fedipod-server 0.11.0 → 0.13.0

package/lib/core/shapes/activitystreams.ttl

@@ -0,0 +1,129 @@
+# activitystreams.ttl — shapes for the ActivityStreams documents an identity
+# reads from strangers.
+#
+# Shapes are identified by fragments of this document, so nothing here claims a
+# namespace of its own.
+#
+# These are deliberately thin. They state what the ActivityPub specification
+# requires and nothing more, because every fediverse implementation writes
+# slightly different documents and a constraint beyond the spec is a constraint
+# that fires on somebody's real traffic. Nothing here rejects anything: a
+# failure is recorded and the activity is handled. A shape earns its way to
+# being enforced by not firing.
+
+@prefix sh:   <http://www.w3.org/ns/shacl#> .
+@prefix as:   <https://www.w3.org/ns/activitystreams#> .
+@prefix ldp:  <http://www.w3.org/ns/ldp#> .
+@prefix xsd:  <http://www.w3.org/2001/XMLSchema#> .
+
+# --- the actor document ------------------------------------------------------
+
+<#Actor>
+  a sh:NodeShape ;
+  sh:targetClass as:Person, as:Service, as:Group, as:Organization, as:Application ;
+  sh:name "Actor" ;
+  sh:description "Someone or something that acts: it has an address activities are sent to, and a name it is addressed by." ;
+  sh:property [
+    sh:path ldp:inbox ;
+    sh:name "inbox" ;
+    sh:description "The collection an actor receives activities in." ;
+    sh:nodeKind sh:IRI ;
+    sh:minCount 1 ;
+    sh:maxCount 1 ;
+  ] ;
+  sh:property [
+    sh:path as:preferredUsername ;
+    sh:name "preferred username" ;
+    sh:description "The short name an actor is addressed by, the local part of its @handle@host address." ;
+    sh:datatype xsd:string ;
+    sh:maxCount 1 ;
+  ] .
+
+# --- the activities an identity acts on --------------------------------------
+#
+# Each states the two things ActivityPub requires of an activity: who performed
+# it, and what it is about.
+
+<#Create>
+  a sh:NodeShape ;
+  sh:targetClass as:Create ;
+  sh:name "Create" ;
+  sh:description "The bringing into existence of the object it names." ;
+  sh:property [
+    sh:path as:actor ;
+    sh:name "actor" ;
+    sh:description "The one that performed the activity." ;
+    sh:nodeKind sh:BlankNodeOrIRI ;
+    sh:minCount 1 ;
+    sh:maxCount 1 ;
+  ] ;
+  sh:property [
+    sh:path as:object ;
+    sh:name "object" ;
+    sh:description "The thing the activity is about." ;
+    sh:minCount 1 ;
+    sh:maxCount 1 ;
+  ] .
+
+<#Follow>
+  a sh:NodeShape ;
+  sh:targetClass as:Follow ;
+  sh:name "Follow" ;
+  sh:description "A request to receive what the object it names publishes." ;
+  sh:property [
+    sh:path as:actor ;
+    sh:name "actor" ;
+    sh:description "The one that performed the activity." ;
+    sh:nodeKind sh:BlankNodeOrIRI ;
+    sh:minCount 1 ;
+    sh:maxCount 1 ;
+  ] ;
+  sh:property [
+    sh:path as:object ;
+    sh:name "object" ;
+    sh:description "The thing the activity is about." ;
+    sh:minCount 1 ;
+    sh:maxCount 1 ;
+  ] .
+
+<#Accept>
+  a sh:NodeShape ;
+  sh:targetClass as:Accept ;
+  sh:name "Accept" ;
+  sh:description "Assent to the activity it names." ;
+  sh:property [
+    sh:path as:actor ;
+    sh:name "actor" ;
+    sh:description "The one that performed the activity." ;
+    sh:nodeKind sh:BlankNodeOrIRI ;
+    sh:minCount 1 ;
+    sh:maxCount 1 ;
+  ] ;
+  sh:property [
+    sh:path as:object ;
+    sh:name "object" ;
+    sh:description "The thing the activity is about." ;
+    sh:minCount 1 ;
+    sh:maxCount 1 ;
+  ] .
+
+<#Undo>
+  a sh:NodeShape ;
+  sh:targetClass as:Undo ;
+  sh:name "Undo" ;
+  sh:description "The retraction of the activity it names, by the one that performed it." ;
+  sh:property [
+    sh:path as:actor ;
+    sh:name "actor" ;
+    sh:description "The one that performed the activity." ;
+    sh:nodeKind sh:BlankNodeOrIRI ;
+    sh:minCount 1 ;
+    sh:maxCount 1 ;
+  ] ;
+  sh:property [
+    sh:path as:object ;
+    sh:name "object" ;
+    sh:description "The thing the activity is about." ;
+    sh:minCount 1 ;
+    sh:maxCount 1 ;
+  ] .

package/lib/core/shapes/index.mjs

@@ -0,0 +1,107 @@
+// shapes/index.mjs — validating an ActivityStreams document against the shapes
+// beside this file.
+//
+// A shape says what a kind of document IS. Checking one against a document we
+// were sent is a different question from whether we trust it: a forged actor,
+// a receipt that does not bind, a reply naming a note we never wrote are each
+// guarded elsewhere, and none of those guards is replaced here.
+//
+// NOTHING HERE REJECTS ANYTHING. A failure is recorded and the activity is
+// handled exactly as it would have been. Every fediverse implementation writes
+// slightly different documents, and a shape strict enough to catch something
+// real is strict enough to reject somebody's quirk; which one cannot be known
+// in advance, so it is learned from the record rather than guessed at. A shape
+// earns enforcement by not firing.
+
+import { Parser } from 'n3';
+import Environment from '@rdfjs/environment';
+import DataFactory from '@rdfjs/data-model/Factory.js';
+import DatasetFactory from '@rdfjs/dataset/Factory.js';
+import NamespaceFactory from '@rdfjs/namespace/Factory.js';
+import TermSetFactory from '@rdfjs/term-set/Factory.js';
+import TermMapFactory from '@rdfjs/term-map/Factory.js';
+import ClownfaceFactory from 'clownface/Factory.js';
+import SHACLValidator from 'rdf-validate-shacl';
+import { SHAPES_TTL } from './shapes-text.mjs';
+
+// The validator needs a full RDF/JS environment, not a bare factory. These
+// pieces are what rdf-validate-shacl itself depends on, composed here rather
+// than pulling in a packaged environment that reads files — this has to run in
+// a service worker too.
+const rdf = new Environment([DataFactory, DatasetFactory, NamespaceFactory, TermSetFactory, TermMapFactory, ClownfaceFactory]);
+
+// The shapes document's own URL is the base, so `<#Create>` resolves to a
+// fragment of it and no namespace is claimed.
+const SHAPES_BASE = 'https://fedipod.invalid/shapes';
+
+let validator;
+let brokenReported = false;
+
+/** The validator, built once. Reading and parsing the shapes is not per-document work. */
+function shacl() {
+  if (!validator) {
+    const quads = new Parser({ baseIRI: SHAPES_BASE, format: 'text/turtle' }).parse(SHAPES_TTL);
+    validator = new SHACLValidator(rdf.dataset(quads.map(asTerm)), { factory: rdf });
+  }
+  return validator;
+}
+
+/** jsonld and n3 each mint their own terms; the validator's environment must mint the ones it sees. */
+function asTerm(q) {
+  const term = (t) => {
+    if (t.termType === 'NamedNode') return rdf.namedNode(t.value);
+    if (t.termType === 'BlankNode') return rdf.blankNode(String(t.value).replace(/^_:/u, ''));
+    if (t.termType === 'Literal') {
+      return rdf.literal(t.value, t.language || (t.datatype ? rdf.namedNode(t.datatype.value) : undefined));
+    }
+    return rdf.defaultGraph();
+  };
+  return rdf.quad(term(q.subject), term(q.predicate), term(q.object));
+}
+
+/**
+ * Check a document's graph against the shapes.
+ *
+ * `quads` is what `parseAS2` produced. Returns null when the document
+ * conforms or when there was no graph to check, and otherwise a short record
+ * of what did not fit — the failing node, the property, and the shape's own
+ * words for it.
+ *
+ * Never throws. A validator that cannot run is not a reason to drop mail — but
+ * it is said once, because a checker that silently passes everything is the
+ * same silence this change exists to remove.
+ */
+export async function checkShapes(quads) {
+  if (!Array.isArray(quads) || quads.length === 0) return null;
+  let report;
+  try {
+    report = await shacl().validate(rdf.dataset(quads.map(asTerm)));
+  } catch (e) {
+    // A validator that cannot run must not read as "everything conforms" —
+    // that is the same silence this whole change exists to remove. Said once,
+    // then quiet, because a broken validator would otherwise say it per item.
+    if (!brokenReported) {
+      brokenReported = true;
+      return { conforms: false, broken: true, results: [{ focus: null, path: null, message: `shape validation is not running: ${e.message}`, shape: null }] };
+    }
+    return null;
+  }
+  if (report.conforms) return null;
+  return {
+    conforms: false,
+    results: report.results.slice(0, 10).map((r) => ({
+      focus: r.focusNode?.value ?? null,
+      path: r.path?.value ?? null,
+      message: r.message?.[0]?.value ?? String(r.sourceConstraintComponent?.value ?? 'does not fit the shape'),
+      shape: r.sourceShape?.value ?? null,
+    })),
+  };
+}
+
+/** The failure as one line, for a log or a dead-letter record. */
+export function describeShapeFailure(failure) {
+  if (!failure) return null;
+  return failure.results
+    .map((r) => `${r.path ? r.path.replace(/^.*[#/]/u, '') : 'node'}: ${r.message}`)
+    .join('; ');
+}

package/lib/core/shapes/shapes-text.mjs

@@ -0,0 +1,13 @@
+// shapes-text.mjs — the shapes document, as text.
+//
+// The shapes are authored as Turtle in activitystreams.ttl, which is the one
+// source of truth and opens in any RDF tool. Reading it differs by where this
+// runs: Node reads the file, and the browser bundle swaps this module for a
+// shim that imports the same .ttl through esbuild's text loader.
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+export const SHAPES_TTL = fs.readFileSync(
+  path.join(path.dirname(fileURLToPath(import.meta.url)), 'activitystreams.ttl'), 'utf8',
+);

package/lib/{social.mjs → core/social.mjs}

@@ -5,7 +5,7 @@
 
 import crypto from 'node:crypto';
 import * as wire from './wire.mjs';
-import * as podNotes from './pod/notes.mjs';
+import * as podNotes from '../pod/notes.mjs';
 import { dropFollower } from './store.mjs';
 
 // WebFinger, ours rather than fedify's — v2 dropped lookupWebFinger.
@@ -21,7 +21,7 @@ export async function lookupWebFinger(acct) {
   if (at < 1) return null;
   const [user, host] = [clean.slice(0, at), clean.slice(at + 1)];
   if (!host || /[/\\?#]/.test(host)) return null;
-  const { safeFetch, readCapped } = await import('./safefetch.mjs');
+  const { safeFetch, readCapped } = await import('../shared/safefetch.mjs');
   const url = `https://${host}/.well-known/webfinger?resource=${encodeURIComponent(`acct:${clean}`)}`;
   const res = await safeFetch(url, {
     headers: { accept: 'application/jrd+json, application/json' },

package/lib/{store.mjs → core/store.mjs}

@@ -152,6 +152,10 @@ export class PodStore {
 
   has(name) { return this.cache.has(name); }
 
+  // The documents held here. Callers that keep one document per thing — a
+  // connected account, say — list them with this rather than a fixed name.
+  names() { return [...this.cache.keys()]; }
+
   read(name, fallback) {
     return this.cache.has(name) ? structuredClone(this.cache.get(name)) : fallback;
   }

package/lib/{wire.mjs → core/wire.mjs}

@@ -11,9 +11,9 @@ export const PUBLIC = 'https://www.w3.org/ns/activitystreams#Public';
 // the container root to be stated rather than defaulted. What stays here is
 // FediPod's own answer to "which root", and the handle rule, both of which read
 // this application's config shape.
-import { apUrls as podUrls } from './pod/urls.mjs';
+import { apUrls as podUrls } from '../pod/urls.mjs';
 
-export { webfingerHost } from './pod/urls.mjs';
+export { webfingerHost } from '../pod/urls.mjs';
 
 // The container the Node agent has always used. Older than the rename to
 // FediPod and kept because it is what every existing Node-side pod actually

package/lib/device/admin/index.mjs

@@ -0,0 +1,13 @@
+// admin.mjs — loopback HTTP front: admin API + Mastodon client-API facade +
+// the bundled Phanpy UI served same-origin (no CORS, no mixed content — the
+// role data-kitchen's router plays for the in-app pane). Loopback-bound; the
+// gate (vendor/gate.cjs) engages only when a token is configured, exactly
+// its standalone behavior.
+//
+// The surface is surface.mjs, its routes are the modules under routes/, the
+// static serving is static.mjs, the listener is server.mjs. This file is the
+// door the rest of the agent imports through.
+
+export { buildAdminSurface } from './surface.mjs';
+export { startAdmin } from './server.mjs';
+export { namedOrigin, secureOrigin, wsOrigins } from './origins.mjs';

package/lib/device/admin/origins.mjs

@@ -0,0 +1,35 @@
+// origins.mjs — the addresses an identity answers on, as a browser must be
+// sent to them.
+
+import { allowedAuthorities, hostLabel } from '../../shared/guard.mjs';
+
+// The origin a browser should be sent to for an identity. A browser keys
+// storage per ORIGIN, so linking every identity at localhost:<port> files them
+// all in one bucket — which is how a client ends up holding one actor's login
+// and showing it on another's page. Named whenever the handle is a legal host
+// label; bare loopback when it is not, because a mangled name would be an
+// origin the other agent's own guard refuses.
+export function namedOrigin(handle, port) {
+  const label = hostLabel(handle);
+  return `http://${label ? label + '.' : ''}localhost:${port}`;
+}
+
+// The https origin for an identity, on the one port it was given.
+// This is the advertised default — what gets printed, opened and linked; the
+// http listener stays served beside it for anything that needs cleartext.
+export function secureOrigin(handle, httpsPort) {
+  const label = hostLabel(handle);
+  return `https://${label ? label + '.' : ''}localhost:${httpsPort}`;
+}
+
+export function wsOrigins(port, labels = []) {
+  const out = new Set();
+  for (const a of allowedAuthorities(port, labels)) {
+    // No IPv6 at all. Bare `::1` cannot carry a port, and Chrome rejects the
+    // bracketed form inside a CSP source expression — one invalid source makes
+    // it drop the whole directive, which is worse than not listing the socket.
+    if (a.startsWith('::') || a.startsWith('[')) continue;
+    out.add(`wss://${/:\d+$/.test(a) ? a : `${a}:${port}`}`);
+  }
+  return [...out];
+}

package/lib/device/admin/routes/connections.mjs

@@ -0,0 +1,144 @@
+// connections.mjs — the accounts held elsewhere: a Bluesky account and
+// accounts on other fediverse servers, connected, adjusted, disconnected;
+// and the page the other server's sign-in comes back to.
+
+
+
+// The page the other server's redirect lands on. Self-contained on purpose:
+// the browser arrives here from somewhere else, and nothing may load from
+// that somewhere.
+function callbackPage(ok, msg) {
+  const esc = (s) => String(s).replace(/[&<>"]/g, c => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;' }[c]));
+  const head = ok ? 'Account connected' : 'Not connected';
+  return `<!doctype html>
+<html lang="en"><head><meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>${head}</title>
+<style>
+  :root { color-scheme: light dark; }
+  body { font: 16px/1.7 system-ui, -apple-system, sans-serif; margin: 0;
+         padding: 2.5rem 2rem; background: #ffffff; color: #1a1a1a; }
+  main { max-width: 32rem; margin: 0 auto; }
+  h1 { font-size: 1.375rem; font-weight: 500; margin: 0 0 1rem; }
+  p { margin: 0 0 1rem; }
+  @media (prefers-color-scheme: dark) {
+    body { background: #16161a; color: #ececf0; }
+  }
+</style></head>
+<body><main>
+<h1>${head}</h1>
+<p>${esc(msg)}</p>
+<p>You can close this tab and go back to FediPod.</p>
+</main></body></html>
+`;
+}
+
+export async function get(p, ctx, req, res, url) {   // eslint-disable-line no-unused-vars
+  const { agent, log, allowed, embedded, port, publicOrigin, versionOnDisk, isGroup } = ctx;   // eslint-disable-line no-unused-vars
+  const json = (res, status, obj) => { ctx.json(res, status, obj); return true; };
+
+  if (req.method === 'GET' && p === '/fediacct') {
+    return json(res, 200, { accounts: agent.fediaccts?.status() || [] });
+  }
+  // Where the other server sends the browser back. A GET, so it gets none
+  // of the POST branch's local-only protection for free and asks for its
+  // own — a code arriving from anywhere else is not the owner's.
+  if (req.method === 'GET' && p === '/fediacct/callback') {
+    if (!embedded && !allowed.isLocalRequest(req)) {
+      return json(res, 403, { error: 'connecting an account is available on this machine only' });
+    }
+    const q = new URL(req.url, 'https://x.invalid').searchParams;
+    const done = (ok, msg) => {
+      res.writeHead(ok ? 200 : 400, { 'content-type': 'text/html; charset=utf-8' });
+      res.end(callbackPage(ok, msg));
+      return true;
+    };
+    if (q.get('error')) return done(false, q.get('error_description') || q.get('error'));
+    if (!q.get('code') || !q.get('state')) return done(false, 'that sign-in came back incomplete');
+    try {
+      const row = await agent.fediaccts.complete({ state: q.get('state'), code: q.get('code') });
+      const cfg = agent.store.getConfig();
+      agent.store.setConfig({ ...cfg, fediAccounts: agent.fediaccts.roster() });
+      await agent.store.flush();
+      agent.restartAccts?.();
+      return done(true, `${row.handle} is connected.`);
+    } catch (e) { return done(false, e.message); }
+  }
+
+  return false;
+}
+
+export async function post(p, body, ctx, req, res) {   // eslint-disable-line no-unused-vars
+  const { agent, log, allowed, embedded, port, publicOrigin, versionOnDisk, isGroup } = ctx;   // eslint-disable-line no-unused-vars
+  const json = (res, status, obj) => { ctx.json(res, status, obj); return true; };
+  switch (p) {
+    case '/atproto/connect': {
+      // The one endpoint that ever sees the app password; loopback-only.
+      if (!body.identifier || !body.appPassword) {
+        return json(res, 400, { error: 'identifier and appPassword required' });
+      }
+      const conn = await agent.atproto.connect({
+        service: body.service, identifier: body.identifier, appPassword: body.appPassword,
+      });
+      const cfg = agent.store.getConfig();
+      agent.store.setConfig({
+        ...cfg,
+        atproto: { ...conn, crossPost: cfg.atproto?.crossPost ?? true },
+      });
+      await agent.store.flush();
+      agent.startBsky?.();
+      return json(res, 200, { ok: true, ...agent.atproto.status() });
+    }
+    case '/atproto/disconnect': {
+      agent.stopBsky?.();
+      await agent.atproto.disconnect();
+      const { atproto, ...rest } = agent.store.getConfig();
+      agent.store.setConfig(rest);
+      await agent.store.flush();
+      return json(res, 200, { ok: true });
+    }
+    case '/atproto': {
+      // Non-secret settings only — today that is the cross-post toggle.
+      const cfg = agent.store.getConfig();
+      if (!cfg.atproto) return json(res, 400, { error: 'no bluesky account connected' });
+      agent.store.setConfig({
+        ...cfg, atproto: { ...cfg.atproto, crossPost: !!body.crossPost },
+      });
+      await agent.store.flush();
+      return json(res, 200, { ok: true, atproto: { ...cfg.atproto, crossPost: !!body.crossPost } });
+    }
+    case '/fediacct/connect': {
+      // Starts the sign-in at the other server. Loopback-only, and the
+      // redirect returns to the origin the owner is actually using, not a
+      // guess — a client reaches this agent by several names.
+      if (!body.host) return json(res, 400, { error: 'the address of the server is required' });
+      try {
+        const { url } = await agent.fediaccts.begin({
+          host: body.host, redirectUri: `https://${req.headers.host}/fediacct/callback`,
+        });
+        return json(res, 200, { ok: true, authorize: url });
+      } catch (e) { return json(res, 400, { error: e.message }); }
+    }
+    case '/fediacct/disconnect': {
+      if (!body.id) return json(res, 400, { error: 'id required' });
+      if (!await agent.fediaccts.remove(body.id)) return json(res, 404, { error: 'no such account' });
+      const cfg = agent.store.getConfig();
+      agent.store.setConfig({ ...cfg, fediAccounts: agent.fediaccts.roster() });
+      await agent.store.flush();
+      agent.restartAccts?.();
+      return json(res, 200, { ok: true });
+    }
+    case '/fediacct': {
+      // Non-secret settings only — today that is whether it is polled.
+      if (!body.id) return json(res, 400, { error: 'id required' });
+      const row = agent.fediaccts.setEnabled(body.id, !!body.enabled);
+      if (!row) return json(res, 404, { error: 'no such account' });
+      const cfg = agent.store.getConfig();
+      agent.store.setConfig({ ...cfg, fediAccounts: agent.fediaccts.roster() });
+      await agent.store.flush();
+      agent.restartAccts?.();
+      return json(res, 200, { ok: true, account: row });
+    }
+    default: return false;
+  }
+}