fedipod-server 0.13.2 → 0.14.1

package/lib/client/masto/statuses.mjs

@@ -95,8 +95,16 @@ export async function handle(api, ctx) {
       api.store.setScheduled(sched);
       return send(200, api.scheduledJson(entry));
     }
-    const note = await api.agent.publisher.publishNote(body.status,
-      { inReplyTo, attachments, visibility, spoilerText });
+    let note;
+    try {
+      note = await api.agent.publisher.publishNote(body.status,
+        { inReplyTo, attachments, visibility, spoilerText });
+    } catch (e) {
+      // A direct message nobody could be found for: the sender's mistake to
+      // fix, said in the client, not a fault of the server.
+      if (e.code === 'unaddressed') return send(422, { error: e.message });
+      throw e;
+    }
     const s = api.store.getStatuses().find(x => x.noteId === note.id);
     return send(200, api.status(s));
   }
@@ -182,6 +190,12 @@ export async function handle(api, ctx) {
   const mContext = /^\/api\/v1\/statuses\/([a-f0-9]+)\/context$/.exec(pathname);
   if (mContext) {
     const noteUrl = api.lookup(mContext[1]).s?.noteId;
+    // A Bluesky post's conversation lives on Bluesky: ask for it now, so the
+    // replies (and their pictures) are in the mirror before the thread is built.
+    const opened = noteUrl && api.store.getStatuses().find(x => x.noteId === noteUrl);
+    if (opened?.kind === 'bsky' && typeof api.agent?.bskyfeed?.mirrorThread === 'function') {
+      await api.agent.bskyfeed.mirrorThread(noteUrl);
+    }
     const all = api.store.getStatuses();
     const byId = new Map(all.map(s => [s.noteId, s]));
     const ancestors = [];

package/lib/connections/bskyfeed.mjs

@@ -18,6 +18,22 @@ export const postUrl = (uri) => {
   return m ? `https://bsky.app/profile/${m[1]}/post/${m[2]}` : null;
 };
 
+// Every place a post view keeps pictures: a plain image post, the media half
+// of a quote-with-media, and a link card's thumbnail. Bluesky's view types
+// differ by shape, not by a flag, so each is read where it lives.
+export function attachmentsOf(post) {
+  const e = post?.embed || {};
+  const images = [...(e.images || []), ...(e.media?.images || [])]
+    .filter(i => i?.fullsize)
+    .map(i => ({ url: i.fullsize, mediaType: 'image/jpeg', description: i.alt || '' }));
+  const card = e.external?.thumb || e.media?.external?.thumb;
+  if (card) {
+    const ext = e.external || e.media.external;
+    images.push({ url: card, mediaType: 'image/jpeg', description: ext.title || ext.uri || '' });
+  }
+  return images;
+}
+
 export class BskyFeed {
   constructor({ store, atproto, log = console.log, onNotification = null }) {
     Object.assign(this, { store, atproto, log, onNotification });
@@ -73,14 +89,27 @@ export class BskyFeed {
   }
 
   // One Bluesky post into the statuses index. Returns its noteId, new or not.
+  // A post seen before is completed, not duplicated: a reply first met as a
+  // bare notification record learns its parent and its pictures from the
+  // full view when that arrives.
   _mirrorPost(post, { via = null } = {}) {
     const noteId = post.uri;
-    const existing = this.store.getStatuses().some(s => s.noteId === noteId);
-    if (existing) return { noteId, added: false };
+    const inReplyTo = post.record?.reply?.parent?.uri || null;
+    const attachments = attachmentsOf(post);
+    const existing = this.store.getStatuses().find(s => s.noteId === noteId);
+    if (existing) {
+      const patch = {
+        ...(inReplyTo && !existing.inReplyTo ? { inReplyTo } : {}),
+        ...(attachments.length && !existing.attachments?.length ? { attachments } : {}),
+      };
+      if (Object.keys(patch).length && typeof this.store.updateStatus === 'function') {
+        this.store.updateStatus(noteId, patch);
+      }
+      return { noteId, added: false };
+    }
     const actor = this._rememberAuthor(post.author);
     if (this.store.isBlocked(actor)) return { noteId, added: false };
     const text = post.record?.text || '';
-    const images = post.embed?.images || [];
     this.store.addStatus({
       noteId, actor,
       content: `<p>${text.replace(/[&<>]/g, c => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;' }[c]))}</p>`,
@@ -89,13 +118,48 @@ export class BskyFeed {
       ...(post.cid ? { cid: post.cid } : {}),
       link: postUrl(noteId),
       ...(via ? { via } : {}),
-      ...(images.length ? {
-        attachments: images.map(i => ({ url: i.fullsize, mediaType: 'image/jpeg', description: i.alt || '' })),
-      } : {}),
+      ...(inReplyTo ? { inReplyTo } : {}),
+      ...(attachments.length ? { attachments } : {}),
     });
     return { noteId, added: true };
   }
 
+  // The conversation under one post, asked for when a post is opened: the
+  // ancestors it hangs from and the replies beneath it, each mirrored with
+  // the reply link the thread view is built from. View cache only, like the
+  // timeline. Returns how many posts were new; a thread Bluesky will not
+  // give (gone, blocked, rate-limited) adds none and is logged, not thrown.
+  async mirrorThread(uri, { depth = 6 } = {}) {
+    if (!this.atproto?.connected()) return 0;
+    if (this.quietUntil && Date.now() < this.quietUntil) return 0;
+    let out;
+    try {
+      out = await this.atproto.xrpc('app.bsky.feed.getPostThread', { params: { uri, depth, parentHeight: 40 } });
+    } catch (e) {
+      if (e.status === 429 || e.status >= 500) this._backOff(e.status, null);
+      else this.log(`bskyfeed: thread ${uri}: ${e.message}`);
+      return 0;
+    }
+    const self = this.atproto.read()?.did;
+    const ownMirrors = new Set(this.store.getStatuses().map(s => s.atproto?.uri).filter(Boolean));
+    let added = 0;
+    const take = (node) => {
+      const post = node?.post;
+      if (!post?.uri) return;                                   // notFoundPost, blockedPost
+      if (post.author?.did === self && ownMirrors.has(post.uri)) return;
+      if (this._mirrorPost(post).added) added++;
+    };
+    for (let up = out?.thread?.parent; up; up = up.parent) take(up);
+    const walk = (node, left) => {
+      take(node);
+      if (left <= 0) return;
+      for (const r of node?.replies || []) walk(r, left - 1);
+    };
+    walk(out?.thread, depth);
+    if (added) this.log(`bskyfeed: +${added} from the thread under ${uri}`);
+    return added;
+  }
+
   async sweep() {
     if (!this.atproto?.connected()) return;
     if (this.quietUntil && Date.now() < this.quietUntil) return;
@@ -142,8 +206,15 @@ export class BskyFeed {
           this.store.addNotification({ type: 'follow', actor, bsky: true });
           await this.onNotification?.(n, { actor });
         } else if (n.reason === 'mention' || n.reason === 'reply') {
-          const record = { uri: n.uri, cid: n.cid, author: n.author, record: n.record, indexedAt: n.indexedAt };
-          this._mirrorPost(record);
+          // The notification carries the bare record — no picture URLs and
+          // no view. The post view has both; the record is the fallback when
+          // Bluesky will not give the view.
+          let view = null;
+          try {
+            const got = await this.atproto.xrpc('app.bsky.feed.getPosts', { params: { uris: n.uri } });
+            view = (got?.posts || [])[0] || null;
+          } catch { /* the bare record still stands */ }
+          this._mirrorPost(view || { uri: n.uri, cid: n.cid, author: n.author, record: n.record, indexedAt: n.indexedAt });
           this.store.addNotification({ type: 'mention', actor, noteId: n.uri, bsky: true });
           await this.onNotification?.(n, { actor });
         }

package/lib/core/intake/activities.mjs

@@ -197,7 +197,7 @@ export async function onUndo(intake, activity, actor, { trusted = false } = {})
   intake.log(`unfollowed by ${actor}`);
 }
 
-export async function onCreate(intake, activity, actor) {
+export async function onCreate(intake, activity, actor, { trusted = false } = {}) {
   const objectId = typeof activity.object === 'string' ? activity.object : activity.object?.id;
   if (!objectId) return 'Create without object id';
   if (intake.store.isBlocked(objectId)) return `blocked domain (${objectId})`;
@@ -219,7 +219,15 @@ export async function onCreate(intake, activity, actor) {
   const ingested = intake.store.getStatuses()
     .some(x => x.noteId === objectId && (x.kind === 'timeline' || x.kind === 'mention'));
   if (!ingested) {
-    const rejected = await intake.ingestNote(objectId, actor);
+    // A verified delivery that carries the note inline is read from that
+    // copy: the door checked the sender's signature over these very bytes,
+    // and the receipt vouches for this actor. That is the only way a direct
+    // or followers-only post can ever be read — it lives in the sender's
+    // owner-only container, and fetching it from there answers 401 to
+    // everyone. An unverified delivery still fetches, as it always did.
+    const inline = trusted && typeof activity.object === 'object' && activity.object?.id === objectId
+      ? activity.object : null;
+    const rejected = await intake.ingestNote(objectId, actor, { inline });
     if (rejected) return rejected;
   }
   // A group carries its members' posts onward. Only reached from Create, so an

package/lib/core/intake/index.mjs

@@ -539,7 +539,7 @@ export class Intake {
     switch (activity.type) {
       case 'Follow': return this.onFollow(activity, actor, { trusted });
       case 'Undo': return this.onUndo(activity, actor, { trusted });
-      case 'Create': return this.onCreate(activity, actor);
+      case 'Create': return this.onCreate(activity, actor, { trusted });
       case 'Accept': return this.onAccept(activity, actor, { trusted });
       case 'Like': case 'Announce': {
         // FEP-1b12: a group Announces the member's whole Create, not the note.

package/lib/core/intake/notes.mjs

@@ -114,8 +114,10 @@ export function referencesOurObject(intake, activity) {
 // Shared tail of Create/Announce: deref the note at its origin (never trust
 // the delivered copy), mirror it into pod RDF + statuses, notify on replies
 // to our own notes. Returns a rejection reason string, or undefined.
-export async function ingestNote(intake, objectId, actor, { via } = {}) {
-  const note = await intake.fetchAP(objectId);
+export async function ingestNote(intake, objectId, actor, { via, inline = null } = {}) {
+  // `inline` is the note as delivered, offered only for a delivery whose
+  // signature the door verified (onCreate); otherwise the origin's copy.
+  const note = inline || await intake.fetchAP(objectId);
   if (!note) return `object fetch failed (${objectId})`;
   if (note.id !== objectId || !isContentType(note.type)) return `object not verifiable content (${objectId}, ${note.type})`;
   const { attachmentsOf, titledContent } = await import('../wire.mjs');
@@ -213,7 +215,13 @@ export async function ingestNote(intake, objectId, actor, { via } = {}) {
     ...(attachments.length ? { attachments } : {}),
     ...(via ? { via } : {}),
   });
-  if (!followed || (note.inReplyTo && String(note.inReplyTo).startsWith(intake.urls.notes))) {
+  // A notification for anything addressed to this person: a stranger's
+  // post, a reply to one of ours, a direct message, or a post that names
+  // us — whoever sent it. A direct message from someone followed used to
+  // raise nothing and sat unseen in the private mentions.
+  const namesUs = mentions.some((m) => m.href === intake.urls.actor);
+  const replyToOurs = !!note.inReplyTo && String(note.inReplyTo).startsWith(intake.urls.notes);
+  if (!followed || replyToOurs || direct || namesUs) {
     intake.store.addNotification({ type: 'mention', actor: author, noteId: note.id });
   }
   if (note.inReplyTo && String(note.inReplyTo).startsWith(intake.urls.notes)) {

package/lib/core/publisher/notes.mjs

@@ -83,6 +83,22 @@ export async function mentionsFor(publisher, content, inReplyTo) {
   return mentions;
 }
 
+// A direct post goes only to the people it names, so one that names nobody
+// the agent can find would be kept in the private container and delivered
+// to no one, with nothing said. Refused instead, before anything is written,
+// with the handles that did not resolve — that is what the sender can act on.
+export function assertDirectAddressed(content, mentions) {
+  const wanted = [...new Set(wire.mentionsIn(content))];
+  const missing = wanted.filter((h) => !mentions.some((m) => m.handle === h));
+  let why = null;
+  if (!wanted.length) why = 'a direct message names who it is for — mention them as @name@host';
+  else if (missing.length) why = `could not find ${missing.map((h) => '@' + h).join(', ')} — the direct message was not sent`;
+  if (!why) return;
+  const e = new Error(why);
+  e.code = 'unaddressed';
+  throw e;
+}
+
 export async function publishNote(publisher, content, { inReplyTo, attachments, visibility = 'public', spoilerText = null } = {}) {
   const { urls } = publisher;
   const priv = visibility === 'private' || visibility === 'direct';
@@ -93,6 +109,7 @@ export async function publishNote(publisher, content, { inReplyTo, attachments,
   const published = new Date().toISOString();
   const slug = published.slice(0, 10) + '-' + crypto.randomBytes(4).toString('hex');
   const mentions = await publisher._mentionsFor(content, inReplyTo);
+  if (visibility === 'direct') assertDirectAddressed(content, mentions);
   const note = wire.noteDoc({ urls, slug, content, published, inReplyTo, attachments, mentions,
     visibility, summary: spoilerText, container: priv ? urls.privateNotes : urls.notes });
 

package/lib/core/publisher/questions.mjs

@@ -9,6 +9,7 @@ import crypto from 'node:crypto';
 import * as wire from '../wire.mjs';
 import * as polls from '../polls.mjs';
 import * as podNotes from '../../pod/notes.mjs';
+import { assertDirectAddressed } from './notes.mjs';
 
 // How long a poll gathers votes before its Question is rewritten. Every vote
 // changes a number other servers re-read, and rewriting per vote would make a
@@ -52,6 +53,7 @@ export async function publishQuestion(publisher, content, { options = [], multip
   const published = new Date().toISOString();
   const slug = published.slice(0, 10) + '-' + crypto.randomBytes(4).toString('hex');
   const mentions = await publisher._mentionsFor(content, inReplyTo);
+  if (visibility === 'direct') assertDirectAddressed(content, mentions);
   const poll = {
     multiple: !!multiple,
     expiresAt: expiresAt || null,

package/lib/core/social.mjs

@@ -15,7 +15,14 @@ import { dropFollower } from './store.mjs';
 // belongs behind the same SSRF guard as every other outbound request. fedify's
 // lookup did not go through ours. https only, because a handle resolved over
 // plaintext is a handle anyone on the path can answer for.
-export async function lookupWebFinger(acct) {
+//
+// `fetchImpl`, when given, makes the request instead of safeFetch: the agent's
+// own remote read, which in the browser build is the relay — a server-side
+// fetch, so the lookup does not depend on the far pod host answering a
+// browser's cross-origin request. Every other remote read there goes the
+// same way; WebFinger went direct and was the one lookup that could fail
+// while the rest worked.
+export async function lookupWebFinger(acct, { fetchImpl = null } = {}) {
   const clean = String(acct || '').replace(/^acct:/, '');
   const at = clean.lastIndexOf('@');
   if (at < 1) return null;
@@ -23,9 +30,8 @@ export async function lookupWebFinger(acct) {
   if (!host || /[/\\?#]/.test(host)) return null;
   const { safeFetch, readCapped } = await import('../shared/safefetch.mjs');
   const url = `https://${host}/.well-known/webfinger?resource=${encodeURIComponent(`acct:${clean}`)}`;
-  const res = await safeFetch(url, {
-    headers: { accept: 'application/jrd+json, application/json' },
-  }).catch(() => null);
+  const headers = { accept: 'application/jrd+json, application/json' };
+  const res = await (fetchImpl ? fetchImpl(url, { headers }) : safeFetch(url, { headers })).catch(() => null);
   if (!res || res.status >= 400) return null;
   let jrd;
   try { jrd = JSON.parse(await readCapped(res, 256 * 1024)); } catch { return null; }
@@ -80,13 +86,18 @@ export async function resolveHandle(agent, handle) {
   const clean = String(handle || '').replace(/^@/, '');
   if (!/^[^@]+@[^@]+$/.test(clean)) throw new Error('handle must look like user@host');
   if (agent.store.isBlocked('https://' + clean.split('@')[1] + '/')) throw new Error('domain is blocked');
-  const jrd = await lookupWebFinger('acct:' + clean);
+  // Through the agent's own remote read where it has one — the relay, in the
+  // browser build — and directly otherwise.
+  const remote = agent.intake?.deliverer?.signedFetch
+    ? (u, i) => agent.intake.deliverer.signedFetch(u, i) : null;
+  const lookup = (a) => lookupWebFinger(a, { fetchImpl: remote });
+  const jrd = await lookup('acct:' + clean);
   const self = selfLink(jrd);
   if (!self?.href) throw new Error(`webfinger found no actor for ${clean}`);
   const doc = await agent.intake.fetchAP(self.href);
   if (!doc?.id) throw new Error(`actor document unusable for ${clean}`);
   if (agent.store.isBlocked(doc.id)) throw new Error('actor is blocked');
-  await confirmDelegation(clean.slice(clean.lastIndexOf('@') + 1), doc);
+  await confirmDelegation(clean.slice(clean.lastIndexOf('@') + 1), doc, lookup);
   // Counts live in the collections, not the actor document, so a client asking
   // "who is this" would otherwise be told everyone has none. Two GETs, and only
   // when someone asked by name — never on the drain path.

package/lib/gateway/front-core.mjs

@@ -429,7 +429,14 @@ async function route(request, ctx) {
     // Re-attaching your own pod — a retry, a re-provision, a second browser — is
     // idempotent: it updates the row in place and keeps the same door secret.
     const prior = await ctx.lookup(key);
-    if (prior && prior.podHome !== podHome) return j(409, { error: 'that name is taken' });
+    // The same account on the same pod may correct where its tree lives — a
+    // row made by an older sign-up named the pod root, and every delivery
+    // to it was written where nothing reads. A different pod is still taken.
+    const sameOwner = (a, b) => { try { return new URL(a).origin === new URL(b).origin; } catch { return false; } };
+    if (prior && prior.podHome !== podHome
+      && !(prior.webId && prior.webId === webid && sameOwner(prior.podHome, podHome))) {
+      return j(409, { error: 'that name is taken' });
+    }
     // Re-attaching is idempotent — a retry, a re-provision, a second browser —
     // and it hands back the EXISTING receipt secret. So it has to be the same
     // person: matching podHome was enough on a subdomain server and, on a
@@ -588,8 +595,10 @@ async function route(request, ctx) {
   if (up.rest === 'ap/inbox/' || up.rest === 'ap/inbox') {
     if (request.method !== 'POST') return { status: 405, headers: {}, body: '' };
     const policy = await policyFor(rec, ctx.fetchImpl || fetch);
-    const { status } = await handleDelivery(request, identFor(rec, policy),
+    const { status, reason } = await handleDelivery(request, identFor(rec, policy),
       { podPut: (u, b, ct) => ctx.podPut(up.handle, u, b, ct), fetchImpl: ctx.fetchImpl });
+    // One line per delivery, so "did it arrive at the door" has an answer.
+    console.log(`door @${up.handle}: delivery → ${status} (${reason})`);
     return { status, headers: {}, body: '' };
   }
 

package/lib/pod/inbox.mjs

@@ -22,10 +22,13 @@ const RECEIPT_CT = 'application/json';
  *
  * @returns {Promise<boolean>} whether it landed
  */
-export async function appendWithToken(url, body, contentType, { appendToken = null, fetchImpl = fetch } = {}) {
+export async function appendWithToken(url, body, contentType, { appendToken = null, fetchImpl = fetch, report = null } = {}) {
   const headers = { 'content-type': contentType,
     ...(appendToken ? { authorization: `Bearer ${appendToken}` } : {}) };
   const r = await fetchImpl(url, { method: 'PUT', headers, body }).catch(() => null);
+  // The pod's answer, for a caller that keeps a log: a refused write is
+  // otherwise a bare "failed" with the status thrown away.
+  report?.(r ? r.status : 0);
   return !!r && r.status < 400;
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fedipod-server",
-  "version": "0.13.2",
+  "version": "0.14.1",
   "description": "The FediPod Server: a full ActivityPub server as a Community Solid Server component.",
   "license": "MIT",
   "main": "dist/index.js",

package/web/app/agent.mjs

@@ -25,7 +25,7 @@ import { BrowserAtproto } from './atproto-browser.mjs';
 import { BskyFeed } from '../../lib/connections/bskyfeed.mjs';
 import { BrowserFediAccounts } from './fediacct-browser.mjs';
 import { AcctFeed } from '../../lib/connections/acctfeed.mjs';
-import { followActor, unfollowActor } from '../../lib/core/social.mjs';
+import { followActor, unfollowActor, resolveHandle } from '../../lib/core/social.mjs';
 import { ImportWorker } from '../../lib/connections/import.mjs';
 
 // The authorities this identity answers on: exactly one, this origin. The Node
@@ -212,6 +212,10 @@ export class BrowserAgent {
     this.publisher = new Publisher({
       config: this.store.getConfig(), remote: this.remote, store: this.store,
       deliverer: this.deliverer, publicKeyPem: keys.rsaPublicPem, assertionKey: null, log: this.log,
+      // Who a post names, resolved — the same lookup the installed agent
+      // gives its publisher. Without it no mention from the browser ever
+      // resolved: a direct message went to nobody, a mention notified no one.
+      resolveMention: (h) => resolveHandle(this, h),
     });
 
     // The Bluesky connection, stamped to this actor. The same client the Node