fedipod-server 0.13.0 → 0.13.2

package/lib/client/masto/accounts.mjs

@@ -145,8 +145,13 @@ export async function handle(api, ctx) {
     if (acct === cfg?.handle || acct === `${cfg?.handle}@${api.host}`) {
       return send(200, api.selfAccount());
     }
+    // By host with its port, as the account is shown; and by hostname alone,
+    // for a client that drops the port from an address it was given.
     const hit = Object.entries(api.store.getActors()).find(([u, a]) => {
-      try { return `${a.preferredUsername}@${new URL(u).host}` === acct; } catch { return false; }
+      try {
+        const at = new URL(u);
+        return `${a.preferredUsername}@${at.host}` === acct || `${a.preferredUsername}@${at.hostname}` === acct;
+      } catch { return false; }
     });
     return hit ? send(200, api.account(hit[0])) : send(404, { error: 'Record not found' });
   }

package/lib/core/as2.mjs

@@ -144,12 +144,17 @@ export function groundContext(input) {
  * what the plain read would have concluded too.
  */
 export async function readLenient(raw) {
+  // The document's own node is the one its `id` names. Handed to the view
+  // as the root, so a document that points at itself — every actor does,
+  // through its key's `owner` — is still read as itself.
+  let input = null;
+  try { input = typeof raw === 'string' ? JSON.parse(raw) : (raw ?? null); } catch { /* not JSON either */ }
+  const own = input && typeof input === 'object' ? (input.id ?? input['@id']) : null;
+  const root = typeof own === 'string' && /^https?:\/\//u.test(own) ? own : null;
   try {
     const { doc, graph } = await parseAS2(raw);
-    return { doc, graph, view: graphView(graph), degraded: null };
+    return { doc, graph, view: graphView(graph, { root }), degraded: null };
   } catch (e) {
-    let input = null;
-    try { input = typeof raw === 'string' ? JSON.parse(raw) : (raw ?? null); } catch { /* not JSON either */ }
     if (!input || typeof input !== 'object') return { doc: null, graph: null, view: null, degraded: e.message };
     // Grounded, so a graph exists for every document that is JSON at all.
     //
@@ -159,7 +164,7 @@ export async function readLenient(raw) {
     // what they read, so rewriting it here silently changed what they posted.
     try {
       const { graph } = await parseAS2(groundContext(input));
-      return { doc: input, graph, view: graphView(graph), degraded: e.message };
+      return { doc: input, graph, view: graphView(graph, { root }), degraded: e.message };
     } catch (inner) {
       // Grounding names only held contexts, so reaching here means the document
       // is malformed JSON-LD rather than unfetchable. Hand back what a plain

package/lib/core/graphview.mjs

@@ -130,14 +130,31 @@ function indexQuads(quads) {
 }
 
 /**
- * The document's own node: a subject nothing else points at. A document that
- * points back at itself leaves no such subject, so the first typed subject is
- * the fallback rather than nothing at all.
+ * The document's own node, when the caller could not name it.
+ *
+ * A named subject nothing points at is the plain case. But an actor is
+ * pointed at by its own key (`owner`), so it is never that; and taking "the
+ * first typed subject" instead handed back a profile field — a blank
+ * PropertyValue that happens to come first in quad order — for every
+ * Mastodon actor with fields on it. Named subjects therefore come before
+ * blank ones at every step, and a blank node is the root only when nothing
+ * named exists at all.
  */
-function findRoot({ bySubject, objects }) {
-  for (const s of bySubject.keys()) if (!objects.has(s)) return s;
-  for (const [s, preds] of bySubject) if (preds.has(RDF_TYPE)) return s;
-  return bySubject.keys().next().value ?? null;
+function findRoot({ bySubject, objects, blanks }) {
+  const all = [...bySubject.keys()];
+  const named = all.filter((s) => !blanks.has(s));
+  // A subject nothing points at is the document's own node — named if there
+  // is one, else blank: a client's Update carries no id of its own and is a
+  // blank root above the named note it edits.
+  const free = all.filter((s) => !objects.has(s));
+  const freeNamed = free.find((s) => !blanks.has(s));
+  if (freeNamed) return freeNamed;
+  if (free.length) return free[0];
+  // Everything is pointed at (an actor, through its key's owner): a typed
+  // named subject, before any typed blank one.
+  for (const s of named) if (bySubject.get(s).has(RDF_TYPE)) return s;
+  for (const s of all) if (bySubject.get(s).has(RDF_TYPE)) return s;
+  return named[0] ?? all[0] ?? null;
 }
 
 /** Walk an rdf:List into an ordered array. `orderedItems` depends on this. */
@@ -260,7 +277,10 @@ function makeView(subject, ctx, depth = 0, seen = new Set()) {
 export function graphView(quads, { root = null } = {}) {
   if (!quads || !quads.length) return null;
   const ctx = indexQuads(quads);
-  const subject = root ?? findRoot(ctx);
+  // The root the caller names is used only when the graph has it as a
+  // subject: a document whose `id` names something it says nothing about
+  // still reads as whatever it does describe.
+  const subject = (root && ctx.bySubject.has(root)) ? root : findRoot(ctx);
   if (!subject) return null;
   const view = makeView(subject, ctx);
   return (view && typeof view === 'object') ? view : null;

package/lib/core/store.mjs

@@ -502,5 +502,34 @@ export class PodStore {
     this.cache.set('ids.json', ids);
     return id;
   }
-  urlFor(id) { return this.getIds()[id] || null; }
+  // The map first, for ids minted under an older scheme. Then, because the
+  // id IS the hash of the url, whatever this store knows is scanned for the
+  // url that hashes to it — actors, posts, contacts, requests, media. The
+  // browser build's worker is stopped whenever it idles, and the in-memory
+  // map went with it: a client clicking an account it had just been shown
+  // reached a fresh worker that held the actor and could not name it.
+  urlFor(id) {
+    const ids = this.getIds();
+    if (ids[id]) return ids[id];
+    if (!/^[a-f0-9]{16}$/u.test(String(id))) return null;
+    const hash = (u) => crypto.createHash('sha256').update(u).digest('hex').slice(0, 16);
+    const seen = new Set();
+    const candidates = function* (store) {
+      for (const u of Object.keys(store.getActors())) yield u;
+      for (const st of store.getStatuses()) {
+        yield st.noteId; yield st.actor;
+        for (const a of st.attachments || []) if (a?.url) yield a.url;
+      }
+      const c = store.getContacts();
+      for (const f of [...c.followers, ...c.following]) if (f?.actor) yield f.actor;
+      for (const r of store.getRequests()) if (r?.actor) yield r.actor;
+      for (const u of Object.keys(store.getMedia())) yield u;
+    };
+    for (const u of candidates(this)) {
+      if (typeof u !== 'string' || seen.has(u)) continue;
+      seen.add(u);
+      if (hash(u) === id) { ids[id] = u; this.cache.set('ids.json', ids); return u; }
+    }
+    return null;
+  }
 }

package/lib/gateway/front-core.mjs

@@ -44,7 +44,12 @@ async function verifyPodToken(request, pathname, verifier) {
     const url = request.url;
     const { webid } = await v(authz, dpop ? { header: dpop, method: request.method, url } : undefined);
     return webid || null;
-  } catch { return null; }
+  } catch (e) {
+    // Said aloud: a token the front will not take is otherwise a bare 401 to
+    // the caller and nothing at all here.
+    console.log(`front: pod token refused on ${pathname}: ${e?.message || e}`);
+    return null;
+  }
 }
 
 // Is this WebID served by the claimed pod? A pod owner's WebID lives on the pod
@@ -149,7 +154,7 @@ async function relayOne(item, rec, fetchImpl) {
   }
   try {
     const res = await safeFetch(url, { method, headers, body, signal: AbortSignal.timeout(RELAY_TIMEOUT_MS) }, fetchImpl);
-    const out = { url, status: res.status };
+    const out = { url, method, status: res.status };
     // The far server asking to be left alone has to reach the agent that will
     // do the asking again. Without this the browser build could not honour a
     // Retry-After at all — every delivery it makes goes through here — and fell
@@ -161,7 +166,7 @@ async function relayOne(item, rec, fetchImpl) {
       out.body = await readCapped(res, RELAY_MAX_BODY);
     }
     return out;
-  } catch (e) { return { url, status: 0, error: e.message }; }
+  } catch (e) { return { url, method, status: 0, error: e.message }; }
 }
 
 const j = (status, obj, ct = 'application/json') =>
@@ -470,15 +475,18 @@ async function route(request, ctx) {
     try { body = JSON.parse(await request.clone().text()); } catch { return j(400, { error: 'bad JSON' }); }
     const handle = String(body.handle || '').toLowerCase();
     const rec = await ctx.lookup(handle);
-    if (!rec) return j(404, { error: 'no such account' });
+    if (!rec) { console.log(`relay: no account named ${handle}`); return j(404, { error: 'no such account' }); }
     const webid = await verifyPodToken(request, pathname, ctx.verifier);
-    if (!webid) return j(401, { error: 'a Solid-OIDC token proving the pod is required' });
+    if (!webid) { console.log(`relay @${handle}: no usable pod token`); return j(401, { error: 'a Solid-OIDC token proving the pod is required' }); }
     const owner = rec.webId ? webid === rec.webId : webidUnderPod(webid, rec.podHome);
-    if (!owner) return j(403, { error: "the token proves a different pod than this account's" });
+    if (!owner) { console.log(`relay @${handle}: token is for ${webid}, not this account's pod`); return j(403, { error: "the token proves a different pod than this account's" }); }
     const items = Array.isArray(body.requests) ? body.requests : [];
     if (!items.length) return j(400, { error: 'requests must be a non-empty list' });
     if (items.length > RELAY_MAX_REQUESTS) return j(400, { error: `at most ${RELAY_MAX_REQUESTS} requests per call` });
     const results = await Promise.all(items.map((it) => relayOne(it, rec, ctx.fetchImpl || fetch)));
+    // One line per relayed request, so a lookup that fails on the far side is
+    // visible here and not only as an empty result in someone's browser.
+    for (const r of results) console.log(`relay @${handle}: ${r.method || ''} ${r.url} → ${r.status}${r.error ? ` (${r.error})` : ''}`);
     return j(200, { results });
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fedipod-server",
-  "version": "0.13.0",
+  "version": "0.13.2",
   "description": "The FediPod Server: a full ActivityPub server as a Community Solid Server component.",
   "license": "MIT",
   "main": "dist/index.js",

package/web/app/agent.mjs

@@ -19,7 +19,7 @@ import { makeDpopSession } from './pod-auth.mjs';
 import { BrowserRemotePod } from './pod-remote.mjs';
 import { importSigningKey, loadKeysFromPod, cacheOpenedKeys } from './keys-browser.mjs';
 import { generateKeys, wrapKeys } from './keystore.mjs';
-import { RelayDeliverer } from './deliver-relay.mjs';
+import { RelayDeliverer, doorKeyOf } from './deliver-relay.mjs';
 import { AdminFacade } from './admin-facade.mjs';
 import { BrowserAtproto } from './atproto-browser.mjs';
 import { BskyFeed } from '../../lib/connections/bskyfeed.mjs';
@@ -203,7 +203,10 @@ export class BrowserAgent {
       passive: true,
       store: this.store, rsaPrivate: keys.rsaPrivate, keyId: this.urls.actor + '#main-key',
       actorId: this.urls.actor, log: this.log,
-      relayUrl: `${frontOrigin.replace(/\/$/, '')}/api/relay`, handle: config.handle, sessionFetch: session.fetch,
+      relayUrl: `${frontOrigin.replace(/\/$/, '')}/api/relay`,
+      // The relay finds the account by the front's own key for it, which for a
+      // mail-door account is the full address, not the bare handle.
+      handle: doorKeyOf(config.gateway?.url) || config.handle, sessionFetch: session.fetch,
     });
 
     this.publisher = new Publisher({

package/web/app/deliver-relay.mjs

@@ -10,6 +10,20 @@
 import { Deliverer } from '../../lib/core/deliver.mjs';
 import { sign } from './shims/fedify-sig.mjs';
 
+/**
+ * The name the front keys this account's row by, read off its door inbox:
+ * `<front>/u/<key>/ap/inbox/`. A mail-door account is keyed by its full
+ * address (`you@your.pod`), not the bare handle, because "you" alone is not
+ * unique across pods — and the relay looks the account up by that key.
+ * Null when the URL is not a door of that shape.
+ */
+export function doorKeyOf(doorInboxUrl) {
+  try {
+    const seg = new URL(doorInboxUrl).pathname.split('/');
+    return seg[1] === 'u' && seg[2] ? decodeURIComponent(seg[2]) : null;
+  } catch { return null; }
+}
+
 export class RelayDeliverer extends Deliverer {
   constructor(opts) {
     super(opts);
@@ -28,10 +42,13 @@ export class RelayDeliverer extends Deliverer {
   async signedFetch(url, init = {}) {
     const body = typeof init.body === 'string' ? init.body : (init.body ? new TextDecoder().decode(init.body) : '');
     const s = await sign({ url, method: init.method || 'GET', headers: init.headers || {}, body }, this.rsaPrivate, this.keyId);
+    // Every signed header goes to the relay, `accept` included: the signature
+    // covers it, so a relay request missing it carries an invalid signature —
+    // and a read without it gets the HTML page instead of the document.
     const relayReq = {
       url: s.url, method: s.method, body,
       headers: {
-        date: s.headers.date, digest: s.headers.digest,
+        date: s.headers.date, digest: s.headers.digest, accept: s.headers.accept,
         'content-type': s.headers['content-type'], signature: s.headers.signature,
       },
     };

package/web/app/dist/sw.js

@@ -34555,8 +34555,40 @@ var PodStore = class {
     this.cache.set("ids.json", ids);
     return id;
   }
+  // The map first, for ids minted under an older scheme. Then, because the
+  // id IS the hash of the url, whatever this store knows is scanned for the
+  // url that hashes to it — actors, posts, contacts, requests, media. The
+  // browser build's worker is stopped whenever it idles, and the in-memory
+  // map went with it: a client clicking an account it had just been shown
+  // reached a fresh worker that held the actor and could not name it.
   urlFor(id) {
-    return this.getIds()[id] || null;
+    const ids = this.getIds();
+    if (ids[id]) return ids[id];
+    if (!/^[a-f0-9]{16}$/u.test(String(id))) return null;
+    const hash = (u) => node_crypto_default.createHash("sha256").update(u).digest("hex").slice(0, 16);
+    const seen = /* @__PURE__ */ new Set();
+    const candidates = function* (store) {
+      for (const u of Object.keys(store.getActors())) yield u;
+      for (const st2 of store.getStatuses()) {
+        yield st2.noteId;
+        yield st2.actor;
+        for (const a of st2.attachments || []) if (a?.url) yield a.url;
+      }
+      const c = store.getContacts();
+      for (const f of [...c.followers, ...c.following]) if (f?.actor) yield f.actor;
+      for (const r of store.getRequests()) if (r?.actor) yield r.actor;
+      for (const u of Object.keys(store.getMedia())) yield u;
+    };
+    for (const u of candidates(this)) {
+      if (typeof u !== "string" || seen.has(u)) continue;
+      seen.add(u);
+      if (hash(u) === id) {
+        ids[id] = u;
+        this.cache.set("ids.json", ids);
+        return u;
+      }
+    }
+    return null;
   }
 };
 
@@ -55555,10 +55587,16 @@ function indexQuads(quads) {
   }
   return { bySubject, objects, blanks };
 }
-function findRoot({ bySubject, objects }) {
-  for (const s of bySubject.keys()) if (!objects.has(s)) return s;
-  for (const [s, preds] of bySubject) if (preds.has(RDF_TYPE)) return s;
-  return bySubject.keys().next().value ?? null;
+function findRoot({ bySubject, objects, blanks }) {
+  const all = [...bySubject.keys()];
+  const named = all.filter((s) => !blanks.has(s));
+  const free = all.filter((s) => !objects.has(s));
+  const freeNamed = free.find((s) => !blanks.has(s));
+  if (freeNamed) return freeNamed;
+  if (free.length) return free[0];
+  for (const s of named) if (bySubject.get(s).has(RDF_TYPE)) return s;
+  for (const s of all) if (bySubject.get(s).has(RDF_TYPE)) return s;
+  return named[0] ?? all[0] ?? null;
 }
 function readList(head, ctx, depth, path) {
   const out = [];
@@ -55636,7 +55674,7 @@ function makeView(subject, ctx, depth = 0, seen = /* @__PURE__ */ new Set()) {
 function graphView(quads, { root = null } = {}) {
   if (!quads || !quads.length) return null;
   const ctx = indexQuads(quads);
-  const subject = root ?? findRoot(ctx);
+  const subject = root && ctx.bySubject.has(root) ? root : findRoot(ctx);
   if (!subject) return null;
   const view = makeView(subject, ctx);
   return view && typeof view === "object" ? view : null;
@@ -55695,19 +55733,21 @@ function groundContext(input) {
   return { ...input, "@context": kept.length === 1 ? kept[0] : kept };
 }
 async function readLenient(raw) {
+  let input = null;
+  try {
+    input = typeof raw === "string" ? JSON.parse(raw) : raw ?? null;
+  } catch {
+  }
+  const own = input && typeof input === "object" ? input.id ?? input["@id"] : null;
+  const root = typeof own === "string" && /^https?:\/\//u.test(own) ? own : null;
   try {
     const { doc, graph: graph2 } = await parseAS2(raw);
-    return { doc, graph: graph2, view: graphView(graph2), degraded: null };
+    return { doc, graph: graph2, view: graphView(graph2, { root }), degraded: null };
   } catch (e) {
-    let input = null;
-    try {
-      input = typeof raw === "string" ? JSON.parse(raw) : raw ?? null;
-    } catch {
-    }
     if (!input || typeof input !== "object") return { doc: null, graph: null, view: null, degraded: e.message };
     try {
       const { graph: graph2 } = await parseAS2(groundContext(input));
-      return { doc: input, graph: graph2, view: graphView(graph2), degraded: e.message };
+      return { doc: input, graph: graph2, view: graphView(graph2, { root }), degraded: e.message };
     } catch (inner) {
       return { doc: input, graph: null, view: null, degraded: `${e.message}; grounded read also failed: ${inner.message}` };
     }
@@ -65423,7 +65463,8 @@ async function handle4(api, ctx) {
     }
     const hit = Object.entries(api.store.getActors()).find(([u, a]) => {
       try {
-        return `${a.preferredUsername}@${new URL(u).host}` === acct;
+        const at = new URL(u);
+        return `${a.preferredUsername}@${at.host}` === acct || `${a.preferredUsername}@${at.hostname}` === acct;
       } catch {
         return false;
       }
@@ -67364,6 +67405,14 @@ var Deliverer = class {
 
 // web/app/deliver-relay.mjs
 init_fedify_sig();
+function doorKeyOf(doorInboxUrl) {
+  try {
+    const seg2 = new URL(doorInboxUrl).pathname.split("/");
+    return seg2[1] === "u" && seg2[2] ? decodeURIComponent(seg2[2]) : null;
+  } catch {
+    return null;
+  }
+}
 var RelayDeliverer = class extends Deliverer {
   constructor(opts) {
     super(opts);
@@ -67388,6 +67437,7 @@ var RelayDeliverer = class extends Deliverer {
       headers: {
         date: s.headers.date,
         digest: s.headers.digest,
+        accept: s.headers.accept,
         "content-type": s.headers["content-type"],
         signature: s.headers.signature
       }
@@ -69615,7 +69665,9 @@ var BrowserAgent = class _BrowserAgent {
       actorId: this.urls.actor,
       log: this.log,
       relayUrl: `${frontOrigin.replace(/\/$/, "")}/api/relay`,
-      handle: config.handle,
+      // The relay finds the account by the front's own key for it, which for a
+      // mail-door account is the full address, not the bare handle.
+      handle: doorKeyOf(config.gateway?.url) || config.handle,
       sessionFetch: session.fetch
     });
     this.publisher = new Publisher({