fedipod-server 0.12.1 → 0.13.0

package/lib/server/embed.mjs

@@ -19,6 +19,7 @@ import { createRequire } from 'node:module';
 import { Agent } from '../../run-agent.mjs';
 import { RemotePod } from '../device/remote.mjs';
 import { apUrls, DEFAULT_ROOT } from '../core/wire.mjs';
+import { handleDelivery } from '../gateway/gateway-core.mjs';
 import { writeJsonAtomic } from '../device/home.mjs';
 import { buildAdminSurface } from '../device/admin/index.mjs';
 import { FixedAuthorities } from '../shared/guard.mjs';
@@ -201,6 +202,62 @@ async function connectionsIntoPod(agent, home, log) {
   }
 }
 
+/**
+ * The pod's own inbox is a verifying door here.
+ *
+ * The server that stores the inbox is the server the delivery arrives at, so
+ * the signature is checked while the headers still exist and the receipt is
+ * written beside the activity — the same door code a standalone gateway runs,
+ * with nothing renamed and nothing advertised differently. The identity's
+ * config names its own inbox as the door and carries the receipt secret, which
+ * is what makes the drain read receipts at all; `trust` because a verified
+ * sender is one the identity may act for.
+ *
+ * An identity attached to an outside door keeps that door: only the secret
+ * is ensured, so receipts from either door verify against the one value.
+ */
+export async function ensureInboxDoor(agent, urls, log = () => {}) {
+  const cfg = agent.store.getConfig();
+  if (!cfg) return;
+  const g = { ...(cfg.gateway || {}) };
+  const fresh = !g.url || !g.mode || g.mode === 'off';
+  if (fresh) Object.assign(g, { url: urls.inbox, mode: 'trust' });
+  if (!g.hmacSecret) g.hmacSecret = crypto.randomBytes(32).toString('base64');
+  if (fresh || !cfg.gateway?.hmacSecret) {
+    agent.store.setConfig({ ...cfg, gateway: g });
+    await agent.store.flush();
+    log(fresh ? 'the pod inbox verifies deliveries at the door' : 'receipt secret added for the inbox door');
+  }
+}
+
+/**
+ * One delivery to a running identity's inbox, verified at the door.
+ *
+ * `request` is the WHATWG form of the POST. `podPut` writes through the
+ * server's store. Returns { status, reason } for the caller to answer with.
+ * The policy is read from the identity's live state rather than its
+ * published policy document, because both are in this process.
+ */
+export async function deliverToInbox(agent, request, { podPut, gatewayWebId = null, fetchImpl = fetch } = {}) {
+  const cfg = agent.store.getConfig() || {};
+  const contacts = agent.store.getContacts();
+  const bl = agent.store.getBlocklist();
+  const u = agent.urls;
+  const toPod = (x) => (u.toPod ? u.toPod(x) : x);
+  const ident = {
+    inboxUrl: toPod(u.inbox),
+    actorUrl: u.actor,
+    followersUrl: u.followers,
+    notesPrefix: u.notes,
+    following: contacts.following.filter((f) => f.accepted && !f.bsky).map((f) => f.actor),
+    blocklist: { domains: bl.domains || [], actors: bl.actors || [] },
+    kind: cfg.kind || 'person',
+    gatewayWebId,
+    hmacSecret: cfg.gateway?.hmacSecret || null,
+  };
+  return handleDelivery(request, ident, { podPut, fetchImpl });
+}
+
 /**
  * Bring one identity up inside the server.
  *
@@ -277,6 +334,7 @@ export async function startEmbeddedAgent({
   // Before connect(), which is what looks the key and the connections up.
   await keyIntoPod(agent, home, log);
   await connectionsIntoPod(agent, home, log);
+  await ensureInboxDoor(agent, urls, log);
 
   await agent.connect();
 
@@ -342,6 +400,6 @@ export async function startEmbeddedAgent({
   // returned rather than rebuilt by the caller so the root name lives here.
   return {
     agent, handle, home, surface, host: authorities.host,
-    podHome: urls.home, actorUrl: urls.actor, stop,
+    podHome: urls.home, actorUrl: urls.actor, inboxUrl: urls.inbox, stop,
   };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fedipod-server",
-  "version": "0.12.1",
+  "version": "0.13.0",
   "description": "The FediPod Server: a full ActivityPub server as a Community Solid Server component.",
   "license": "MIT",
   "main": "dist/index.js",

package/web/app/agent.mjs

@@ -17,9 +17,8 @@ import { MastoApi } from '../../lib/client/masto/index.mjs';
 import { TagFeed } from '../../lib/connections/tagfeed.mjs';
 import { makeDpopSession } from './pod-auth.mjs';
 import { BrowserRemotePod } from './pod-remote.mjs';
-import { importSigningKey, loadKeysFromPod, keyCacheKey } from './keys-browser.mjs';
+import { importSigningKey, loadKeysFromPod, cacheOpenedKeys } from './keys-browser.mjs';
 import { generateKeys, wrapKeys } from './keystore.mjs';
-import { kvPut } from './idb-kv.mjs';
 import { RelayDeliverer } from './deliver-relay.mjs';
 import { AdminFacade } from './admin-facade.mjs';
 import { BrowserAtproto } from './atproto-browser.mjs';
@@ -364,8 +363,7 @@ export class BrowserAgent {
     const rec = await generateKeys();
     rec.mintedFor = this.urls.actor;                  // one key, one actor (lib/keys.mjs)
     await podState.writeWrappedKeys(this.remote, this.urls, await wrapKeys(rec, password));
-    await kvPut(keyCacheKey(this.urls.actor), rec).catch(() => {});
-    const keys = await importSigningKey(rec);
+    const keys = await cacheOpenedKeys(this.urls.actor, rec);
     this.publisher.publicKeyPem = keys.rsaPublicPem;
     this.deliverer.rsaPrivate = keys.rsaPrivate;
     await this.publisher.publishProfile();

package/web/app/boot.mjs

@@ -15,8 +15,7 @@ import * as podState from '../../lib/pod/state.mjs';
 import { BrowserRemotePod } from './pod-remote.mjs';
 import { beginLogin, completeLogin, getSession, signOut } from './oidc-session.mjs';
 import { unwrapKeys, isKeyEnvelope } from './keystore.mjs';
-import { kvPut } from './idb-kv.mjs';
-import { keyCacheKey } from './keys-browser.mjs';
+import { cacheOpenedKeys } from './keys-browser.mjs';
 
 const REDIRECT = `${location.origin}/`;   // the app root doubles as the OIDC callback
 
@@ -83,7 +82,7 @@ window.fedipodUnlock = async (password) => {
   if (!isKeyEnvelope(doc)) throw new Error('this account\'s key is not locked — nothing to unlock');
   const rec = await unwrapKeys(doc, password);          // throws 'wrong password'
   const actorUrl = `${cfg.remotePod}${cfg.root || AP_ROOT}ap/actor`;
-  await kvPut(keyCacheKey(actorUrl), rec);
+  await cacheOpenedKeys(actorUrl, rec);
   await bootWorker();
 };
 

package/web/app/dist/boot.js

@@ -33231,6 +33231,26 @@ async function kvPut(key, val) {
 }
 
 // web/app/keys-browser.mjs
+var pemToDer = (pem) => Uint8Array.from(
+  atob(pem.replace(/-----[^-]+-----/g, "").replace(/\s+/g, "")),
+  (c) => c.charCodeAt(0)
+);
+async function importSigningKey(keysRecord) {
+  const rsaPrivate = await crypto.subtle.importKey(
+    "pkcs8",
+    pemToDer(keysRecord.rsa.privatePem),
+    { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" },
+    false,
+    ["sign"]
+  );
+  return { rsaPrivate, rsaPublicPem: keysRecord.rsa.publicPem, edPrivate: null, edPublicMultibase: null };
+}
+async function cacheOpenedKeys(actorUrl, keysRecord) {
+  const keys = await importSigningKey(keysRecord);
+  await kvPut(keyCacheKey(actorUrl), { rsaPrivate: keys.rsaPrivate, rsaPublicPem: keys.rsaPublicPem }).catch(() => {
+  });
+  return keys;
+}
 var keyCacheKey = (actorUrl) => `signing-keys:${actorUrl}`;
 
 // web/app/signup.mjs
@@ -33321,8 +33341,7 @@ async function signUp(answers, { onStep = () => {
     } catch (e) {
       throw new Error(`could not store the signing key on the pod (${e.message}). The credential is for ${credential.webId} \u2014 that WebID must own ${pod} and its ${AP_ROOT} must be writable by it.`);
     }
-    await kvPut(keyCacheKey(actorUrl), keys).catch(() => {
-    });
+    await cacheOpenedKeys(actorUrl, keys);
     prog.keys = keys;
     prog.keysStored = true;
     keysStep.ok();
@@ -33668,7 +33687,7 @@ window.fedipodUnlock = async (password) => {
   if (!isKeyEnvelope(doc)) throw new Error("this account's key is not locked \u2014 nothing to unlock");
   const rec = await unwrapKeys(doc, password);
   const actorUrl = `${cfg.remotePod}${cfg.root || AP_ROOT}ap/actor`;
-  await kvPut(keyCacheKey(actorUrl), rec);
+  await cacheOpenedKeys(actorUrl, rec);
   await bootWorker();
 };
 window.fedipodSignup = async ({ onStep, ...answers }) => {