fedipod-server 0.11.0 → 0.13.0

package/lib/client/masto/body.mjs

@@ -0,0 +1,69 @@
+// body.mjs — reading what a client sent: JSON or form-encoded bodies, the
+// poll a compose request carries, and the text of a post back out of its
+// HTML.
+
+
+
+/**
+ * A poll out of a compose request, or null when there is none. A JSON client
+ * sends a `poll` object; a form-encoded one spells the same thing out in
+ * Rails's bracket notation, which is the shape the option list arrives in.
+ */
+export function pollParams(body) {
+  const nested = body?.poll && typeof body.poll === 'object' ? body.poll : null;
+  const options = [].concat(nested?.options ?? body?.['poll[options][]'] ?? [])
+    .map(o => String(o ?? '').trim()).filter(Boolean);
+  const rawExpiry = nested?.expires_in ?? body?.['poll[expires_in]'];
+  const rawMultiple = nested?.multiple ?? body?.['poll[multiple]'];
+  if (!options.length && rawExpiry === undefined) return null;
+  return {
+    options,
+    expiresIn: rawExpiry === undefined || rawExpiry === null || rawExpiry === ''
+      ? null : Number(rawExpiry),
+    multiple: rawMultiple === true || rawMultiple === 'true' || rawMultiple === '1',
+  };
+}
+
+// Accepts JSON or form-encoded bodies (OAuth posts are often form-encoded).
+// The source of a post that predates raw-text storage: its HTML back to
+// typed text, near enough to edit.
+export function htmlToText(html) {
+  return String(html)
+    .replace(/<br\s*\/?>/gi, '\n')
+    .replace(/<\/p>\s*<p[^>]*>/gi, '\n\n')
+    .replace(/<[^>]+>/g, '')
+    .replace(/&amp;/g, '&').replace(/&lt;/g, '<').replace(/&gt;/g, '>')
+    .replace(/&quot;/g, '"').replace(/&#39;/g, "'")
+    .trim();
+}
+
+export function readBody(req) {
+  return new Promise((resolve, reject) => {
+    let data = '';
+    req.on('data', c => {
+      data += c;
+      // Destroying the socket without settling left the awaiting handler
+      // pending for the life of the process and the client waiting on a
+      // response that would never come.
+      if (data.length > 1e6) { req.destroy(); reject(new Error('request body too large')); }
+    });
+    req.on('end', () => {
+      const ct = String(req.headers['content-type'] || '');
+      try {
+        if (ct.includes('application/json')) return resolve(data ? JSON.parse(data) : {});
+        // A form-encoded list is the same key repeated, spelled with a
+        // trailing `[]`. Reading it as a plain object kept only the last one,
+        // so a client sending its poll or its media that way lost all but the
+        // final value. Only the `[]` keys become lists: everything else keeps
+        // the single value the rest of this file reads.
+        const form = new URLSearchParams(data);
+        const out = {};
+        for (const key of new Set(form.keys())) {
+          out[key] = key.endsWith('[]') ? form.getAll(key) : form.get(key);
+        }
+        resolve(out);
+      } catch (e) { reject(e); }
+    });
+    req.on('error', reject);
+  });
+}

package/lib/client/masto/index.mjs

@@ -0,0 +1,183 @@
+// mastoapi.mjs — Mastodon client-API facade over ap-agent (M1: read + post).
+// Modeled on snac2's approach: real implementations for the endpoints
+// clients actually exercise, empty-collection stubs for the rest. Reached
+// through the router (/api/*, /oauth/* → this port), so requests carry the
+// gate; OAuth here is theater for a single already-trusted local user.
+//
+// Surface: oauth trio · instance v1/v2 · verify_credentials · timelines/home
+// (M1) · notifications, relationships, lookup, follow/unfollow, thread
+// context, /v2/search (M2) · favourite/reblog, media upload, markers,
+// DELETE status (M3) · stub farm. Unknown /api/* GETs 404 and are LOGGED —
+// that log is the running punch list.
+//
+// This file is the class and the dispatcher. The endpoints are in the modules
+// beside it, one per area — oauth.mjs, instance.mjs, accounts.mjs,
+// timelines.mjs, statuses.mjs, media.mjs — each exporting handle(api, ctx),
+// which answers and returns true or returns false; handle() below walks them
+// in order with the bearer gate between the public ones and the rest. The
+// JSON shapes are render.mjs and the request readers body.mjs; every helper
+// the areas reach through `api.` is a one-line delegation here.
+
+import { Push } from '../webpush.mjs';
+import * as oauth from './oauth.mjs';
+import * as render from './render.mjs';
+import * as instance from './instance.mjs';
+import * as accounts from './accounts.mjs';
+import * as timelines from './timelines.mjs';
+import * as statuses from './statuses.mjs';
+import * as media from './media.mjs';
+export { hashPassword } from './oauth.mjs';
+export { pollParams } from './body.mjs';
+export { attachmentType, extensionFor } from './media.mjs';
+
+export class MastoApi {
+  constructor({ agent, log = console.log, allowed = null, scheme = null, embedded = false,
+    streaming = true, webPush = true, scheduling = true }) {
+    this.agent = agent;
+    // A server-hosted identity has no CLI of its own, so the advice this gives
+    // when it refuses has to name the route that identity really has.
+    this.embedded = embedded;
+    this.log = log;
+    this.allowed = allowed;             // authorities a redirect_uri may name
+    // The scheme this identity is reached on, when the socket cannot say —
+    // a server behind a TLS proxy terminates cleartext and still is https.
+    this.scheme = scheme;
+    // Whether this deployment can serve the Mastodon streaming WebSocket. A
+    // Node agent can; the in-browser service-worker facade cannot (it is
+    // fetch-only), so it advertises NO streaming URL. Otherwise the client
+    // opens wss://localhost/... (the worker has no request host to name), which
+    // not only fails but, from a public origin, trips Chrome's private-network
+    // permission prompt ("access other apps and services on this device").
+    // With no streaming URL the client falls back to polling, which is served.
+    this.streaming = streaming;
+    // The same idea for two more capabilities the browser build does not have.
+    // A client decides what to offer from what the instance document says, so
+    // the honest thing is to say nothing rather than advertise and no-op.
+    //
+    // `webPush`: the browser build's web-push is a shim that mints a random
+    // placeholder VAPID key and whose sendNotification does nothing. Advertised,
+    // the client shows a notifications toggle that looks on and never fires.
+    // Omit `vapid` and it hides the toggle instead.
+    this.webPush = webPush;
+    // `scheduling`: a scheduled post is only a stored row until something
+    // publishes it when its time comes, and the only such tick is the Node
+    // agent's (run-agent.mjs). Where nothing ticks, accepting one is silent
+    // loss — the client says "scheduled" and the post never appears. Refusing
+    // it is worse UX and better behaviour.
+    this.scheduling = scheduling;
+    this.authzAttempts = [];            // password-attempt timestamps
+  }
+
+  get store() { return this.agent.store; }
+  get urls() { return this.agent.publisher?.urls; }
+  get push() {
+    this._push ||= new Push({
+      store: this.store,
+      subject: () => this.urls?.actor || 'https://localhost/',
+      log: this.log,
+    });
+    return this._push;
+  }
+  get host() { return this.urls ? new URL(this.urls.base).host : 'unconfigured.invalid'; }
+
+  // Where the live feed is, as the CLIENT must address it: this agent's own
+  // origin, taken from the request, not the pod's host. An instance document
+  // that leaves it empty is not merely unhelpful — clients read it without a
+  // guard and fall over, and every one of them loses live updates.
+  streamingUrl(req) {
+    if (!this.streaming) return null;   // fetch-only facade: no WebSocket, no wss://localhost prompt
+    const host = req?.headers?.host || `localhost:${this.port || ''}`;
+    const secure = this.scheme
+      ? this.scheme.startsWith('https')
+      : req?.headers?.['x-forwarded-proto'] === 'https' || !!req?.socket?.encrypted;
+    return `${secure ? 'wss' : 'ws'}://${host}/api/v1/streaming`;
+  }
+
+  static scopeFor(...a) { return oauth.scopeFor(...a); }
+  static scopeAllows(...a) { return oauth.scopeAllows(...a); }
+  static redirectMatches(...a) { return oauth.redirectMatches(...a); }
+  static provesCode(...a) { return oauth.provesCode(...a); }
+
+  // ---- request handling; returns true when handled ----
+  async handle(req, res, pathname, url) {
+    const send = (status, obj, headers = {}) => {
+      const body = JSON.stringify(obj);
+      res.writeHead(status, { 'content-type': 'application/json', ...headers });
+      res.end(body);
+      return true;
+    };
+    const ctx = { req, res, pathname, url, send };
+
+    if (await oauth.handle(this, ctx)) return true;
+    if (!pathname.startsWith('/api/')) return false;
+    if (await instance.handle(this, ctx)) return true;
+
+    // --- everything below needs a bearer token + a configured agent ---
+    const bearer = this.tokenOf(req);
+    if (!bearer) return send(401, { error: 'The access token is invalid' });
+    // One gate for every client route below, rather than a check in each of
+    // the fifty-odd branches — which is how the scope came to be recorded and
+    // never consulted in the first place.
+    const need = MastoApi.scopeFor(req.method, pathname);
+    if (!MastoApi.scopeAllows(bearer.scope, need)) {
+      this.log(`refused ${req.method} ${pathname}: token has "${bearer.scope}", needs "${need}"`);
+      return send(403, { error: `This action is outside the authorized scopes (needs ${need})` });
+    }
+    if (!this.agent.configured()) return send(503, { error: 'agent not configured' });
+    // A viewer-mode agent (another agent holds the drain lease) may not act —
+    // but a user acting HERE outranks the idle active agent elsewhere, so a
+    // write attempt claims the lease and proceeds. Only a failed claim 503s.
+    if (this.agent.viewer && req.method !== 'GET' && req.method !== 'HEAD') {
+      const took = await this.agent.requestTakeover?.();
+      if (!took) return send(503, { error: 'another agent is active for this pod — takeover failed, try again' });
+    }
+
+    for (const area of [accounts, timelines, statuses, media]) {
+      if (await area.handle(this, ctx)) return true;
+    }
+
+    this.log(`mastoapi: unhandled ${req.method} ${pathname} — punch list`);
+    return send(404, { error: `Unimplemented: ${req.method} ${pathname}` });
+  }
+
+  // oauth.mjs
+  tokenRecords(...a) { return oauth.tokenRecords(this, ...a); }
+  tokens(...a) { return oauth.tokens(this, ...a); }
+  mintToken(...a) { return oauth.mintToken(this, ...a); }
+  apps(...a) { return oauth.apps(this, ...a); }
+  authorizationServerMetadata(...a) { return oauth.authorizationServerMetadata(this, ...a); }
+  findApp(...a) { return oauth.findApp(this, ...a); }
+  resolveClientDocument(...a) { return oauth.resolveClientDocument(this, ...a); }
+  registerApp(...a) { return oauth.registerApp(this, ...a); }
+  mintCode(...a) { return oauth.mintCode(this, ...a); }
+  consumeCode(...a) { return oauth.consumeCode(this, ...a); }
+  tokenOf(...a) { return oauth.tokenOf(this, ...a); }
+  authed(...a) { return oauth.authed(this, ...a); }
+  redirectAllowed(...a) { return oauth.redirectAllowed(this, ...a); }
+  rateLimited(...a) { return oauth.rateLimited(this, ...a); }
+
+  // render.mjs
+  selfAccount(...a) { return render.selfAccount(this, ...a); }
+  account(...a) { return render.account(this, ...a); }
+  page(...a) { return render.page(this, ...a); }
+  bskyReply(...a) { return render.bskyReply(this, ...a); }
+  acctAction(...a) { return render.acctAction(this, ...a); }
+  acctReply(...a) { return render.acctReply(this, ...a); }
+  status(...a) { return render.status(this, ...a); }
+  filtersFor(...a) { return render.filtersFor(this, ...a); }
+  lookup(...a) { return render.lookup(this, ...a); }
+  statusOrBoost(...a) { return render.statusOrBoost(this, ...a); }
+  pushNotify(...a) { return render.pushNotify(this, ...a); }
+  scheduledJson(...a) { return render.scheduledJson(this, ...a); }
+  pollJson(...a) { return render.pollJson(this, ...a); }
+  mediaJson(...a) { return render.mediaJson(this, ...a); }
+  relationship(...a) { return render.relationship(this, ...a); }
+  notificationType(...a) { return render.notificationType(this, ...a); }
+  notification(...a) { return render.notification(this, ...a); }
+  accountSearch(...a) { return render.accountSearch(this, ...a); }
+
+  // instance.mjs
+  instanceTitle(...a) { return instance.instanceTitle(this, ...a); }
+  tagObject(...a) { return instance.tagObject(this, ...a); }
+  instanceBlurb(...a) { return instance.instanceBlurb(this, ...a); }
+}

package/lib/client/masto/instance.mjs

@@ -0,0 +1,104 @@
+// instance.mjs — what the instance says about itself: the v1 and v2 instance
+// documents, the limits a client reads from them, the title and blurb, the
+// tag object, and the empty-collection stubs for endpoints a single-actor
+// instance has nothing to say to.
+
+import { TRANSPARENT_PNG } from './render.mjs';
+import {
+  MAX_OPTIONS as POLL_MAX_OPTIONS, MAX_OPTION_CHARS as POLL_MAX_OPTION_CHARS,
+  MIN_SECONDS as POLL_MIN_SECONDS, MAX_SECONDS as POLL_MAX_SECONDS,
+} from '../../core/polls.mjs';
+
+const STUBS = new Map(Object.entries({
+  '/api/v1/filters': [],
+  '/api/v1/custom_emojis': [],
+  '/api/v1/announcements': [],
+  '/api/v1/instance/peers': [],
+  '/api/v1/trends/tags': [], '/api/v1/trends/links': [],
+  '/api/v2/suggestions': [],
+  '/api/v1/preferences': {},
+}));   // followed_tags is served live from the tag feed, not stubbed
+
+export function instanceConfig() {
+  return {
+    statuses: { max_characters: 5000, max_media_attachments: 4, characters_reserved_per_url: 23 },
+    media_attachments: {
+      supported_mime_types: ['image/jpeg', 'image/png', 'image/gif', 'image/webp',
+        'video/mp4', 'video/webm', 'audio/mpeg', 'audio/ogg'],
+      image_size_limit: 10 * 1024 * 1024, video_size_limit: 40 * 1024 * 1024,
+      image_matrix_limit: 16777216, video_matrix_limit: 2304000,
+    },
+    polls: {
+      max_options: POLL_MAX_OPTIONS,
+      max_characters_per_option: POLL_MAX_OPTION_CHARS,
+      min_expiration: POLL_MIN_SECONDS,
+      max_expiration: POLL_MAX_SECONDS,
+    },
+    accounts: { max_featured_tags: 0 },
+  };
+}
+
+// Every agent used to report title 'solid-activitypub', so a client holding two
+// of them showed two identical instances and you had to read the acct to tell
+// them apart. The title is free text no client parses — make it say who.
+export function instanceTitle(api) {
+  const cfg = api.store.getConfig();
+  return cfg?.handle ? `@${cfg.handle}@${api.host}` : 'FediPod';
+}
+
+// A Mastodon Tag object. The client reads `following` in its Followed
+// Hashtags view and toggles it with the follow/unfollow endpoints. No usage
+// history — a single-actor instance has no firehose stats to report.
+export function tagObject(api, name, following, req) {
+  const host = req?.headers?.host || api.host;
+  return { name, url: `https://${host}/tags/${name}`, history: [], following: !!following };
+}
+
+export function instanceBlurb(api) {
+  const kind = api.store.getConfig()?.kind === 'group' ? 'group' : 'actor';
+  return `Solid pod ActivityPub ${kind}`;
+}
+
+export async function handle(api, ctx) {
+  const { req, res, pathname, url, send } = ctx;   // eslint-disable-line no-unused-vars
+
+  // --- instance (public) ---
+  if (pathname === '/api/v1/instance') {
+    const su = api.streamingUrl(req);
+    return send(200, {
+      uri: api.host, title: api.instanceTitle(), short_description: api.instanceBlurb(),
+      description: api.instanceBlurb(), email: '', version: '4.2.0 (compatible; fedipod)',
+      urls: su ? { streaming_api: su } : {},
+      stats: { user_count: 1, status_count: api.store.countStatuses(), domain_count: 1 },
+      languages: ['en'], registrations: false, approval_required: false, invites_enabled: false,
+      configuration: instanceConfig(),
+      contact_account: null, rules: [],
+    });
+  }
+  if (pathname === '/api/v2/instance') {
+    const su = api.streamingUrl(req);
+    return send(200, {
+      domain: api.host, title: api.instanceTitle(), version: '4.2.0 (compatible; fedipod)',
+      source_url: 'https://github.com/jeff-zucker/FediPod', description: api.instanceBlurb(),
+      usage: { users: { active_month: 1 } },
+      thumbnail: { url: TRANSPARENT_PNG },
+      languages: ['en'],
+      // Both spellings: v2 clients read configuration.urls.streaming, older
+      // ones the top-level urls.streaming_api, and some fall back blindly.
+      // Omitted entirely when there is no streaming, so the client polls.
+      urls: su ? { streaming_api: su } : {},
+      configuration: {
+        ...instanceConfig(),
+        ...(su ? { urls: { streaming: su } } : {}),
+        ...(api.webPush ? { vapid: { public_key: api.push.publicKey() } } : {}),
+      },
+      registrations: { enabled: false, approval_required: false, message: null },
+      contact: { email: '', account: null }, rules: [],
+    });
+  }
+
+  const stub = STUBS.get(pathname);
+  if (stub !== undefined && req.method === 'GET') return send(200, stub);
+
+  return false;
+}

package/lib/client/masto/media.mjs

@@ -0,0 +1,133 @@
+// media.mjs — an upload on its way to the pod's media container: what an
+// attachment is allowed to be, the multipart reader, and the two media
+// endpoints.
+
+import crypto from 'node:crypto';
+import * as podMedia from '../../pod/media.mjs';
+import { readBody } from './body.mjs';
+
+// What an attachment is allowed to BE. Anything else is stored as bytes, which
+// a browser downloads rather than runs.
+const ATTACHMENT_KINDS = new Set(['image', 'video', 'audio']);
+// image/* with an exception: an SVG is a document, it carries script, and a
+// browser renders it rather than showing it. Mastodon does not take them as
+// media either.
+const NEVER = new Set(['image/svg+xml', 'image/svg']);
+const OPAQUE = 'application/octet-stream';
+
+export function attachmentType(claimed) {
+  const t = String(claimed || '').split(';')[0].trim().toLowerCase();
+  if (!/^[a-z0-9.+-]+\/[a-z0-9.+-]+$/.test(t) || NEVER.has(t)) return OPAQUE;
+  return ATTACHMENT_KINDS.has(t.split('/')[0]) ? t : OPAQUE;
+}
+
+// From the TYPE we accepted, not from the name the client sent — an `.html`
+// suffix on a file stored as octet-stream is what a pod would serve from, and
+// a filename is the client's to choose.
+export function extensionFor(mediaType, filename = '') {
+  if (mediaType === OPAQUE) return 'bin';
+  const sub = mediaType.split('/')[1].replace(/[^a-z0-9]/g, '');
+  const given = String(filename || '').includes('.')
+    ? filename.split('.').pop().toLowerCase().replace(/[^a-z0-9]/g, '') : '';
+  // Keep the client's suffix only when it plainly belongs to the accepted type,
+  // so jpg/jpeg and mp4/m4v survive without a table of every media type.
+  return given && (given === sub || sub.startsWith(given) || given.startsWith(sub)) ? given : (sub || 'bin');
+}
+
+// Minimal multipart/form-data reader for media uploads: string fields plus
+// at most one file part (Mastodon's media endpoints send exactly one).
+export function readMultipart(req, limit = 12e6) {
+  return new Promise((resolve, reject) => {
+    const chunks = [];
+    let n = 0;
+    req.on('data', c => {
+      n += c.length;
+      if (n > limit) { reject(new Error('upload too large')); req.destroy(); return; }
+      chunks.push(c);
+    });
+    req.on('error', reject);
+    req.on('end', () => {
+      try {
+        const m = /boundary=(?:"([^"]+)"|([^;]+))/.exec(String(req.headers['content-type'] || ''));
+        if (!m) return resolve({ fields: {}, file: null });
+        const buf = Buffer.concat(chunks);
+        const boundary = Buffer.from('--' + (m[1] || m[2]).trim());
+        const fields = {};
+        // `file` is the last one seen, which is what the single-file media
+        // upload wants. `files` keys them by field name, because the profile
+        // editor submits an avatar and a header in one request.
+        const files = {};
+        let file = null;
+        let i = buf.indexOf(boundary);
+        while (i >= 0) {
+          const start = i + boundary.length;
+          if (buf.slice(start, start + 2).toString() === '--') break;
+          const next = buf.indexOf(boundary, start);
+          if (next < 0) break;
+          const part = buf.slice(start + 2, next - 2);        // strip the CRLFs framing the part
+          const sep = part.indexOf('\r\n\r\n');
+          if (sep >= 0) {
+            const head = part.slice(0, sep).toString();
+            const body = part.slice(sep + 4);
+            const name = /name="([^"]*)"/.exec(head)?.[1];
+            const filename = /filename="([^"]*)"/.exec(head)?.[1];
+            if (filename !== undefined) {
+              file = {
+                filename,
+                contentType: /content-type:\s*([^\r\n]+)/i.exec(head)?.[1]?.trim() || 'application/octet-stream',
+                data: body,
+              };
+              if (name) files[name] = file;
+            } else if (name) fields[name] = body.toString();
+          }
+          i = next;
+        }
+        resolve({ fields, file, files });
+      } catch (e) { reject(e); }
+    });
+  });
+}
+
+export async function handle(api, ctx) {
+  const { req, res, pathname, url, send } = ctx;   // eslint-disable-line no-unused-vars
+
+  // Media upload: file → remote pod /ap/media/ (public-Read), entry in the
+  // media registry so a later POST /statuses can attach it.
+  if ((pathname === '/api/v2/media' || pathname === '/api/v1/media') && req.method === 'POST') {
+    const { fields, file } = await readMultipart(req);
+    if (!file?.data?.length) return send(422, { error: 'file required' });
+    // The client said what this is, and we used to believe it. The media
+    // container is world-readable and sits on the pod's own origin — the same
+    // origin as the WebID and the ACLs — so a file stored as text/html is a
+    // page served from your identity, and script in it runs as you in any
+    // browser already logged into that pod. A bearer is not "only you": the
+    // facade exists so third-party clients can connect, tokens last 90 days,
+    // and no scope is enforced. So any client you authorize could leave that
+    // page behind.
+    const mediaType = attachmentType(file.contentType);
+    const ext = extensionFor(mediaType, file.filename);
+    const slug = new Date().toISOString().slice(0, 10) + '-' + crypto.randomBytes(4).toString('hex') + '.' + ext;
+    const mediaUrl = api.urls.media + slug;
+    await api.agent.publisher.ensureMediaContainer();
+    await podMedia.write(api.agent.remote, mediaUrl, file.data, mediaType);
+    const entry = { url: mediaUrl, mediaType, description: fields.description || '' };
+    const id = api.store.idFor(mediaUrl);
+    api.store.setMedia(id, entry);
+    return send(200, api.mediaJson({ id, ...entry }));
+  }
+  const mMedia = /^\/api\/v1\/media\/([a-f0-9]+)$/.exec(pathname);
+  if (mMedia) {
+    const entry = api.store.getMedia()[mMedia[1]];
+    if (!entry) return send(404, { error: 'Record not found' });
+    if (req.method === 'PUT') {
+      const body = await readBody(req);
+      if (typeof body.description === 'string') {
+        entry.description = body.description;
+        api.store.setMedia(mMedia[1], entry);
+      }
+    }
+    return send(200, api.mediaJson({ id: mMedia[1], ...entry }));
+  }
+
+  return false;
+}