fedipod-server 0.11.0 → 0.13.0

package/lib/{atproto.mjs → connections/atproto.mjs}

@@ -7,10 +7,8 @@
 // was connected for — the keys.json rules). The app password is kept so an
 // expired refresh token re-logins instead of demanding a reconnect.
 
-import fs from 'node:fs';
-import path from 'node:path';
-import { writeJsonAtomic } from './home.mjs';
-import { safeFetch, retryAfterMs } from './safefetch.mjs';
+import { fileVault } from './vault.mjs';
+import { safeFetch, retryAfterMs } from '../shared/safefetch.mjs';
 
 const FILE = 'atproto.json';
 const POST_NSID = 'app.bsky.feed.post';
@@ -64,11 +62,15 @@ export function bskyText(text, noteUrl) {
   return { text: out, facets, truncated: true };
 }
 
-const filePath = (dir) => path.join(dir, FILE);
-
 export class Atproto {
-  constructor({ localDir, actorId = null, log = console.log, fetcher = null }) {
-    this.localDir = localDir;
+  /**
+   * `vault` is where the app password is kept: this machine when the identity
+   * runs on a laptop, its own pod when it runs inside the pod server. Absent,
+   * it is the file beside the credential, which is what a laptop wants.
+   */
+  constructor({ localDir, vault = null, actorId = null, log = console.log, fetcher = null }) {
+    this.vault = vault || fileVault(localDir);
+    this.name = vault ? 'bluesky' : FILE.replace(/\.json$/u, '');
     this.actorId = actorId;
     this.log = log;
     // Injectable for tests; the default is the politeness stack.
@@ -80,19 +82,16 @@ export class Atproto {
   // The stamped-record guard: a credential minted for another actor is treated
   // as absent, never silently adopted across identities.
   read() {
-    let rec;
-    try { rec = JSON.parse(fs.readFileSync(filePath(this.localDir), 'utf8')); } catch { return null; }
+    const rec = this.vault.read(this.name);
+    if (!rec) return null;
     if (rec?.mintedFor && this.actorId && rec.mintedFor !== this.actorId) {
-      this.log(`atproto.json belongs to ${rec.mintedFor} — not reusing it for ${this.actorId}`);
+      this.log(`the Bluesky connection belongs to ${rec.mintedFor} — not reusing it for ${this.actorId}`);
       return null;
     }
     return rec;
   }
 
-  write(rec) {
-    fs.mkdirSync(this.localDir, { recursive: true, mode: 0o700 });
-    writeJsonAtomic(filePath(this.localDir), rec);
-  }
+  write(rec) { this.vault.write(this.name, rec); }
 
   connected() { return !!this.read()?.did; }
 
@@ -162,7 +161,7 @@ export class Atproto {
         method: 'POST', headers: { authorization: `Bearer ${rec.refreshJwt}` },
       }).catch(() => {});
     }
-    try { fs.rmSync(filePath(this.localDir)); } catch {}
+    await this.vault.remove(this.name);
     this.log('bluesky disconnected');
   }
 

package/lib/{bskygroup.mjs → connections/bskygroup.mjs}

@@ -20,7 +20,7 @@ export class BskyGroup {
   // whatever record the caller keeps, so one join costs one probe.
   async isBridged(did) {
     try {
-      const { safeFetch } = await import('./safefetch.mjs');
+      const { safeFetch } = await import('../shared/safefetch.mjs');
       const doFetch = this.fetcher || ((u, i) => safeFetch(u, i));
       const res = await doFetch(BRIDGE_ACTOR(did), { headers: { accept: AP_ACCEPT } });
       return res.status < 400;

package/lib/{fediacct.mjs → connections/fediacct.mjs}

@@ -4,20 +4,20 @@
 // one atproto.mjs has to a Bluesky account. Nothing here is a second identity:
 // no key, no pod, nothing published.
 //
-// One credential per account at AP_HOME/fediaccts/<id>.json (0600, atomic,
-// stamped with the actor it was connected for — the keys.json rules). A file
-// stamped for someone else is skipped rather than fatal, so one stray record
-// cannot cost the owner the whole roster.
+// One credential per account, stamped with the actor it was connected for
+// (the keys.json rules). A record stamped for someone else is skipped rather
+// than fatal, so one stray one cannot cost the owner the whole roster.
 //
-// An access token here is full access to that account on that server, so it
-// never reaches pod state: config.json gets the handle and the host, nothing
-// more.
+// Where they are kept is vault.mjs's decision: this machine when the identity
+// runs on a laptop, the identity's own pod when it runs inside the pod server.
+// Either way config.json gets the handle and the host and nothing more — the
+// roster is public to anyone who can read the identity's config, the token
+// never is.
 
-import fs from 'node:fs';
 import path from 'node:path';
 import crypto from 'node:crypto';
-import { writeJsonAtomic } from './home.mjs';
-import { safeFetch, retryAfterMs } from './safefetch.mjs';
+import { fileVault } from './vault.mjs';
+import { safeFetch, retryAfterMs } from '../shared/safefetch.mjs';
 
 const DIR = 'fediaccts';
 const APPS = '_apps';
@@ -42,8 +42,14 @@ export function cleanHost(host) {
 }
 
 export class FediAccounts {
-  constructor({ localDir, actorId = null, log = console.log, fetcher = null }) {
-    this.dir = path.join(localDir, DIR);
+  /**
+   * `vault` and `apps` are where the credentials and the per-host app
+   * registrations live. Absent, they are the directories beside the
+   * credential file, which is what a laptop wants.
+   */
+  constructor({ localDir, vault = null, apps = null, actorId = null, log = console.log, fetcher = null }) {
+    this.vault = vault || fileVault(path.join(localDir, DIR));
+    this.apps = apps || fileVault(path.join(localDir, DIR, APPS));
     this.actorId = actorId;
     this.log = log;
     // Injectable for tests; the default is the politeness stack, which also
@@ -55,28 +61,19 @@ export class FediAccounts {
 
   // ---- records ----
 
-  _path(id) { return path.join(this.dir, `${id}.json`); }
-
-  ids() {
-    let names = [];
-    try { names = fs.readdirSync(this.dir); } catch { return []; }
-    return names.filter(n => n.endsWith('.json') && !n.startsWith('_')).map(n => n.slice(0, -5));
-  }
+  ids() { return this.vault.names().filter(n => !n.startsWith('_')); }
 
   read(id) {
-    let rec;
-    try { rec = JSON.parse(fs.readFileSync(this._path(id), 'utf8')); } catch { return null; }
+    const rec = this.vault.read(id);
+    if (!rec) return null;
     if (rec?.mintedFor && this.actorId && rec.mintedFor !== this.actorId) {
-      this.log(`fediaccts/${id}.json belongs to ${rec.mintedFor} — not reusing it for ${this.actorId}`);
+      this.log(`the connection record for ${id} belongs to ${rec.mintedFor} — not reusing it for ${this.actorId}`);
       return null;
     }
     return rec;
   }
 
-  write(rec) {
-    fs.mkdirSync(this.dir, { recursive: true, mode: 0o700 });
-    writeJsonAtomic(this._path(rec.id), rec);
-  }
+  write(rec) { this.vault.write(rec.id, rec); }
 
   list() { return this.ids().map(id => this.read(id)).filter(Boolean); }
 
@@ -106,9 +103,9 @@ export class FediAccounts {
     return this.roster().find(r => r.id === id) || null;
   }
 
-  remove(id) {
+  async remove(id) {
     if (!this.read(id)) return false;
-    try { fs.rmSync(this._path(id)); } catch { return false; }
+    if (!await this.vault.remove(id)) return false;
     this.log(`Fediverse account disconnected: ${id}`);
     return true;
   }
@@ -143,11 +140,8 @@ export class FediAccounts {
   // was registered, so an agent that moved to another port re-registers rather
   // than sending the server a redirect it will refuse.
   async appFor(host, redirectUri) {
-    const file = path.join(this.dir, APPS, `${host}.json`);
-    try {
-      const app = JSON.parse(fs.readFileSync(file, 'utf8'));
-      if (app.redirectUri === redirectUri && app.clientId && app.clientSecret) return app;
-    } catch { /* not registered here yet */ }
+    const known = this.apps.read(host);
+    if (known?.redirectUri === redirectUri && known.clientId && known.clientSecret) return known;
     const res = await this._fetch(host, `https://${host}/api/v1/apps`, {
       method: 'POST',
       headers: { 'content-type': 'application/json' },
@@ -159,8 +153,7 @@ export class FediAccounts {
     const body = await this._json(res, host);
     if (!body.client_id || !body.client_secret) throw new Error(`${host} registered no client`);
     const app = { host, redirectUri, clientId: body.client_id, clientSecret: body.client_secret };
-    fs.mkdirSync(path.join(this.dir, APPS), { recursive: true, mode: 0o700 });
-    writeJsonAtomic(file, app);
+    this.apps.write(host, app);
     return app;
   }
 
@@ -213,6 +206,9 @@ export class FediAccounts {
       addedAt: new Date().toISOString(), enabled: true,
       ...(this.actorId ? { mintedFor: this.actorId } : {}),
     });
+    // The owner has just been through a browser to get this; it is written
+    // down before they are told it worked.
+    if (!await this.vault.commit()) throw new Error('the connection could not be written down');
     this.log(`Fediverse account connected: @${me.username}@${host}`);
     return this.roster().find(r => r.id === id);
   }

package/lib/{import.mjs → connections/import.mjs}

@@ -13,7 +13,7 @@
 // still there and still pending.
 
 import crypto from 'node:crypto';
-import { lookupWebFinger, selfLink, confirmDelegation, followActor, unfollowActor } from './social.mjs';
+import { lookupWebFinger, selfLink, confirmDelegation, followActor, unfollowActor } from '../core/social.mjs';
 
 export const IMPORT_STATE_DOC = 'import-state.json';
 export const IMPORT_KINDS = ['follow', 'block', 'mute', 'list', 'domain'];

package/lib/{tagfeed.mjs → connections/tagfeed.mjs}

@@ -6,7 +6,7 @@
 // Config in tagfeed.json: { instance, tags: [...], intervalMin }. Every note
 // is still verified by dereference at its origin before it is mirrored.
 
-import { isContentType, authorOf } from './intake.mjs';
+import { isContentType, authorOf } from '../core/intake/index.mjs';
 
 // A public timeline page from somebody else's instance. Generous for 20 posts,
 // and a bound where there was none.
@@ -102,7 +102,7 @@ export class TagFeed {
     for (const tag of tags) {
       let list;
       try {
-        const { safeFetch, retryAfterMs, readCapped } = await import('./safefetch.mjs');
+        const { safeFetch, retryAfterMs, readCapped } = await import('../shared/safefetch.mjs');
         const url = `${instance}/api/v1/timelines/tag/${encodeURIComponent(tag)}?limit=${PER_TAG}`;
         const res = this.fetcher === globalThis.fetch
           ? await safeFetch(url, { headers: { accept: 'application/json' } })
@@ -149,7 +149,7 @@ export class TagFeed {
         if (!this.store.getActors()[author]) {
           await this.intake.fetchAP(author).catch(() => {});   // warm name+avatar
         }
-        const { attachmentsOf, titledContent } = await import('./wire.mjs');
+        const { attachmentsOf, titledContent } = await import('../core/wire.mjs');
         const attachments = attachmentsOf(note);
         this.store.addStatus({
           noteId, actor: author, content: titledContent(note),

package/lib/connections/vault.mjs

@@ -0,0 +1,114 @@
+// vault.mjs — where an identity keeps the credentials for accounts it holds on
+// OTHER servers: a full-access token on a Mastodon-API server, a Bluesky app
+// password. Not its own key, and nothing published.
+//
+// Two places, and which one is right depends on where the identity runs. On a
+// laptop the pod is somebody else's server, so a token goes on this machine
+// and nowhere near the pod. Inside a pod server the two are the same computer,
+// and the pod is the thing that travels — a token left on the host is a
+// connection the owner loses the day they take their pod elsewhere.
+//
+// The question is where the agent runs, not where its signing key is: sharing
+// a key through the pod is a laptop's own choice and says nothing about a
+// token for somebody else's server.
+//
+// `read`, `write` and `names` are synchronous because every caller here is.
+// The pod's writes land through the store's own retrying queue; `commit`
+// waits for them, and callers that have just taken a credential from a remote
+// server use it before they answer.
+import fs from 'node:fs';
+import path from 'node:path';
+import { writeJsonAtomic } from '../device/home.mjs';
+
+/** What every connection document in pod state is named from. */
+export const CONNECTION_PREFIX = 'conn-';
+
+/** One directory, one document per name, 0600 and atomic — the laptop. */
+export function fileVault(dir) {
+  const file = (name) => path.join(dir, `${name}.json`);
+  return {
+    kind: 'file',
+    where: dir,
+    names() {
+      try { return fs.readdirSync(dir).filter(n => n.endsWith('.json')).map(n => n.slice(0, -5)); }
+      catch { return []; }
+    },
+    read(name) {
+      try { return JSON.parse(fs.readFileSync(file(name), 'utf8')); } catch { return null; }
+    },
+    write(name, rec) {
+      fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+      writeJsonAtomic(file(name), rec);
+    },
+    async remove(name) {
+      try { fs.rmSync(file(name)); return true; } catch { return false; }
+    },
+    async commit() { return true; },
+  };
+}
+
+/** Documents in the identity's own pod state, one per name under `prefix`. */
+export function podVault(store, prefix) {
+  const doc = (name) => `${prefix}${name}.json`;
+  return {
+    kind: 'pod',
+    where: `pod state (${prefix}*)`,
+    names() {
+      return store.names()
+        .filter(n => n.startsWith(prefix) && n.endsWith('.json'))
+        .map(n => n.slice(prefix.length, -5));
+    },
+    read(name) { return store.read(doc(name), null); },
+    write(name, rec) { store.write(doc(name), rec); },
+    async remove(name) { return store.remove(doc(name)); },
+    async commit() { return store.commit(); },
+  };
+}
+
+/**
+ * The vaults one agent's connections use.
+ *
+ * `embedded` is the whole question: an agent running inside the server that
+ * holds its pod is on the pod's own host, so a credential left on the machine
+ * is one its owner loses the day they take the pod elsewhere. An agent on a
+ * laptop is not, and its tokens stay where they are — including when the
+ * owner has chosen to share their SIGNING key through the pod, which says
+ * nothing about a token for somebody else's server.
+ */
+export function vaultsFor({ embedded, home, store }) {
+  if (!embedded) {
+    return { bluesky: null, fedi: null, apps: null };   // the classes' own defaults, beside the credential
+  }
+  return {
+    bluesky: podVault(store, CONNECTION_PREFIX),
+    fedi: podVault(store, `${CONNECTION_PREFIX}fedi-`),
+    apps: podVault(store, `${CONNECTION_PREFIX}fediapp-`),
+    home,
+  };
+}
+
+/**
+ * Move whatever a file vault holds into a pod vault, and only then take the
+ * host's copies away. A token here is full access to an account on a server
+ * this project does not run: losing one in the move is a connection its owner
+ * has to make again, and cannot be told about.
+ */
+export async function moveVault(from, to, log = () => {}) {
+  const names = from.names();
+  if (!names.length) return 0;
+  let moved = 0;
+  for (const name of names) {
+    const rec = from.read(name);
+    if (!rec) continue;
+    if (to.read(name)) { await from.remove(name); continue; }
+    to.write(name, rec);
+    moved += 1;
+  }
+  if (!await to.commit()) {
+    log('could not write the connected-account credentials to the pod — they stay on this host for now');
+    return 0;
+  }
+  for (const name of names) await from.remove(name);
+  if (moved) log(`${moved} connected-account credential(s) moved into the pod`);
+  return moved;
+}

package/lib/core/as2.mjs

@@ -0,0 +1,170 @@
+// as2.mjs — the one place ActivityStreams bytes become something to handle.
+//
+// An AS2 document IS a JSON-LD document; ActivityStreams 2.0 Core says so. We
+// read it as one. Expanding it to a graph is what makes the document mean the
+// same thing however its sender chose to write it — `"type": "Create"` and
+// `"@type": "as:Create"` are the same statement, and only a JSON-LD reader
+// knows that.
+//
+// The graph is what the handlers read, through lib/core/graphview.mjs. `doc`,
+// the copy compacted against the standard context, is kept for the callers
+// that republish what they read rather than act on it — compaction alone drops
+// any term the sender defined in its own context, so it is the weaker read.
+//
+// What we STORE and SEND is untouched by any of this. Bytes go into the pod as
+// they arrived, and lib/core/wire.mjs builds what we send as compacted AS2
+// with a plain string @context, as it always did. This is a reading layer.
+//
+// Every document goes through the processor. There is no shortcut for the
+// common shape: one that skipped it would not be read as JSON-LD, and would
+// produce no graph, so nothing could be validated against it.
+//
+// CONTEXTS ARE NEVER FETCHED. The loader serves the fourteen the fediverse
+// actually uses and refuses every other URL. That refusal is the point: this
+// code runs on documents a stranger wrote, in the same path the SSRF guards
+// protect, and expanding one would otherwise mean dereferencing a URL of their
+// choosing. A document naming a context we do not hold is not lost for it —
+// `groundContext` reads it against the contexts we hold and says so in
+// `degraded` — but nothing is ever fetched to make that happen.
+
+import jsonld from 'jsonld';
+import { AS_CTX } from './wire.mjs';
+import { CONTEXTS } from './contexts/index.mjs';
+import { graphView } from './graphview.mjs';
+
+export { CONTEXTS };
+
+/** Why a document could not be read. Carried to the caller so a drop is explained. */
+export class AS2Error extends Error {
+  constructor(reason, { context = null } = {}) {
+    super(reason);
+    this.name = 'AS2Error';
+    this.context = context;
+  }
+}
+
+/**
+ * A loader over the contexts we hold, and nothing else.
+ *
+ * jsonld calls this for every `@context` URL in a document. Anything not in
+ * the map throws rather than being fetched, so a document cannot make this
+ * process reach out to an address its sender picked.
+ */
+export function contextLoader(url) {
+  const doc = CONTEXTS[url];
+  if (!doc) {
+    return Promise.reject(new AS2Error(`context not held here: ${url}`, { context: url }));
+  }
+  return Promise.resolve({ contextUrl: null, documentUrl: url, document: doc });
+}
+
+/**
+ * Read AS2 bytes.
+ *
+ * Returns `{ doc, graph }` — the document compacted against the standard
+ * context, which is what handlers read, and its quads, which is what a shape
+ * is validated against. Throws AS2Error when the document cannot be read as
+ * JSON-LD at all.
+ *
+ * `raw` is a string or a parsed object; both arrive here in practice.
+ */
+export async function parseAS2(raw) {
+  let input;
+  if (typeof raw === 'string') {
+    try {
+      input = JSON.parse(raw);
+    } catch (e) {
+      throw new AS2Error(`not JSON: ${e.message}`);
+    }
+  } else {
+    input = raw;
+  }
+  if (!input || typeof input !== 'object') throw new AS2Error('not a JSON object');
+
+  // A document with no @context expands to nothing at all — every term is
+  // dropped, and the result is an empty graph rather than an error. Silently
+  // reading a delivery as "no statements" is the worst of the outcomes, so it
+  // is named here instead.
+  if (input['@context'] === undefined) throw new AS2Error('no @context');
+
+  const options = { documentLoader: contextLoader };
+  let graph;
+  let doc;
+  try {
+    graph = await jsonld.toRDF(input, options);          // RDF/JS quads, which is what a shape is checked against
+    doc = await jsonld.compact(input, AS_CTX, options);
+  } catch (e) {
+    if (e instanceof AS2Error) throw e;
+    // jsonld wraps a loader rejection; recover ours so the caller can say which
+    // context was missing rather than reporting a library's own phrasing.
+    const cause = e?.details?.cause ?? e?.cause;
+    if (cause instanceof AS2Error) throw cause;
+    throw new AS2Error(`not readable as JSON-LD: ${e.message}`);
+  }
+  return { doc, graph };
+}
+
+/**
+ * Rewrite a document's `@context` to one we can read without fetching anything.
+ *
+ * A document carrying no `@context` is not a puzzle: AS2 Core §2.1 says a
+ * consumer meeting `application/activity+json` without one MUST assume the
+ * normative context still applies. That is what this does. A document naming a
+ * context we do not hold keeps every entry we DO hold — inline objects
+ * included, since those need no fetch — and loses only the unfetchable ones,
+ * so a Mastodon post with an unknown extension still reads as a post.
+ *
+ * Nothing here dereferences a URL. The result names only contexts already on
+ * disk, so the guarantee that a stranger's document cannot make us reach out
+ * survives the fallback.
+ */
+export function groundContext(input) {
+  const ctx = input['@context'];
+  const held = (c) => typeof c === 'string' ? Object.hasOwn(CONTEXTS, c) : (c && typeof c === 'object');
+  let kept;
+  if (ctx === undefined || ctx === null) kept = [];
+  else if (Array.isArray(ctx)) kept = ctx.filter(held);
+  else kept = held(ctx) ? [ctx] : [];
+  if (!kept.some(c => c === AS_CTX)) kept.unshift(AS_CTX);
+  return { ...input, '@context': kept.length === 1 ? kept[0] : kept };
+}
+
+/**
+ * Read AS2 bytes, and when they cannot be read as JSON-LD as written, read
+ * them against the contexts we do hold.
+ *
+ * A delivery naming a context we do not hold, or carrying none at all, is
+ * still a delivery somebody sent. It is now grounded rather than refused, so
+ * `graph` is present for anything that is JSON at all — which is what lets the
+ * handlers read the graph instead of the document. `degraded` still carries
+ * the reason the document could not be read exactly as written, so a caller
+ * records what happened instead of letting it pass unnoticed.
+ *
+ * `doc` and `graph` are null only when the bytes are not JSON at all, which is
+ * what the plain read would have concluded too.
+ */
+export async function readLenient(raw) {
+  try {
+    const { doc, graph } = await parseAS2(raw);
+    return { doc, graph, view: graphView(graph), degraded: null };
+  } catch (e) {
+    let input = null;
+    try { input = typeof raw === 'string' ? JSON.parse(raw) : (raw ?? null); } catch { /* not JSON either */ }
+    if (!input || typeof input !== 'object') return { doc: null, graph: null, view: null, degraded: e.message };
+    // Grounded, so a graph exists for every document that is JSON at all.
+    //
+    // `doc` stays the bytes as they were parsed, NOT the grounded compaction.
+    // Compacting shortens an IRI to whatever term names it — `#Public` comes
+    // back as `as:Public` — and the callers that still read `doc` republish
+    // what they read, so rewriting it here silently changed what they posted.
+    try {
+      const { graph } = await parseAS2(groundContext(input));
+      return { doc: input, graph, view: graphView(graph), degraded: e.message };
+    } catch (inner) {
+      // Grounding names only held contexts, so reaching here means the document
+      // is malformed JSON-LD rather than unfetchable. Hand back what a plain
+      // read would have seen, with no graph, as this always did.
+      return { doc: input, graph: null, view: null, degraded: `${e.message}; grounded read also failed: ${inner.message}` };
+    }
+  }
+}