;
@@ -315,16 +428,8 @@ export class Intake {
    * pod that says nothing has always used.
    */
   async _storageDescriptionUrl() {
-    try {
-      const head = await fetch(this.urls.base, {
-        method: 'HEAD',
-        headers: { 'user-agent': USER_AGENT },
-        signal: AbortSignal.timeout(HTTP_TIMEOUT_MS),
-      });
-      const [found] = linkTargets(head.headers.get('link'), REL.storageDescription, this.urls.base);
-      if (found) return found;
-    } catch { /* the well-known path below */ }
-    return this.urls.base + '.well-known/solid';
+    return podNotifications.storageDescriptionUrl(this.urls.base,
+      { headers: { 'user-agent': USER_AGENT }, timeoutMs: HTTP_TIMEOUT_MS });
   }
 
   async _subscribeOnce() {
@@ -335,35 +440,16 @@ export class Intake {
       return;
     }
     const descUrl = await this._storageDescriptionUrl();
-    const descRes = await fetch(descUrl, {
-      headers: { accept: 'text/turtle', 'user-agent': USER_AGENT },
-      signal: AbortSignal.timeout(HTTP_TIMEOUT_MS),
-    });
-    // The service description is RDF; ask rdflib which subject is the
-    // WebSocketChannel2023 service rather than pattern-matching the document.
-    const g = $rdf.graph();
-    try { $rdf.parse(await readCapped(descRes), g, descUrl, 'text/turtle'); }
-    catch (e) { this.wsState = 'unavailable'; this.log(`service description unparsable (${e.message}) — polling only`); return; }
-    const channel = g.each(null, RDF('type'), NOTIFY('WebSocketChannel2023'), null)
-      .map(n => n.value)
-      .find(Boolean)
-      || g.each(null, NOTIFY('channelType'), NOTIFY('WebSocketChannel2023'), null)
-        .map(n => n.value).find(Boolean);
-    if (!channel) { this.wsState = 'unavailable'; this.log('no WebSocketChannel2023 service — polling only'); return; }
+    const { channel, error } = await podNotifications.readWebSocketChannel(descUrl,
+      { headers: { 'user-agent': USER_AGENT }, timeoutMs: HTTP_TIMEOUT_MS });
+    if (!channel) { this.wsState = 'unavailable'; this.log(`${error} — polling only`); return; }
     // The topic is a POD resource, and it travels in the BODY — so the url map
     // RemotePod applies to the request line never reaches it. A fronted
     // identity's inbox url names the front, which the pod cannot grant read on,
     // and the subscription came back 403. A no-op when unfronted.
     const topic = this.urls.toPod ? this.urls.toPod(this.urls.inbox) : this.urls.inbox;
-    const sub = await this.remote.fetch(channel, {
-      method: 'POST',
-      headers: { 'content-type': 'application/ld+json' },
-      body: JSON.stringify({
-        '@context': ['https://www.w3.org/ns/solid/notification/v1'],
-        type: 'http://www.w3.org/ns/solid/notifications#WebSocketChannel2023',
-        topic,
-      }),
-    });
+    const sub = await podNotifications.subscribeToInbox(this.remote,
+      { channelUrl: channel, podTopicUrl: topic });
     const body = await readCapped(sub).then(JSON.parse).catch(() => null);
     if (!body?.receiveFrom) {
       this.wsState = `subscribe-failed-${sub.status}`;
@@ -445,6 +531,9 @@ export class Intake {
     // invariant — commit() flushes whatever is pending either way — so a store
     // that does not implement it behaves exactly as before.
     this._inSweep = true;
+    // Fresh per sweep: the cap is on how much this drain may amplify, not a
+    // lifetime total (see _maybeForward).
+    this._forwardBudget = MAX_FORWARDS_PER_DRAIN;
     this.store.hold?.();
     this._draining = this._drainOnce().finally(async () => {
       this._inSweep = false;
@@ -481,7 +570,7 @@ export class Intake {
   async prune({ before, keepConcerning = false } = {}) {
     const cutoff = Date.parse(before);
     if (!Number.isFinite(cutoff)) throw new Error(`"${before}" is not a date`);
-    const all = await this.remote.listContainer(this.urls.inbox);
+    const all = await podInbox.list(this.remote, this.urls);
     const older = all.filter(e => !e.url.endsWith('.keep')
       && e.modified && Date.parse(e.modified) < cutoff);
     const out = { considered: older.length, applied: 0, dropped: 0, discarded: 0, failed: 0 };
@@ -489,14 +578,14 @@ export class Intake {
     for (const item of older) {
       try {
         if (item.size > MAX_ITEM_BYTES) {
-          await this.remote.delete(item.url);       // unreadable by the drain either way
+          await podInbox.dropHandledItem(this.remote, item.url);   // unreadable by the drain either way
           out.discarded++;
         } else {
-          const res = await this.remote.fetch(item.url, { headers: { accept: '*/*' } });
           // Same rule as the drain: a read we could not make is not a Create to
-          // be dropped. Let it count as failed and stay for the next pass.
-          if (res.status >= 400 && res.status !== 404) throw new Error(`inbox item GET → ${res.status}`);
-          const activity = res.status < 400 ? await res.json().catch(() => null) : null;
+          // be dropped. readItem throws on anything but 404, so it counts as
+          // failed and stays for the next pass.
+          const got = await podInbox.readItem(this.remote, item.url, { maxBytes: MAX_ITEM_BYTES, readCapped });
+          const activity = got.raw === null ? null : (() => { try { return JSON.parse(got.raw); } catch { return null; } })();
           // A Create is the content the owner just asked to be rid of. Anything
           // else changes state and is applied exactly as a drain would.
           if (keepConcerning) {
@@ -512,7 +601,7 @@ export class Intake {
             this.log(`state not written — stopping the prune with ${older.length - out.applied - out.dropped - out.discarded} left`);
             break;
           }
-          await this.remote.delete(item.url);
+          await podInbox.dropHandledItem(this.remote, item.url);
         }
         this._clearAttempt(item.url);
         await new Promise(r => setTimeout(r, DELETE_GAP_MS));
@@ -595,7 +684,7 @@ export class Intake {
     this._pruneAttempts();
     let all;
     try {
-      all = await this.remote.listContainer(this.urls.inbox);
+      all = await podInbox.list(this.remote, this.urls);
       this.drainFailures = 0;
     } catch (e) {
       this._backOff(`inbox unreadable (${e.message})`);
@@ -637,7 +726,7 @@ export class Intake {
         return false;
       }
       for (const url of pending.splice(0)) {
-        if (!await this.remote.delete(url)) {
+        if (!await podInbox.dropHandledItem(this.remote, url)) {
           // Still in the mailbox. Handling is idempotent so seeing it again is
           // harmless, but counting it would clear the attempt record and report
           // progress that did not happen.
@@ -667,17 +756,14 @@ export class Intake {
       }
       let activity = null;
       try {
-        const res = await this.remote.fetch(url, { headers: { accept: '*/*' } });
-        // A pod that would not GIVE us the item has told us nothing about it.
-        // Reading a 500 as an empty body made it "unparsable JSON", which is a
-        // REJECTION: dead-lettered with both `activity` and `raw` null, and then
-        // DELETEd — a delivery destroyed by a transient fault, with no record of
-        // what it was. Throwing puts it on the retry path the header promises.
-        // 404 is the exception: the item is already gone, so deleting is right.
-        if (res.status >= 400 && res.status !== 404) throw new Error(`inbox item GET → ${res.status}`);
-        // Capped rather than res.text(): the listing's size is advisory, and the
-        // inbox is public-Append, so the body is whatever a stranger chose.
-        const raw = res.status < 400 ? await readCapped(res, MAX_ITEM_BYTES) : null;
+        const got = await podInbox.readItem(this.remote, url, { maxBytes: MAX_ITEM_BYTES, readCapped });
+        // readItem carries the rule that matters here: a pod that would not
+        // GIVE us the item has told us nothing about it, so anything but a 404
+        // throws rather than reading as an empty body. Reading a 500 as empty
+        // made it "unparsable JSON" — a REJECTION, dead-lettered with both
+        // `activity` and `raw` null and then DELETEd, destroying a delivery on
+        // a transient fault with no record of what it had been.
+        const raw = got.raw;
         try { activity = raw ? JSON.parse(raw) : null; } catch { /* kept raw for the dead letter */ }
         // A gateway that verified this delivery left a receipt beside it. Read
         // it only when a gateway is configured (no config → no fetch, so an
@@ -690,7 +776,7 @@ export class Intake {
         if (!rejection) await this._maybeForward(activity);    // §7.1.2, only what we accepted
         if (rejection) {
           this.store.addDeadLetter({
-            inboxUrl: url, reason: rejection, activity,
+            inboxUrl: url, reason: rejection, activity: trimActivity(activity),
             ...(activity ? {} : { raw: raw?.slice(0, 2000) ?? null }),
           });
           this.log(`rejected (${rejection}) — dead-lettered: ${url}`);
@@ -700,7 +786,7 @@ export class Intake {
         const n = this._bumpAttempt(url, e.message);
         this.log(`inbox item ${url} attempt ${n}/${MAX_ITEM_ATTEMPTS}: ${e.message}`);
         if (n >= MAX_ITEM_ATTEMPTS) {
-          this.store.addDeadLetter({ inboxUrl: url, reason: `failed ${n}x: ${e.message}`, activity });
+          this.store.addDeadLetter({ inboxUrl: url, reason: `failed ${n}x: ${e.message}`, activity: trimActivity(activity) });
           // The dead letter IS the record of this item — deleting before it is
           // written down would lose the only evidence it ever arrived, so it
           // goes through the same commit-then-delete batch as everything else.
@@ -765,6 +851,23 @@ export class Intake {
     let doc = null;
     try { doc = JSON.parse(await readCapped(res)); }
     catch (e) { this.log(`fetch ${url}: unreadable as JSON — ${e.message}`); return null; }
+    // A document is only evidence about its OWN origin.
+    //
+    // signedFetch follows redirects and hands back only the final response, and
+    // every caller checks `doc.id` against the URL it ASKED for — so an open
+    // redirector on a victim's origin let an attacker's server answer for a
+    // victim's URL and be believed by that check.
+    //
+    // Only a redirect that CROSSED AN ORIGIN is refused here. A same-origin
+    // redirect is ordinary (canonicalisation, trailing slashes), and a document
+    // fetched with no redirect at all is still returned whatever it claims —
+    // the callers reject it on id, and they say something more useful about it
+    // than this could ("actor id mismatch", "object not verifiable content").
+    const landed = res.finalUrl || url;
+    if (!sameOrigin(landed, url) && doc && doc.id && !sameOrigin(doc.id, landed)) {
+      this.log(`fetch ${url}: redirected to ${landed}, which is not where ${doc.id} lives — refused`);
+      return null;
+    }
     // Every actor type, not just Person. A Group was fetched, used and thrown
     // away, so nothing knew its preferredUsername — and a client rendering it
     // fell back to the last path segment of the actor URL, which is the literal
@@ -785,6 +888,8 @@ export class Intake {
   }
 
   sameOrigin(a, b) { return sameOrigin(a, b); }
+  // Overridable in tests the same way sameOrigin is.
+  sameIdentity(a, b) { return sameIdentity(a, b); }
 
   // Have we ever heard of this actor or object? Answered entirely from local
   // state, so asking costs nothing. It is what stops a stranger's Delete or
@@ -823,15 +928,26 @@ export class Intake {
     const secret = this.gatewaySecret();
     if (!secret) return null;
     try {
-      const res = await this.remote.fetch(itemUrl + '.receipt.json', { headers: { accept: 'application/json' } });
-      if (res.status >= 400) return null;
-      const { readCapped } = await import('./safefetch.mjs');
-      const receipt = JSON.parse(await readCapped(res, 64 * 1024));
+      const { readCapped: cap } = await import('./safefetch.mjs');
+      const receipt = await podInbox.readDeliveryReceipt(this.remote, itemUrl, { maxBytes: 64 * 1024, readCapped: cap });
+      if (!receipt) return null;
       const { verifyReceipt } = await import('./httpsig.mjs');
       return verifyReceipt(receipt, secret) ? receipt : null;
     } catch { return null; }
   }
 
+  // Whether a receipt says anything about THIS actor. Verified-and-about-someone
+  // -else is worth exactly as much as unverified, and is treated the same way:
+  // the drain's verify-by-dereference still stands behind it.
+  receiptVouchesFor(receipt, actor) {
+    if (!receipt?.verified) return false;
+    if (!receipt.actor || receipt.actor !== actor) return false;
+    // A missing keyId with verified:true cannot come from our own door
+    // (makeReceipt fills both from the same key), so refuse rather than waive.
+    if (!receipt.keyId || !sameOrigin(receipt.keyId, actor)) return false;
+    return true;
+  }
+
   async handle(activity, receipt = null) {   // eslint-disable-line no-unused-vars
     const actor = typeof activity.actor === 'string' ? activity.actor : activity.actor?.id;
     if (!actor) return 'no actor';
@@ -844,6 +960,12 @@ export class Intake {
     if (!httpUrl(actor)) return `actor is not an http(s) URL (${actor})`;
     if (this.store.isBlocked(actor)) return `blocked sender (${actor})`;
 
+    // Whether the door vouched for this sender — read by the moderation queue
+    // just below as well as by the arms further down, so it is settled here,
+    // before its first use.
+    const trusted = this.receiptVouchesFor(receipt, actor)
+      && this.store.getConfig()?.gateway?.mode === 'trust';
+
     // FEP-1b12 moderation from a LISTED moderator. A delivery proves nothing
     // about its sender, which is why these are QUEUED for the operator rather
     // than run on arrival — the queue is where a claimed moderator's word
@@ -852,18 +974,26 @@ export class Intake {
     if (this.config.kind === 'group'
       && (this.config.moderators || []).includes(actor)
       && this.isModerationAsk(activity)) {
-      return this.queueModeration(activity, actor);
+      return this.queueModeration(activity, actor, { trusted });
     }
 
-    // A gateway receipt is trusted only in `trust` mode — in `shadow` it is
-    // measured but never acted on, which is what makes the shadow phase safe.
-    const trusted = !!receipt?.verified && this.store.getConfig()?.gateway?.mode === 'trust';
+    // `trusted` was settled above, before the moderation queue reads it. Why it
+    // is not simply `receipt.verified`: that says the door checked a signature
+    // and the signature was good; it does NOT say whose. The door reports the
+    // signing key's owner separately, in `receipt.actor`, and nothing here used
+    // to read it — so ANY valid fediverse signing key, over an activity whose
+    // `actor` field named someone else entirely, arrived as trusted. In trust
+    // mode that is one delivery to evict any of your followers, or to have a
+    // Follow naming a third party auto-accepted. See receiptVouchesFor, which
+    // also holds the keyId to the actor's origin: a key document is fetched
+    // from wherever its id points, so one hosted elsewhere that merely CLAIMS
+    // `owner: <you>` would otherwise bind.
 
     switch (activity.type) {
       case 'Follow': return this.onFollow(activity, actor, { trusted });
       case 'Undo': return this.onUndo(activity, actor, { trusted });
       case 'Create': return this.onCreate(activity, actor);
-      case 'Accept': return this.onAccept(activity, actor);
+      case 'Accept': return this.onAccept(activity, actor, { trusted });
       case 'Like': case 'Announce': {
         // FEP-1b12: a group Announces the member's whole Create, not the note.
         // Without unwrapping we try to ingest a Create as if it were a Note and
@@ -897,7 +1027,7 @@ export class Intake {
       }
       case 'Delete': return this.onDelete(activity, actor);
       case 'Update': return this.onUpdate(activity, actor);
-      case 'Reject': return this.onReject(activity, actor);
+      case 'Reject': return this.onReject(activity, actor, { trusted });
       case 'Move': return this.onMove(activity, actor);
       case 'Add': case 'Remove': return this.onAddRemove(activity, actor);
       default: this.log(`ignored ${activity.type} from ${actor}`);
@@ -929,17 +1059,42 @@ export class Intake {
 
   // Held, not run: one entry per distinct ask, capped, waiting for the
   // operator to apply or dismiss it (social.applyModeration).
-  queueModeration(activity, actor) {
+  // A moderator's WORD, not their proof. `actor` is a field in an unsigned
+  // body and a moderator's URL is public, so anyone can claim to be one — which
+  // is exactly why these are QUEUED for the operator rather than run. What was
+  // missing is that the queue did not say which is which, and a stranger could
+  // fill all 200 slots and push the real asks out.
+  //
+  // So: the entry records whether the door vouched for the sender, and when the
+  // queue is full the UNVERIFIED entries are what get dropped. A real
+  // moderator's ask cannot be crowded out by someone impersonating them.
+  queueModeration(activity, actor, { trusted = false } = {}) {
     const q = this.store.read('modqueue.json', []);
     const objectId = typeof activity.object === 'string' ? activity.object : activity.object?.id;
     const key = [activity.type, actor, objectId || JSON.stringify(activity.object || null)].join(' ');
-    if (q.some(e => e.key === key)) return;
+    const seen = q.find(e => e.key === key);
+    if (seen) {
+      // The same ask arriving verified is worth more than the copy we hold.
+      if (trusted && !seen.verified) {
+        seen.verified = true;
+        this.store.write('modqueue.json', q);
+      }
+      return;
+    }
     q.unshift({
       key, id: (this.serial++).toString(36) + '-' + q.length,
-      type: activity.type, moderator: actor, activity, at: new Date().toISOString(),
+      type: activity.type, moderator: actor, activity: trimActivity(activity),
+      verified: !!trusted, at: new Date().toISOString(),
     });
-    this.store.write('modqueue.json', q.slice(0, 200));
-    this.log(`moderation queued from ${actor}: ${activity.type} ${objectId || ''}`);
+    let kept = q;
+    if (kept.length > MAX_MODQUEUE) {
+      const verified = kept.filter(e => e.verified);
+      const rest = kept.filter(e => !e.verified);
+      // Verified first, then the newest unverified up to the cap.
+      kept = [...verified, ...rest].slice(0, MAX_MODQUEUE);
+    }
+    this.store.write('modqueue.json', kept);
+    this.log(`moderation queued from ${actor}${trusted ? '' : ' (unverified)'}: ${activity.type} ${objectId || ''}`);
   }
 
   // §7.6 Add / §7.9 Remove. The side effect would be to add or remove the object
@@ -992,7 +1147,7 @@ export class Intake {
       if (!reqs.some(r => r.actor === actor)) {
         reqs.unshift({
           actor, inbox: doc.inbox, sharedInbox: doc.endpoints?.sharedInbox,
-          activity, at: new Date().toISOString(),
+          activity: trimActivity(activity), at: new Date().toISOString(),
         });
         this.store.setRequests(reqs.slice(0, 500));
         this.store.addNotification({ type: 'follow-request', actor });
@@ -1068,7 +1223,18 @@ export class Intake {
     // operator's queue forever asking about someone who left.
     if (!rec) {
       const reqs = this.store.getRequests();
-      if (reqs.some(r => r.actor === actor)) {
+      const pending = reqs.find(r => r.actor === actor);
+      if (pending) {
+        // Bound the same way the follower eviction below is, and for the same
+        // reason: `actor` is a field in an unsigned body, so without a match
+        // anyone could withdraw anyone else's waiting request. The victim's
+        // server believes the Follow is still pending and never resends, so
+        // they simply never get followed and nobody sees why.
+        const theirs = pending.activity?.id;
+        if (!trusted && (!theirs || named !== theirs)) {
+          this.log(`Undo from ${actor} does not name the request we hold — ignored`);
+          return;
+        }
         this.store.setRequests(reqs.filter(r => r.actor !== actor));
         await this.republish({ pending: true });
         this.log(`join request withdrawn: ${actor}`);
@@ -1161,6 +1327,21 @@ export class Intake {
   async _maybeForward(activity) {
     if (!activity || typeof activity !== 'object') return;
     if (!FORWARDABLE.has(activity.type)) return;              // see FORWARDABLE
+    // Forwarding signs somebody else's activity with OUR key and pushes it to
+    // every follower we have. That is a lot to do on the word of an unsigned
+    // POST, so it is narrowed three ways:
+    //
+    //   1. Only the types whose object this drain actually DEREFERENCED at the
+    //      author's own origin. A Create/Update/Delete went through onCreate /
+    //      onUpdate / onDelete, which fetch and check the author; a Like, an
+    //      Announce or an Undo is believed on the envelope alone, so relaying
+    //      one made us a signed relay for anything a stranger cared to write.
+    //   2. The actor has to be someone we already know of. A complete stranger
+    //      addressing our followers collection is not a conversation we are
+    //      party to.
+    //   3. A budget per drain, so a flood cannot turn one sweep into thousands
+    //      of outbound deliveries under our signature.
+    if (!FORWARD_TYPES.has(activity.type)) return;
     try {
       const audience = []
         .concat(activity.to || [], activity.cc || [], activity.audience || [])
@@ -1169,6 +1350,14 @@ export class Intake {
       if (!this._referencesOurObject(activity)) return;         // not into a thread of ours
       const actor = typeof activity.actor === 'string' ? activity.actor : activity.actor?.id;
       if (actor === this.urls.actor) return;                    // our own; nothing to forward
+      if (!this.known(actor)) {
+        this.log(`not forwarding ${activity.type} from ${actor}: nobody we know of`);
+        return;
+      }
+      if (this._forwardBudget <= 0) {
+        this.log(`not forwarding ${activity.type}: this drain's forwarding budget is spent`);
+        return;
+      }
       const id = typeof activity.id === 'string' ? activity.id : null;
       if (!id) return;
       const forwarded = this.store.read('forwarded.json', []);
@@ -1179,6 +1368,7 @@ export class Intake {
         .map(f => f.sharedInbox || f.inbox)
         .filter(Boolean))];
       if (!inboxes.length) return;
+      this._forwardBudget -= 1;
       await this.deliverer.deliverToAll(inboxes, activity);
       this.store.write('forwarded.json', [...forwarded, id].slice(-MAX_FORWARDED));
       this.log(`forwarded ${activity.type} ${id} to ${inboxes.length} follower inbox(es)`);
@@ -1206,7 +1396,7 @@ export class Intake {
     const objectId = typeof activity.object === 'string' ? activity.object : activity.object?.id;
     if (!objectId) return 'Create without object id';
     if (this.store.isBlocked(objectId)) return `blocked domain (${objectId})`;
-    if (!this.sameOrigin(objectId, actor)) return `object/actor origin mismatch (${objectId})`;
+    if (!this.sameIdentity(objectId, actor)) return `object/actor identity mismatch (${objectId})`;
     // The delivered copy is untrusted for CONTENT, but its addressing is
     // enough to decide whether to bother fetching the origin's copy.
     const envelope = typeof activity.object === 'object' ? { ...activity, ...activity.object } : activity;
@@ -1296,8 +1486,22 @@ export class Intake {
     // Wrap the member's own activity when we have it; a bare note URL is the
     // fallback, and renders as a plain boost rather than a group carry. The
     // group names itself as the audience (FEP-1b12).
+    //
+    // `activity` is the envelope as DELIVERED — a document the sender wrote,
+    // which the group would otherwise re-sign and hand to every follower with
+    // whatever addressing, tags and object body it carried. Only the note id was
+    // ever verified (ingestNote fetched it from the author's origin and checked
+    // the attribution), so only the note id is safe to pass on: send the bare
+    // id unless the wrapper's own object id agrees with what we verified.
+    const wrapperObject = (a) => {
+      const inner = a?.object;
+      const id = typeof inner === 'string' ? inner : inner?.id;
+      return id === noteId ? a : null;
+    };
     const act = announceActivity({
-      urls: this.urls, object: activity || held?.activity || noteId, serial: this.serial++,
+      urls: this.urls,
+      object: wrapperObject(activity) || wrapperObject(held?.activity) || noteId,
+      serial: this.serial++,
       audience: this.urls.actor,
     });
     await this.deliverer.deliverToAll(inboxes, act);
@@ -1432,6 +1636,20 @@ export class Intake {
     // somebody else's boost, or through a hashtag feed.
     if (this.store.isBlocked(author)) return `blocked author (${author})`;
 
+    // The ENVELOPE said this concerns us. The envelope is a document a stranger
+    // wrote: onCreate reads addressing off the delivered copy to decide whether
+    // fetching is worth it, and nothing re-asked the question of the copy that
+    // came back from the author's own server. So anyone could take any public
+    // post, address the delivery to us, and have it filed as "X mentioned you"
+    // — or, to a group, have a member's post carried to every follower when the
+    // member never sent it there.
+    //
+    // A boost is exempt (`via`): someone we follow deliberately putting a post
+    // in front of us is the whole point, and the note will not address us.
+    if (!via && !this.concernsUs(note, author)) {
+      return `the note its own server serves does not address us (${objectId})`;
+    }
+
     // An answer to one of our polls is a number on a document, not a post. It
     // arrives as an ordinary reply naming an option and carrying nothing else,
     // so filing it as one would put a blank entry in the thread and ring the
@@ -1467,24 +1685,13 @@ export class Intake {
     const followed = via || known || (!known && await this.isCoMember(author));
     const kind = followed ? 'timeline' : 'mention';
 
-    // `published` comes from a document at someone else's origin, and its first
-    // ten characters become the leading component of a storage path. A date is
-    // a date or it is not used: a value carrying `../` would otherwise be a
-    // remote party choosing where we write.
-    const day = String(note.published || '').slice(0, 10);
-    const slug = (/^\d{4}-\d{2}-\d{2}$/.test(day) ? day : new Date().toISOString().slice(0, 10)) + '-' +
-      (await import('node:crypto')).createHash('sha256').update(note.id).digest('hex').slice(0, 8);
-    if (kind === 'timeline') {
-      await this.local.writeNote('timeline', slug, {
-        noteId: note.id, actor: author, published: note.published, content,
-        inReplyTo: note.inReplyTo, attachments,
-      });
-    }
     // Mastodon carries a thread's mentions into every reply, which is the only
     // reason a reply ever reaches a group. Keep them so our composer can too.
     const mentions = [].concat(note.tag || [])
       .filter(t => t?.type === 'Mention' && t.href && t.name)
-      .map(t => ({ href: t.href, name: t.name }));
+      .slice(0, MAX_MENTIONS)
+      .map(t => ({ href: httpOnly(String(t.href).slice(0, MAX_URL_CHARS)), name: String(t.name).slice(0, 256) }))
+      .filter(m => m.href);
     const emojis = emojisOf(note);
     const poll = pollOf(note);
     // Explicitly addressed, but to nobody public and to no followers
@@ -1507,7 +1714,6 @@ export class Intake {
       ...(poll ? { poll } : {}),
       ...(emojis.length ? { emojis } : {}),
       ...(mentions.length ? { mentions } : {}),
-      ...(kind === 'timeline' ? { slug } : {}),
       ...(attachments.length ? { attachments } : {}),
       ...(via ? { via } : {}),
     });
@@ -1546,7 +1752,7 @@ export class Intake {
   async onDelete(activity, actor) {
     const objectId = typeof activity.object === 'string' ? activity.object : activity.object?.id;
     if (!objectId) return 'Delete without object id';
-    if (!this.sameOrigin(objectId, actor)) return `Delete crosses origins (${objectId})`;
+    if (!this.sameIdentity(objectId, actor)) return `Delete crosses identities (${objectId})`;
     // `objectId === actor` is NOT evidence we care: it is true of EVERY account
     // deletion, and Mastodon broadcasts those constantly. Taking it as known
     // meant a signed dereference to a stranger's server for each one.
@@ -1592,13 +1798,6 @@ export class Intake {
     if (s.announceActivity) {
       await this.retract(s.noteId, { collect }).catch(e => this.log(`retract: ${e.message}`));
     }
-    if (s.slug) {
-      // Said out loud rather than swallowed: the status row is about to go, so
-      // a failure here leaves the note document in the private tree with
-      // nothing indexing it, and no other record that it is there.
-      await this.local.delete(this.local.fedi + 'timeline/' + s.slug)
-        .catch(e => this.log(`forget ${s.noteId}: its RDF note could NOT be removed (${e.message})`));
-    }
     this.store.removeStatus(s.noteId);
   }
 
@@ -1629,7 +1828,7 @@ export class Intake {
   async onUpdate(activity, actor) {
     const objectId = typeof activity.object === 'string' ? activity.object : activity.object?.id;
     if (!objectId) return 'Update without object id';
-    if (!this.sameOrigin(objectId, actor)) return `Update crosses origins (${objectId})`;
+    if (!this.sameIdentity(objectId, actor)) return `Update crosses identities (${objectId})`;
     if (objectId === actor) {                             // display name, avatar, bio
       // The same guard onDelete has, for the same reason: the inbox is
       // public-Append, so without it anyone can name any host and make us spend
@@ -1664,12 +1863,6 @@ export class Intake {
         poll: { ...freshPoll, voted: !!s.poll?.voted, ownVotes: s.poll?.ownVotes || [] },
       } : {}),
     });
-    if (s.slug) {
-      await this.local.writeNote('timeline', s.slug, {
-        noteId: note.id, actor: s.actor, published: note.published, content,
-        inReplyTo: note.inReplyTo, attachments,
-      }).catch(e => this.log(`rewrite ${s.slug}: ${e.message}`));
-    }
     this.log(`edited upstream: ${objectId}`);
   }
 
@@ -1695,11 +1888,11 @@ export class Intake {
     // collection, and rewriting on top of one erases every reply already
     // recorded. getJson returns null only for a genuine 404 — the document does
     // not exist yet — and throws otherwise, which the caller logs and retries.
-    const cur = await this.remote.getJson(url);
+    const cur = await podNotes.readReplies(this.remote, url);
     const items = Array.isArray(cur?.items) ? cur.items : [];
     if (items.includes(replyId)) return;
     items.push(replyId);
-    await this.remote.putJson(url, collection(url, items.slice(-MAX_REPLIES_RECORDED)));
+    await podNotes.writeReplies(this.remote, url, collection(url, items.slice(-MAX_REPLIES_RECORDED)));
     this.log(`reply recorded on ${parentId}`);
   }
 
@@ -1707,11 +1900,32 @@ export class Intake {
   // has recorded that we do not follow them; ours went on saying we did, and
   // published it — so the two disagreed permanently, and a retry would never
   // come because as far as they are concerned the question was answered.
-  async onReject(activity, actor) {
+  //
+  // It has to answer the Follow we actually SENT. Only the type was checked, so
+  // one Append per account you follow — from anyone, naming no particular
+  // follow — severed every one of them at once, and silently: their server
+  // never hears about it, so nothing ever retries and nothing looks wrong until
+  // the timeline goes quiet. `followActivity` is stored by followActor
+  // (lib/social.mjs) for exactly this kind of comparison.
+  async onReject(activity, actor, { trusted = false } = {}) {
     if (activity.object?.type && activity.object.type !== 'Follow') return;
     const contacts = this.store.getContacts();
     const rec = contacts.following.find(f => f.actor === actor);
     if (!rec) return;                                   // nothing of ours to undo
+    const named = typeof activity.object === 'string' ? activity.object : activity.object?.id;
+    const ours = rec.followActivity?.id;
+    // A gateway receipt bound to this actor is the other way to believe it —
+    // the door checked a signature and said whose (see receiptVouchesFor).
+    if (!trusted) {
+      if (!ours) {
+        this.log(`Reject from ${actor}: no follow id on record to match it against — ignored`);
+        return;
+      }
+      if (named !== ours) {
+        this.log(`Reject from ${actor} answers ${named || 'nothing'}, not the follow we sent — ignored`);
+        return;
+      }
+    }
     contacts.following = contacts.following.filter(f => f.actor !== actor);
     this.store.setContacts(contacts);
     await this.republish({ following: true, pending: true });
@@ -1741,7 +1955,7 @@ export class Intake {
     this.log(`${actor} moved to ${target} — follow the new account to keep seeing them`);
   }
 
-  async onAccept(activity, actor) {
+  async onAccept(activity, actor, { trusted = false } = {}) {
     const contacts = this.store.getContacts();
     const rec = contacts.following.find(f => f.actor === actor);
     // It has to answer the Follow we actually sent. followActor stores that
@@ -1750,8 +1964,11 @@ export class Intake {
     // including one answering a Follow we never made.
     const named = typeof activity.object === 'string' ? activity.object : activity.object?.id;
     const ours = rec?.followActivity?.id;
-    if (ours && named && named !== ours) {
-      this.log(`Accept from ${actor} answers ${named}, not the follow we sent — ignored`);
+    // `named &&` used to be part of this, so an Accept naming NOTHING sailed
+    // past — which is the easy one to send, and it marks a request to a locked
+    // account as accepted when it is still sitting in their queue.
+    if (ours && named !== ours && !trusted) {
+      this.log(`Accept from ${actor} answers ${named || 'nothing'}, not the follow we sent — ignored`);
       return;
     }
     if (rec && !rec.accepted) {