fedipod-server 0.11.0 → 0.13.0

package/web/app/agent.mjs

@@ -5,29 +5,28 @@
 // the signing key comes from WebCrypto (keys-browser), and delivery goes through
 // the relay (deliver-relay). Everything between — wire, the store, the
 // publisher, intake, the Mastodon facade — is lib/, unchanged.
-import { apUrls } from '../../lib/wire.mjs';
+import { apUrls } from '../../lib/core/wire.mjs';
 import * as containers from '../../lib/pod/containers.mjs';
 import * as podState from '../../lib/pod/state.mjs';
-import { PodStore } from '../../lib/store.mjs';
-import { HttpStorage } from '../../lib/storage.mjs';
-import { Publisher } from '../../lib/publisher.mjs';
-import { Intake } from '../../lib/intake.mjs';
-import { Lease } from '../../lib/lease.mjs';
-import { MastoApi } from '../../lib/mastoapi.mjs';
-import { TagFeed } from '../../lib/tagfeed.mjs';
+import { PodStore } from '../../lib/core/store.mjs';
+import { HttpStorage } from '../../lib/core/storage.mjs';
+import { Publisher } from '../../lib/core/publisher/index.mjs';
+import { Intake } from '../../lib/core/intake/index.mjs';
+import { Lease } from '../../lib/core/lease.mjs';
+import { MastoApi } from '../../lib/client/masto/index.mjs';
+import { TagFeed } from '../../lib/connections/tagfeed.mjs';
 import { makeDpopSession } from './pod-auth.mjs';
 import { BrowserRemotePod } from './pod-remote.mjs';
-import { importSigningKey, loadKeysFromPod, keyCacheKey } from './keys-browser.mjs';
+import { importSigningKey, loadKeysFromPod, cacheOpenedKeys } from './keys-browser.mjs';
 import { generateKeys, wrapKeys } from './keystore.mjs';
-import { kvPut } from './idb-kv.mjs';
 import { RelayDeliverer } from './deliver-relay.mjs';
 import { AdminFacade } from './admin-facade.mjs';
 import { BrowserAtproto } from './atproto-browser.mjs';
-import { BskyFeed } from '../../lib/bskyfeed.mjs';
+import { BskyFeed } from '../../lib/connections/bskyfeed.mjs';
 import { BrowserFediAccounts } from './fediacct-browser.mjs';
-import { AcctFeed } from '../../lib/acctfeed.mjs';
-import { followActor, unfollowActor } from '../../lib/social.mjs';
-import { ImportWorker } from '../../lib/import.mjs';
+import { AcctFeed } from '../../lib/connections/acctfeed.mjs';
+import { followActor, unfollowActor } from '../../lib/core/social.mjs';
+import { ImportWorker } from '../../lib/connections/import.mjs';
 
 // The authorities this identity answers on: exactly one, this origin. The Node
 // agent gets this from lib/guard.mjs, which is not in the browser bundle and
@@ -364,8 +363,7 @@ export class BrowserAgent {
     const rec = await generateKeys();
     rec.mintedFor = this.urls.actor;                  // one key, one actor (lib/keys.mjs)
     await podState.writeWrappedKeys(this.remote, this.urls, await wrapKeys(rec, password));
-    await kvPut(keyCacheKey(this.urls.actor), rec).catch(() => {});
-    const keys = await importSigningKey(rec);
+    const keys = await cacheOpenedKeys(this.urls.actor, rec);
     this.publisher.publicKeyPem = keys.rsaPublicPem;
     this.deliverer.rsaPrivate = keys.rsaPrivate;
     await this.publisher.publishProfile();

package/web/app/atproto-browser.mjs

@@ -10,7 +10,7 @@
 //  2. The mirror can be paused (feedPaused) without disconnecting.
 //
 // Bluesky's API answers CORS, so the fetches go direct, not through the relay.
-import { Atproto } from '../../lib/atproto.mjs';
+import { Atproto } from '../../lib/connections/atproto.mjs';
 import { kvGet, kvPut, kvDel } from './idb-kv.mjs';
 
 const IDB_KEY = 'atproto';

package/web/app/boot.mjs

@@ -15,8 +15,7 @@ import * as podState from '../../lib/pod/state.mjs';
 import { BrowserRemotePod } from './pod-remote.mjs';
 import { beginLogin, completeLogin, getSession, signOut } from './oidc-session.mjs';
 import { unwrapKeys, isKeyEnvelope } from './keystore.mjs';
-import { kvPut } from './idb-kv.mjs';
-import { keyCacheKey } from './keys-browser.mjs';
+import { cacheOpenedKeys } from './keys-browser.mjs';
 
 const REDIRECT = `${location.origin}/`;   // the app root doubles as the OIDC callback
 
@@ -83,7 +82,7 @@ window.fedipodUnlock = async (password) => {
   if (!isKeyEnvelope(doc)) throw new Error('this account\'s key is not locked — nothing to unlock');
   const rec = await unwrapKeys(doc, password);          // throws 'wrong password'
   const actorUrl = `${cfg.remotePod}${cfg.root || AP_ROOT}ap/actor`;
-  await kvPut(keyCacheKey(actorUrl), rec);
+  await cacheOpenedKeys(actorUrl, rec);
   await bootWorker();
 };
 

package/web/app/deliver-relay.mjs

@@ -7,7 +7,7 @@
 // which sends it verbatim. Everything else — the retry queue, the cooling
 // hosts, the dead-letter, FEP-8b32 proofs — is the Node Deliverer, reused by
 // overriding only the one network step.
-import { Deliverer } from '../../lib/deliver.mjs';
+import { Deliverer } from '../../lib/core/deliver.mjs';
 import { sign } from './shims/fedify-sig.mjs';
 
 export class RelayDeliverer extends Deliverer {

package/web/app/dist/boot.js

@@ -33231,6 +33231,26 @@ async function kvPut(key, val) {
 }
 
 // web/app/keys-browser.mjs
+var pemToDer = (pem) => Uint8Array.from(
+  atob(pem.replace(/-----[^-]+-----/g, "").replace(/\s+/g, "")),
+  (c) => c.charCodeAt(0)
+);
+async function importSigningKey(keysRecord) {
+  const rsaPrivate = await crypto.subtle.importKey(
+    "pkcs8",
+    pemToDer(keysRecord.rsa.privatePem),
+    { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" },
+    false,
+    ["sign"]
+  );
+  return { rsaPrivate, rsaPublicPem: keysRecord.rsa.publicPem, edPrivate: null, edPublicMultibase: null };
+}
+async function cacheOpenedKeys(actorUrl, keysRecord) {
+  const keys = await importSigningKey(keysRecord);
+  await kvPut(keyCacheKey(actorUrl), { rsaPrivate: keys.rsaPrivate, rsaPublicPem: keys.rsaPublicPem }).catch(() => {
+  });
+  return keys;
+}
 var keyCacheKey = (actorUrl) => `signing-keys:${actorUrl}`;
 
 // web/app/signup.mjs
@@ -33321,8 +33341,7 @@ async function signUp(answers, { onStep = () => {
     } catch (e) {
       throw new Error(`could not store the signing key on the pod (${e.message}). The credential is for ${credential.webId} \u2014 that WebID must own ${pod} and its ${AP_ROOT} must be writable by it.`);
     }
-    await kvPut(keyCacheKey(actorUrl), keys).catch(() => {
-    });
+    await cacheOpenedKeys(actorUrl, keys);
     prog.keys = keys;
     prog.keysStored = true;
     keysStep.ok();
@@ -33668,7 +33687,7 @@ window.fedipodUnlock = async (password) => {
   if (!isKeyEnvelope(doc)) throw new Error("this account's key is not locked \u2014 nothing to unlock");
   const rec = await unwrapKeys(doc, password);
   const actorUrl = `${cfg.remotePod}${cfg.root || AP_ROOT}ap/actor`;
-  await kvPut(keyCacheKey(actorUrl), rec);
+  await cacheOpenedKeys(actorUrl, rec);
   await bootWorker();
 };
 window.fedipodSignup = async ({ onStep, ...answers }) => {