fedipod-server 0.12.1 → 0.13.1

package/lib/gateway/front-core.mjs

@@ -44,7 +44,12 @@ async function verifyPodToken(request, pathname, verifier) {
     const url = request.url;
     const { webid } = await v(authz, dpop ? { header: dpop, method: request.method, url } : undefined);
     return webid || null;
-  } catch { return null; }
+  } catch (e) {
+    // Said aloud: a token the front will not take is otherwise a bare 401 to
+    // the caller and nothing at all here.
+    console.log(`front: pod token refused on ${pathname}: ${e?.message || e}`);
+    return null;
+  }
 }
 
 // Is this WebID served by the claimed pod? A pod owner's WebID lives on the pod
@@ -149,7 +154,7 @@ async function relayOne(item, rec, fetchImpl) {
   }
   try {
     const res = await safeFetch(url, { method, headers, body, signal: AbortSignal.timeout(RELAY_TIMEOUT_MS) }, fetchImpl);
-    const out = { url, status: res.status };
+    const out = { url, method, status: res.status };
     // The far server asking to be left alone has to reach the agent that will
     // do the asking again. Without this the browser build could not honour a
     // Retry-After at all — every delivery it makes goes through here — and fell
@@ -161,7 +166,7 @@ async function relayOne(item, rec, fetchImpl) {
       out.body = await readCapped(res, RELAY_MAX_BODY);
     }
     return out;
-  } catch (e) { return { url, status: 0, error: e.message }; }
+  } catch (e) { return { url, method, status: 0, error: e.message }; }
 }
 
 const j = (status, obj, ct = 'application/json') =>
@@ -470,15 +475,18 @@ async function route(request, ctx) {
     try { body = JSON.parse(await request.clone().text()); } catch { return j(400, { error: 'bad JSON' }); }
     const handle = String(body.handle || '').toLowerCase();
     const rec = await ctx.lookup(handle);
-    if (!rec) return j(404, { error: 'no such account' });
+    if (!rec) { console.log(`relay: no account named ${handle}`); return j(404, { error: 'no such account' }); }
     const webid = await verifyPodToken(request, pathname, ctx.verifier);
-    if (!webid) return j(401, { error: 'a Solid-OIDC token proving the pod is required' });
+    if (!webid) { console.log(`relay @${handle}: no usable pod token`); return j(401, { error: 'a Solid-OIDC token proving the pod is required' }); }
     const owner = rec.webId ? webid === rec.webId : webidUnderPod(webid, rec.podHome);
-    if (!owner) return j(403, { error: "the token proves a different pod than this account's" });
+    if (!owner) { console.log(`relay @${handle}: token is for ${webid}, not this account's pod`); return j(403, { error: "the token proves a different pod than this account's" }); }
     const items = Array.isArray(body.requests) ? body.requests : [];
     if (!items.length) return j(400, { error: 'requests must be a non-empty list' });
     if (items.length > RELAY_MAX_REQUESTS) return j(400, { error: `at most ${RELAY_MAX_REQUESTS} requests per call` });
     const results = await Promise.all(items.map((it) => relayOne(it, rec, ctx.fetchImpl || fetch)));
+    // One line per relayed request, so a lookup that fails on the far side is
+    // visible here and not only as an empty result in someone's browser.
+    for (const r of results) console.log(`relay @${handle}: ${r.method || ''} ${r.url} → ${r.status}${r.error ? ` (${r.error})` : ''}`);
     return j(200, { results });
   }
 

package/lib/server/embed.mjs

@@ -19,6 +19,7 @@ import { createRequire } from 'node:module';
 import { Agent } from '../../run-agent.mjs';
 import { RemotePod } from '../device/remote.mjs';
 import { apUrls, DEFAULT_ROOT } from '../core/wire.mjs';
+import { handleDelivery } from '../gateway/gateway-core.mjs';
 import { writeJsonAtomic } from '../device/home.mjs';
 import { buildAdminSurface } from '../device/admin/index.mjs';
 import { FixedAuthorities } from '../shared/guard.mjs';
@@ -201,6 +202,62 @@ async function connectionsIntoPod(agent, home, log) {
   }
 }
 
+/**
+ * The pod's own inbox is a verifying door here.
+ *
+ * The server that stores the inbox is the server the delivery arrives at, so
+ * the signature is checked while the headers still exist and the receipt is
+ * written beside the activity — the same door code a standalone gateway runs,
+ * with nothing renamed and nothing advertised differently. The identity's
+ * config names its own inbox as the door and carries the receipt secret, which
+ * is what makes the drain read receipts at all; `trust` because a verified
+ * sender is one the identity may act for.
+ *
+ * An identity attached to an outside door keeps that door: only the secret
+ * is ensured, so receipts from either door verify against the one value.
+ */
+export async function ensureInboxDoor(agent, urls, log = () => {}) {
+  const cfg = agent.store.getConfig();
+  if (!cfg) return;
+  const g = { ...(cfg.gateway || {}) };
+  const fresh = !g.url || !g.mode || g.mode === 'off';
+  if (fresh) Object.assign(g, { url: urls.inbox, mode: 'trust' });
+  if (!g.hmacSecret) g.hmacSecret = crypto.randomBytes(32).toString('base64');
+  if (fresh || !cfg.gateway?.hmacSecret) {
+    agent.store.setConfig({ ...cfg, gateway: g });
+    await agent.store.flush();
+    log(fresh ? 'the pod inbox verifies deliveries at the door' : 'receipt secret added for the inbox door');
+  }
+}
+
+/**
+ * One delivery to a running identity's inbox, verified at the door.
+ *
+ * `request` is the WHATWG form of the POST. `podPut` writes through the
+ * server's store. Returns { status, reason } for the caller to answer with.
+ * The policy is read from the identity's live state rather than its
+ * published policy document, because both are in this process.
+ */
+export async function deliverToInbox(agent, request, { podPut, gatewayWebId = null, fetchImpl = fetch } = {}) {
+  const cfg = agent.store.getConfig() || {};
+  const contacts = agent.store.getContacts();
+  const bl = agent.store.getBlocklist();
+  const u = agent.urls;
+  const toPod = (x) => (u.toPod ? u.toPod(x) : x);
+  const ident = {
+    inboxUrl: toPod(u.inbox),
+    actorUrl: u.actor,
+    followersUrl: u.followers,
+    notesPrefix: u.notes,
+    following: contacts.following.filter((f) => f.accepted && !f.bsky).map((f) => f.actor),
+    blocklist: { domains: bl.domains || [], actors: bl.actors || [] },
+    kind: cfg.kind || 'person',
+    gatewayWebId,
+    hmacSecret: cfg.gateway?.hmacSecret || null,
+  };
+  return handleDelivery(request, ident, { podPut, fetchImpl });
+}
+
 /**
  * Bring one identity up inside the server.
  *
@@ -277,6 +334,7 @@ export async function startEmbeddedAgent({
   // Before connect(), which is what looks the key and the connections up.
   await keyIntoPod(agent, home, log);
   await connectionsIntoPod(agent, home, log);
+  await ensureInboxDoor(agent, urls, log);
 
   await agent.connect();
 
@@ -342,6 +400,6 @@ export async function startEmbeddedAgent({
   // returned rather than rebuilt by the caller so the root name lives here.
   return {
     agent, handle, home, surface, host: authorities.host,
-    podHome: urls.home, actorUrl: urls.actor, stop,
+    podHome: urls.home, actorUrl: urls.actor, inboxUrl: urls.inbox, stop,
   };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fedipod-server",
-  "version": "0.12.1",
+  "version": "0.13.1",
   "description": "The FediPod Server: a full ActivityPub server as a Community Solid Server component.",
   "license": "MIT",
   "main": "dist/index.js",

package/web/app/agent.mjs

@@ -17,10 +17,9 @@ import { MastoApi } from '../../lib/client/masto/index.mjs';
 import { TagFeed } from '../../lib/connections/tagfeed.mjs';
 import { makeDpopSession } from './pod-auth.mjs';
 import { BrowserRemotePod } from './pod-remote.mjs';
-import { importSigningKey, loadKeysFromPod, keyCacheKey } from './keys-browser.mjs';
+import { importSigningKey, loadKeysFromPod, cacheOpenedKeys } from './keys-browser.mjs';
 import { generateKeys, wrapKeys } from './keystore.mjs';
-import { kvPut } from './idb-kv.mjs';
-import { RelayDeliverer } from './deliver-relay.mjs';
+import { RelayDeliverer, doorKeyOf } from './deliver-relay.mjs';
 import { AdminFacade } from './admin-facade.mjs';
 import { BrowserAtproto } from './atproto-browser.mjs';
 import { BskyFeed } from '../../lib/connections/bskyfeed.mjs';
@@ -204,7 +203,10 @@ export class BrowserAgent {
       passive: true,
       store: this.store, rsaPrivate: keys.rsaPrivate, keyId: this.urls.actor + '#main-key',
       actorId: this.urls.actor, log: this.log,
-      relayUrl: `${frontOrigin.replace(/\/$/, '')}/api/relay`, handle: config.handle, sessionFetch: session.fetch,
+      relayUrl: `${frontOrigin.replace(/\/$/, '')}/api/relay`,
+      // The relay finds the account by the front's own key for it, which for a
+      // mail-door account is the full address, not the bare handle.
+      handle: doorKeyOf(config.gateway?.url) || config.handle, sessionFetch: session.fetch,
     });
 
     this.publisher = new Publisher({
@@ -364,8 +366,7 @@ export class BrowserAgent {
     const rec = await generateKeys();
     rec.mintedFor = this.urls.actor;                  // one key, one actor (lib/keys.mjs)
     await podState.writeWrappedKeys(this.remote, this.urls, await wrapKeys(rec, password));
-    await kvPut(keyCacheKey(this.urls.actor), rec).catch(() => {});
-    const keys = await importSigningKey(rec);
+    const keys = await cacheOpenedKeys(this.urls.actor, rec);
     this.publisher.publicKeyPem = keys.rsaPublicPem;
     this.deliverer.rsaPrivate = keys.rsaPrivate;
     await this.publisher.publishProfile();

package/web/app/boot.mjs

@@ -15,8 +15,7 @@ import * as podState from '../../lib/pod/state.mjs';
 import { BrowserRemotePod } from './pod-remote.mjs';
 import { beginLogin, completeLogin, getSession, signOut } from './oidc-session.mjs';
 import { unwrapKeys, isKeyEnvelope } from './keystore.mjs';
-import { kvPut } from './idb-kv.mjs';
-import { keyCacheKey } from './keys-browser.mjs';
+import { cacheOpenedKeys } from './keys-browser.mjs';
 
 const REDIRECT = `${location.origin}/`;   // the app root doubles as the OIDC callback
 
@@ -83,7 +82,7 @@ window.fedipodUnlock = async (password) => {
   if (!isKeyEnvelope(doc)) throw new Error('this account\'s key is not locked — nothing to unlock');
   const rec = await unwrapKeys(doc, password);          // throws 'wrong password'
   const actorUrl = `${cfg.remotePod}${cfg.root || AP_ROOT}ap/actor`;
-  await kvPut(keyCacheKey(actorUrl), rec);
+  await cacheOpenedKeys(actorUrl, rec);
   await bootWorker();
 };
 

package/web/app/deliver-relay.mjs

@@ -10,6 +10,20 @@
 import { Deliverer } from '../../lib/core/deliver.mjs';
 import { sign } from './shims/fedify-sig.mjs';
 
+/**
+ * The name the front keys this account's row by, read off its door inbox:
+ * `<front>/u/<key>/ap/inbox/`. A mail-door account is keyed by its full
+ * address (`you@your.pod`), not the bare handle, because "you" alone is not
+ * unique across pods — and the relay looks the account up by that key.
+ * Null when the URL is not a door of that shape.
+ */
+export function doorKeyOf(doorInboxUrl) {
+  try {
+    const seg = new URL(doorInboxUrl).pathname.split('/');
+    return seg[1] === 'u' && seg[2] ? decodeURIComponent(seg[2]) : null;
+  } catch { return null; }
+}
+
 export class RelayDeliverer extends Deliverer {
   constructor(opts) {
     super(opts);
@@ -28,10 +42,13 @@ export class RelayDeliverer extends Deliverer {
   async signedFetch(url, init = {}) {
     const body = typeof init.body === 'string' ? init.body : (init.body ? new TextDecoder().decode(init.body) : '');
     const s = await sign({ url, method: init.method || 'GET', headers: init.headers || {}, body }, this.rsaPrivate, this.keyId);
+    // Every signed header goes to the relay, `accept` included: the signature
+    // covers it, so a relay request missing it carries an invalid signature —
+    // and a read without it gets the HTML page instead of the document.
     const relayReq = {
       url: s.url, method: s.method, body,
       headers: {
-        date: s.headers.date, digest: s.headers.digest,
+        date: s.headers.date, digest: s.headers.digest, accept: s.headers.accept,
         'content-type': s.headers['content-type'], signature: s.headers.signature,
       },
     };

package/web/app/dist/boot.js

@@ -33231,6 +33231,26 @@ async function kvPut(key, val) {
 }
 
 // web/app/keys-browser.mjs
+var pemToDer = (pem) => Uint8Array.from(
+  atob(pem.replace(/-----[^-]+-----/g, "").replace(/\s+/g, "")),
+  (c) => c.charCodeAt(0)
+);
+async function importSigningKey(keysRecord) {
+  const rsaPrivate = await crypto.subtle.importKey(
+    "pkcs8",
+    pemToDer(keysRecord.rsa.privatePem),
+    { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" },
+    false,
+    ["sign"]
+  );
+  return { rsaPrivate, rsaPublicPem: keysRecord.rsa.publicPem, edPrivate: null, edPublicMultibase: null };
+}
+async function cacheOpenedKeys(actorUrl, keysRecord) {
+  const keys = await importSigningKey(keysRecord);
+  await kvPut(keyCacheKey(actorUrl), { rsaPrivate: keys.rsaPrivate, rsaPublicPem: keys.rsaPublicPem }).catch(() => {
+  });
+  return keys;
+}
 var keyCacheKey = (actorUrl) => `signing-keys:${actorUrl}`;
 
 // web/app/signup.mjs
@@ -33321,8 +33341,7 @@ async function signUp(answers, { onStep = () => {
     } catch (e) {
       throw new Error(`could not store the signing key on the pod (${e.message}). The credential is for ${credential.webId} \u2014 that WebID must own ${pod} and its ${AP_ROOT} must be writable by it.`);
     }
-    await kvPut(keyCacheKey(actorUrl), keys).catch(() => {
-    });
+    await cacheOpenedKeys(actorUrl, keys);
     prog.keys = keys;
     prog.keysStored = true;
     keysStep.ok();
@@ -33668,7 +33687,7 @@ window.fedipodUnlock = async (password) => {
   if (!isKeyEnvelope(doc)) throw new Error("this account's key is not locked \u2014 nothing to unlock");
   const rec = await unwrapKeys(doc, password);
   const actorUrl = `${cfg.remotePod}${cfg.root || AP_ROOT}ap/actor`;
-  await kvPut(keyCacheKey(actorUrl), rec);
+  await cacheOpenedKeys(actorUrl, rec);
   await bootWorker();
 };
 window.fedipodSignup = async ({ onStep, ...answers }) => {