fedipod-server 0.13.0 → 0.13.1

package/lib/core/as2.mjs

@@ -144,12 +144,17 @@ export function groundContext(input) {
  * what the plain read would have concluded too.
  */
 export async function readLenient(raw) {
+  // The document's own node is the one its `id` names. Handed to the view
+  // as the root, so a document that points at itself — every actor does,
+  // through its key's `owner` — is still read as itself.
+  let input = null;
+  try { input = typeof raw === 'string' ? JSON.parse(raw) : (raw ?? null); } catch { /* not JSON either */ }
+  const own = input && typeof input === 'object' ? (input.id ?? input['@id']) : null;
+  const root = typeof own === 'string' && /^https?:\/\//u.test(own) ? own : null;
   try {
     const { doc, graph } = await parseAS2(raw);
-    return { doc, graph, view: graphView(graph), degraded: null };
+    return { doc, graph, view: graphView(graph, { root }), degraded: null };
   } catch (e) {
-    let input = null;
-    try { input = typeof raw === 'string' ? JSON.parse(raw) : (raw ?? null); } catch { /* not JSON either */ }
     if (!input || typeof input !== 'object') return { doc: null, graph: null, view: null, degraded: e.message };
     // Grounded, so a graph exists for every document that is JSON at all.
     //
@@ -159,7 +164,7 @@ export async function readLenient(raw) {
     // what they read, so rewriting it here silently changed what they posted.
     try {
       const { graph } = await parseAS2(groundContext(input));
-      return { doc: input, graph, view: graphView(graph), degraded: e.message };
+      return { doc: input, graph, view: graphView(graph, { root }), degraded: e.message };
     } catch (inner) {
       // Grounding names only held contexts, so reaching here means the document
       // is malformed JSON-LD rather than unfetchable. Hand back what a plain

package/lib/core/graphview.mjs

@@ -130,14 +130,31 @@ function indexQuads(quads) {
 }
 
 /**
- * The document's own node: a subject nothing else points at. A document that
- * points back at itself leaves no such subject, so the first typed subject is
- * the fallback rather than nothing at all.
+ * The document's own node, when the caller could not name it.
+ *
+ * A named subject nothing points at is the plain case. But an actor is
+ * pointed at by its own key (`owner`), so it is never that; and taking "the
+ * first typed subject" instead handed back a profile field — a blank
+ * PropertyValue that happens to come first in quad order — for every
+ * Mastodon actor with fields on it. Named subjects therefore come before
+ * blank ones at every step, and a blank node is the root only when nothing
+ * named exists at all.
  */
-function findRoot({ bySubject, objects }) {
-  for (const s of bySubject.keys()) if (!objects.has(s)) return s;
-  for (const [s, preds] of bySubject) if (preds.has(RDF_TYPE)) return s;
-  return bySubject.keys().next().value ?? null;
+function findRoot({ bySubject, objects, blanks }) {
+  const all = [...bySubject.keys()];
+  const named = all.filter((s) => !blanks.has(s));
+  // A subject nothing points at is the document's own node — named if there
+  // is one, else blank: a client's Update carries no id of its own and is a
+  // blank root above the named note it edits.
+  const free = all.filter((s) => !objects.has(s));
+  const freeNamed = free.find((s) => !blanks.has(s));
+  if (freeNamed) return freeNamed;
+  if (free.length) return free[0];
+  // Everything is pointed at (an actor, through its key's owner): a typed
+  // named subject, before any typed blank one.
+  for (const s of named) if (bySubject.get(s).has(RDF_TYPE)) return s;
+  for (const s of all) if (bySubject.get(s).has(RDF_TYPE)) return s;
+  return named[0] ?? all[0] ?? null;
 }
 
 /** Walk an rdf:List into an ordered array. `orderedItems` depends on this. */
@@ -260,7 +277,10 @@ function makeView(subject, ctx, depth = 0, seen = new Set()) {
 export function graphView(quads, { root = null } = {}) {
   if (!quads || !quads.length) return null;
   const ctx = indexQuads(quads);
-  const subject = root ?? findRoot(ctx);
+  // The root the caller names is used only when the graph has it as a
+  // subject: a document whose `id` names something it says nothing about
+  // still reads as whatever it does describe.
+  const subject = (root && ctx.bySubject.has(root)) ? root : findRoot(ctx);
   if (!subject) return null;
   const view = makeView(subject, ctx);
   return (view && typeof view === 'object') ? view : null;

package/lib/gateway/front-core.mjs

@@ -44,7 +44,12 @@ async function verifyPodToken(request, pathname, verifier) {
     const url = request.url;
     const { webid } = await v(authz, dpop ? { header: dpop, method: request.method, url } : undefined);
     return webid || null;
-  } catch { return null; }
+  } catch (e) {
+    // Said aloud: a token the front will not take is otherwise a bare 401 to
+    // the caller and nothing at all here.
+    console.log(`front: pod token refused on ${pathname}: ${e?.message || e}`);
+    return null;
+  }
 }
 
 // Is this WebID served by the claimed pod? A pod owner's WebID lives on the pod
@@ -149,7 +154,7 @@ async function relayOne(item, rec, fetchImpl) {
   }
   try {
     const res = await safeFetch(url, { method, headers, body, signal: AbortSignal.timeout(RELAY_TIMEOUT_MS) }, fetchImpl);
-    const out = { url, status: res.status };
+    const out = { url, method, status: res.status };
     // The far server asking to be left alone has to reach the agent that will
     // do the asking again. Without this the browser build could not honour a
     // Retry-After at all — every delivery it makes goes through here — and fell
@@ -161,7 +166,7 @@ async function relayOne(item, rec, fetchImpl) {
       out.body = await readCapped(res, RELAY_MAX_BODY);
     }
     return out;
-  } catch (e) { return { url, status: 0, error: e.message }; }
+  } catch (e) { return { url, method, status: 0, error: e.message }; }
 }
 
 const j = (status, obj, ct = 'application/json') =>
@@ -470,15 +475,18 @@ async function route(request, ctx) {
     try { body = JSON.parse(await request.clone().text()); } catch { return j(400, { error: 'bad JSON' }); }
     const handle = String(body.handle || '').toLowerCase();
     const rec = await ctx.lookup(handle);
-    if (!rec) return j(404, { error: 'no such account' });
+    if (!rec) { console.log(`relay: no account named ${handle}`); return j(404, { error: 'no such account' }); }
     const webid = await verifyPodToken(request, pathname, ctx.verifier);
-    if (!webid) return j(401, { error: 'a Solid-OIDC token proving the pod is required' });
+    if (!webid) { console.log(`relay @${handle}: no usable pod token`); return j(401, { error: 'a Solid-OIDC token proving the pod is required' }); }
     const owner = rec.webId ? webid === rec.webId : webidUnderPod(webid, rec.podHome);
-    if (!owner) return j(403, { error: "the token proves a different pod than this account's" });
+    if (!owner) { console.log(`relay @${handle}: token is for ${webid}, not this account's pod`); return j(403, { error: "the token proves a different pod than this account's" }); }
     const items = Array.isArray(body.requests) ? body.requests : [];
     if (!items.length) return j(400, { error: 'requests must be a non-empty list' });
     if (items.length > RELAY_MAX_REQUESTS) return j(400, { error: `at most ${RELAY_MAX_REQUESTS} requests per call` });
     const results = await Promise.all(items.map((it) => relayOne(it, rec, ctx.fetchImpl || fetch)));
+    // One line per relayed request, so a lookup that fails on the far side is
+    // visible here and not only as an empty result in someone's browser.
+    for (const r of results) console.log(`relay @${handle}: ${r.method || ''} ${r.url} → ${r.status}${r.error ? ` (${r.error})` : ''}`);
     return j(200, { results });
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fedipod-server",
-  "version": "0.13.0",
+  "version": "0.13.1",
   "description": "The FediPod Server: a full ActivityPub server as a Community Solid Server component.",
   "license": "MIT",
   "main": "dist/index.js",

package/web/app/agent.mjs

@@ -19,7 +19,7 @@ import { makeDpopSession } from './pod-auth.mjs';
 import { BrowserRemotePod } from './pod-remote.mjs';
 import { importSigningKey, loadKeysFromPod, cacheOpenedKeys } from './keys-browser.mjs';
 import { generateKeys, wrapKeys } from './keystore.mjs';
-import { RelayDeliverer } from './deliver-relay.mjs';
+import { RelayDeliverer, doorKeyOf } from './deliver-relay.mjs';
 import { AdminFacade } from './admin-facade.mjs';
 import { BrowserAtproto } from './atproto-browser.mjs';
 import { BskyFeed } from '../../lib/connections/bskyfeed.mjs';
@@ -203,7 +203,10 @@ export class BrowserAgent {
       passive: true,
       store: this.store, rsaPrivate: keys.rsaPrivate, keyId: this.urls.actor + '#main-key',
       actorId: this.urls.actor, log: this.log,
-      relayUrl: `${frontOrigin.replace(/\/$/, '')}/api/relay`, handle: config.handle, sessionFetch: session.fetch,
+      relayUrl: `${frontOrigin.replace(/\/$/, '')}/api/relay`,
+      // The relay finds the account by the front's own key for it, which for a
+      // mail-door account is the full address, not the bare handle.
+      handle: doorKeyOf(config.gateway?.url) || config.handle, sessionFetch: session.fetch,
     });
 
     this.publisher = new Publisher({

package/web/app/deliver-relay.mjs

@@ -10,6 +10,20 @@
 import { Deliverer } from '../../lib/core/deliver.mjs';
 import { sign } from './shims/fedify-sig.mjs';
 
+/**
+ * The name the front keys this account's row by, read off its door inbox:
+ * `<front>/u/<key>/ap/inbox/`. A mail-door account is keyed by its full
+ * address (`you@your.pod`), not the bare handle, because "you" alone is not
+ * unique across pods — and the relay looks the account up by that key.
+ * Null when the URL is not a door of that shape.
+ */
+export function doorKeyOf(doorInboxUrl) {
+  try {
+    const seg = new URL(doorInboxUrl).pathname.split('/');
+    return seg[1] === 'u' && seg[2] ? decodeURIComponent(seg[2]) : null;
+  } catch { return null; }
+}
+
 export class RelayDeliverer extends Deliverer {
   constructor(opts) {
     super(opts);
@@ -28,10 +42,13 @@ export class RelayDeliverer extends Deliverer {
   async signedFetch(url, init = {}) {
     const body = typeof init.body === 'string' ? init.body : (init.body ? new TextDecoder().decode(init.body) : '');
     const s = await sign({ url, method: init.method || 'GET', headers: init.headers || {}, body }, this.rsaPrivate, this.keyId);
+    // Every signed header goes to the relay, `accept` included: the signature
+    // covers it, so a relay request missing it carries an invalid signature —
+    // and a read without it gets the HTML page instead of the document.
     const relayReq = {
       url: s.url, method: s.method, body,
       headers: {
-        date: s.headers.date, digest: s.headers.digest,
+        date: s.headers.date, digest: s.headers.digest, accept: s.headers.accept,
         'content-type': s.headers['content-type'], signature: s.headers.signature,
       },
     };

package/web/app/dist/sw.js

@@ -55555,10 +55555,16 @@ function indexQuads(quads) {
   }
   return { bySubject, objects, blanks };
 }
-function findRoot({ bySubject, objects }) {
-  for (const s of bySubject.keys()) if (!objects.has(s)) return s;
-  for (const [s, preds] of bySubject) if (preds.has(RDF_TYPE)) return s;
-  return bySubject.keys().next().value ?? null;
+function findRoot({ bySubject, objects, blanks }) {
+  const all = [...bySubject.keys()];
+  const named = all.filter((s) => !blanks.has(s));
+  const free = all.filter((s) => !objects.has(s));
+  const freeNamed = free.find((s) => !blanks.has(s));
+  if (freeNamed) return freeNamed;
+  if (free.length) return free[0];
+  for (const s of named) if (bySubject.get(s).has(RDF_TYPE)) return s;
+  for (const s of all) if (bySubject.get(s).has(RDF_TYPE)) return s;
+  return named[0] ?? all[0] ?? null;
 }
 function readList(head, ctx, depth, path) {
   const out = [];
@@ -55636,7 +55642,7 @@ function makeView(subject, ctx, depth = 0, seen = /* @__PURE__ */ new Set()) {
 function graphView(quads, { root = null } = {}) {
   if (!quads || !quads.length) return null;
   const ctx = indexQuads(quads);
-  const subject = root ?? findRoot(ctx);
+  const subject = root && ctx.bySubject.has(root) ? root : findRoot(ctx);
   if (!subject) return null;
   const view = makeView(subject, ctx);
   return view && typeof view === "object" ? view : null;
@@ -55695,19 +55701,21 @@ function groundContext(input) {
   return { ...input, "@context": kept.length === 1 ? kept[0] : kept };
 }
 async function readLenient(raw) {
+  let input = null;
+  try {
+    input = typeof raw === "string" ? JSON.parse(raw) : raw ?? null;
+  } catch {
+  }
+  const own = input && typeof input === "object" ? input.id ?? input["@id"] : null;
+  const root = typeof own === "string" && /^https?:\/\//u.test(own) ? own : null;
   try {
     const { doc, graph: graph2 } = await parseAS2(raw);
-    return { doc, graph: graph2, view: graphView(graph2), degraded: null };
+    return { doc, graph: graph2, view: graphView(graph2, { root }), degraded: null };
   } catch (e) {
-    let input = null;
-    try {
-      input = typeof raw === "string" ? JSON.parse(raw) : raw ?? null;
-    } catch {
-    }
     if (!input || typeof input !== "object") return { doc: null, graph: null, view: null, degraded: e.message };
     try {
       const { graph: graph2 } = await parseAS2(groundContext(input));
-      return { doc: input, graph: graph2, view: graphView(graph2), degraded: e.message };
+      return { doc: input, graph: graph2, view: graphView(graph2, { root }), degraded: e.message };
     } catch (inner) {
       return { doc: input, graph: null, view: null, degraded: `${e.message}; grounded read also failed: ${inner.message}` };
     }
@@ -67364,6 +67372,14 @@ var Deliverer = class {
 
 // web/app/deliver-relay.mjs
 init_fedify_sig();
+function doorKeyOf(doorInboxUrl) {
+  try {
+    const seg2 = new URL(doorInboxUrl).pathname.split("/");
+    return seg2[1] === "u" && seg2[2] ? decodeURIComponent(seg2[2]) : null;
+  } catch {
+    return null;
+  }
+}
 var RelayDeliverer = class extends Deliverer {
   constructor(opts) {
     super(opts);
@@ -67388,6 +67404,7 @@ var RelayDeliverer = class extends Deliverer {
       headers: {
         date: s.headers.date,
         digest: s.headers.digest,
+        accept: s.headers.accept,
         "content-type": s.headers["content-type"],
         signature: s.headers.signature
       }
@@ -69615,7 +69632,9 @@ var BrowserAgent = class _BrowserAgent {
       actorId: this.urls.actor,
       log: this.log,
       relayUrl: `${frontOrigin.replace(/\/$/, "")}/api/relay`,
-      handle: config.handle,
+      // The relay finds the account by the front's own key for it, which for a
+      // mail-door account is the full address, not the bare handle.
+      handle: doorKeyOf(config.gateway?.url) || config.handle,
       sessionFetch: session.fetch
     });
     this.publisher = new Publisher({