fedipod-server 0.14.0 → 0.14.1

package/lib/core/intake/activities.mjs

@@ -197,7 +197,7 @@ export async function onUndo(intake, activity, actor, { trusted = false } = {})
   intake.log(`unfollowed by ${actor}`);
 }
 
-export async function onCreate(intake, activity, actor) {
+export async function onCreate(intake, activity, actor, { trusted = false } = {}) {
   const objectId = typeof activity.object === 'string' ? activity.object : activity.object?.id;
   if (!objectId) return 'Create without object id';
   if (intake.store.isBlocked(objectId)) return `blocked domain (${objectId})`;
@@ -219,7 +219,15 @@ export async function onCreate(intake, activity, actor) {
   const ingested = intake.store.getStatuses()
     .some(x => x.noteId === objectId && (x.kind === 'timeline' || x.kind === 'mention'));
   if (!ingested) {
-    const rejected = await intake.ingestNote(objectId, actor);
+    // A verified delivery that carries the note inline is read from that
+    // copy: the door checked the sender's signature over these very bytes,
+    // and the receipt vouches for this actor. That is the only way a direct
+    // or followers-only post can ever be read — it lives in the sender's
+    // owner-only container, and fetching it from there answers 401 to
+    // everyone. An unverified delivery still fetches, as it always did.
+    const inline = trusted && typeof activity.object === 'object' && activity.object?.id === objectId
+      ? activity.object : null;
+    const rejected = await intake.ingestNote(objectId, actor, { inline });
     if (rejected) return rejected;
   }
   // A group carries its members' posts onward. Only reached from Create, so an

package/lib/core/intake/index.mjs

@@ -539,7 +539,7 @@ export class Intake {
     switch (activity.type) {
       case 'Follow': return this.onFollow(activity, actor, { trusted });
       case 'Undo': return this.onUndo(activity, actor, { trusted });
-      case 'Create': return this.onCreate(activity, actor);
+      case 'Create': return this.onCreate(activity, actor, { trusted });
       case 'Accept': return this.onAccept(activity, actor, { trusted });
       case 'Like': case 'Announce': {
         // FEP-1b12: a group Announces the member's whole Create, not the note.

package/lib/core/intake/notes.mjs

@@ -114,8 +114,10 @@ export function referencesOurObject(intake, activity) {
 // Shared tail of Create/Announce: deref the note at its origin (never trust
 // the delivered copy), mirror it into pod RDF + statuses, notify on replies
 // to our own notes. Returns a rejection reason string, or undefined.
-export async function ingestNote(intake, objectId, actor, { via } = {}) {
-  const note = await intake.fetchAP(objectId);
+export async function ingestNote(intake, objectId, actor, { via, inline = null } = {}) {
+  // `inline` is the note as delivered, offered only for a delivery whose
+  // signature the door verified (onCreate); otherwise the origin's copy.
+  const note = inline || await intake.fetchAP(objectId);
   if (!note) return `object fetch failed (${objectId})`;
   if (note.id !== objectId || !isContentType(note.type)) return `object not verifiable content (${objectId}, ${note.type})`;
   const { attachmentsOf, titledContent } = await import('../wire.mjs');

package/lib/core/social.mjs

@@ -15,7 +15,14 @@ import { dropFollower } from './store.mjs';
 // belongs behind the same SSRF guard as every other outbound request. fedify's
 // lookup did not go through ours. https only, because a handle resolved over
 // plaintext is a handle anyone on the path can answer for.
-export async function lookupWebFinger(acct) {
+//
+// `fetchImpl`, when given, makes the request instead of safeFetch: the agent's
+// own remote read, which in the browser build is the relay — a server-side
+// fetch, so the lookup does not depend on the far pod host answering a
+// browser's cross-origin request. Every other remote read there goes the
+// same way; WebFinger went direct and was the one lookup that could fail
+// while the rest worked.
+export async function lookupWebFinger(acct, { fetchImpl = null } = {}) {
   const clean = String(acct || '').replace(/^acct:/, '');
   const at = clean.lastIndexOf('@');
   if (at < 1) return null;
@@ -23,9 +30,8 @@ export async function lookupWebFinger(acct) {
   if (!host || /[/\\?#]/.test(host)) return null;
   const { safeFetch, readCapped } = await import('../shared/safefetch.mjs');
   const url = `https://${host}/.well-known/webfinger?resource=${encodeURIComponent(`acct:${clean}`)}`;
-  const res = await safeFetch(url, {
-    headers: { accept: 'application/jrd+json, application/json' },
-  }).catch(() => null);
+  const headers = { accept: 'application/jrd+json, application/json' };
+  const res = await (fetchImpl ? fetchImpl(url, { headers }) : safeFetch(url, { headers })).catch(() => null);
   if (!res || res.status >= 400) return null;
   let jrd;
   try { jrd = JSON.parse(await readCapped(res, 256 * 1024)); } catch { return null; }
@@ -80,13 +86,18 @@ export async function resolveHandle(agent, handle) {
   const clean = String(handle || '').replace(/^@/, '');
   if (!/^[^@]+@[^@]+$/.test(clean)) throw new Error('handle must look like user@host');
   if (agent.store.isBlocked('https://' + clean.split('@')[1] + '/')) throw new Error('domain is blocked');
-  const jrd = await lookupWebFinger('acct:' + clean);
+  // Through the agent's own remote read where it has one — the relay, in the
+  // browser build — and directly otherwise.
+  const remote = agent.intake?.deliverer?.signedFetch
+    ? (u, i) => agent.intake.deliverer.signedFetch(u, i) : null;
+  const lookup = (a) => lookupWebFinger(a, { fetchImpl: remote });
+  const jrd = await lookup('acct:' + clean);
   const self = selfLink(jrd);
   if (!self?.href) throw new Error(`webfinger found no actor for ${clean}`);
   const doc = await agent.intake.fetchAP(self.href);
   if (!doc?.id) throw new Error(`actor document unusable for ${clean}`);
   if (agent.store.isBlocked(doc.id)) throw new Error('actor is blocked');
-  await confirmDelegation(clean.slice(clean.lastIndexOf('@') + 1), doc);
+  await confirmDelegation(clean.slice(clean.lastIndexOf('@') + 1), doc, lookup);
   // Counts live in the collections, not the actor document, so a client asking
   // "who is this" would otherwise be told everyone has none. Two GETs, and only
   // when someone asked by name — never on the drain path.

package/lib/gateway/front-core.mjs

@@ -429,7 +429,14 @@ async function route(request, ctx) {
     // Re-attaching your own pod — a retry, a re-provision, a second browser — is
     // idempotent: it updates the row in place and keeps the same door secret.
     const prior = await ctx.lookup(key);
-    if (prior && prior.podHome !== podHome) return j(409, { error: 'that name is taken' });
+    // The same account on the same pod may correct where its tree lives — a
+    // row made by an older sign-up named the pod root, and every delivery
+    // to it was written where nothing reads. A different pod is still taken.
+    const sameOwner = (a, b) => { try { return new URL(a).origin === new URL(b).origin; } catch { return false; } };
+    if (prior && prior.podHome !== podHome
+      && !(prior.webId && prior.webId === webid && sameOwner(prior.podHome, podHome))) {
+      return j(409, { error: 'that name is taken' });
+    }
     // Re-attaching is idempotent — a retry, a re-provision, a second browser —
     // and it hands back the EXISTING receipt secret. So it has to be the same
     // person: matching podHome was enough on a subdomain server and, on a

package/lib/pod/inbox.mjs

@@ -22,10 +22,13 @@ const RECEIPT_CT = 'application/json';
  *
  * @returns {Promise<boolean>} whether it landed
  */
-export async function appendWithToken(url, body, contentType, { appendToken = null, fetchImpl = fetch } = {}) {
+export async function appendWithToken(url, body, contentType, { appendToken = null, fetchImpl = fetch, report = null } = {}) {
   const headers = { 'content-type': contentType,
     ...(appendToken ? { authorization: `Bearer ${appendToken}` } : {}) };
   const r = await fetchImpl(url, { method: 'PUT', headers, body }).catch(() => null);
+  // The pod's answer, for a caller that keeps a log: a refused write is
+  // otherwise a bare "failed" with the status thrown away.
+  report?.(r ? r.status : 0);
   return !!r && r.status < 400;
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fedipod-server",
-  "version": "0.14.0",
+  "version": "0.14.1",
   "description": "The FediPod Server: a full ActivityPub server as a Community Solid Server component.",
   "license": "MIT",
   "main": "dist/index.js",

package/web/app/agent.mjs

@@ -25,7 +25,7 @@ import { BrowserAtproto } from './atproto-browser.mjs';
 import { BskyFeed } from '../../lib/connections/bskyfeed.mjs';
 import { BrowserFediAccounts } from './fediacct-browser.mjs';
 import { AcctFeed } from '../../lib/connections/acctfeed.mjs';
-import { followActor, unfollowActor } from '../../lib/core/social.mjs';
+import { followActor, unfollowActor, resolveHandle } from '../../lib/core/social.mjs';
 import { ImportWorker } from '../../lib/connections/import.mjs';
 
 // The authorities this identity answers on: exactly one, this origin. The Node
@@ -212,6 +212,10 @@ export class BrowserAgent {
     this.publisher = new Publisher({
       config: this.store.getConfig(), remote: this.remote, store: this.store,
       deliverer: this.deliverer, publicKeyPem: keys.rsaPublicPem, assertionKey: null, log: this.log,
+      // Who a post names, resolved — the same lookup the installed agent
+      // gives its publisher. Without it no mention from the browser ever
+      // resolved: a direct message went to nobody, a mention notified no one.
+      resolveMention: (h) => resolveHandle(this, h),
     });
 
     // The Bluesky connection, stamped to this actor. The same client the Node

package/web/app/dist/sw.js

@@ -57393,7 +57393,7 @@ async function onUndo(intake, activity, actor, { trusted = false } = {}) {
   await intake.republish({ followers: true });
   intake.log(`unfollowed by ${actor}`);
 }
-async function onCreate(intake, activity, actor) {
+async function onCreate(intake, activity, actor, { trusted = false } = {}) {
   const objectId = typeof activity.object === "string" ? activity.object : activity.object?.id;
   if (!objectId) return "Create without object id";
   if (intake.store.isBlocked(objectId)) return `blocked domain (${objectId})`;
@@ -57402,7 +57402,8 @@ async function onCreate(intake, activity, actor) {
   if (!intake.concernsUs(envelope, actor)) return `not addressed to us (${objectId})`;
   const ingested = intake.store.getStatuses().some((x) => x.noteId === objectId && (x.kind === "timeline" || x.kind === "mention"));
   if (!ingested) {
-    const rejected = await intake.ingestNote(objectId, actor);
+    const inline = trusted && typeof activity.object === "object" && activity.object?.id === objectId ? activity.object : null;
+    const rejected = await intake.ingestNote(objectId, actor, { inline });
     if (rejected) return rejected;
   }
   if (intake.config.kind === "group") await intake.amplify(objectId, { activity });
@@ -57616,8 +57617,8 @@ function referencesOurObject(intake, activity) {
   if (refs.some((r) => r.startsWith(intake.urls.notes))) return true;
   return intake.config.kind === "group" && refs.some((r) => intake.store.getStatuses().some((s) => s.noteId === r));
 }
-async function ingestNote(intake, objectId, actor, { via } = {}) {
-  const note = await intake.fetchAP(objectId);
+async function ingestNote(intake, objectId, actor, { via, inline = null } = {}) {
+  const note = inline || await intake.fetchAP(objectId);
   if (!note) return `object fetch failed (${objectId})`;
   if (note.id !== objectId || !isContentType(note.type)) return `object not verifiable content (${objectId}, ${note.type})`;
   const { attachmentsOf: attachmentsOf3, titledContent: titledContent2 } = await Promise.resolve().then(() => (init_wire(), wire_exports));
@@ -63143,7 +63144,7 @@ var Intake = class {
       case "Undo":
         return this.onUndo(activity, actor, { trusted });
       case "Create":
-        return this.onCreate(activity, actor);
+        return this.onCreate(activity, actor, { trusted });
       case "Accept":
         return this.onAccept(activity, actor, { trusted });
       case "Like":
@@ -64122,7 +64123,7 @@ __export(social_exports, {
 });
 init_node_crypto();
 init_wire();
-async function lookupWebFinger(acct) {
+async function lookupWebFinger(acct, { fetchImpl = null } = {}) {
   const clean = String(acct || "").replace(/^acct:/, "");
   const at = clean.lastIndexOf("@");
   if (at < 1) return null;
@@ -64130,9 +64131,8 @@ async function lookupWebFinger(acct) {
   if (!host || /[/\\?#]/.test(host)) return null;
   const { safeFetch: safeFetch2, readCapped: readCapped3 } = await Promise.resolve().then(() => (init_safefetch(), safefetch_exports));
   const url = `https://${host}/.well-known/webfinger?resource=${encodeURIComponent(`acct:${clean}`)}`;
-  const res = await safeFetch2(url, {
-    headers: { accept: "application/jrd+json, application/json" }
-  }).catch(() => null);
+  const headers = { accept: "application/jrd+json, application/json" };
+  const res = await (fetchImpl ? fetchImpl(url, { headers }) : safeFetch2(url, { headers })).catch(() => null);
   if (!res || res.status >= 400) return null;
   let jrd2;
   try {
@@ -64168,13 +64168,15 @@ async function resolveHandle(agent2, handle7) {
   const clean = String(handle7 || "").replace(/^@/, "");
   if (!/^[^@]+@[^@]+$/.test(clean)) throw new Error("handle must look like user@host");
   if (agent2.store.isBlocked("https://" + clean.split("@")[1] + "/")) throw new Error("domain is blocked");
-  const jrd2 = await lookupWebFinger("acct:" + clean);
+  const remote = agent2.intake?.deliverer?.signedFetch ? (u, i) => agent2.intake.deliverer.signedFetch(u, i) : null;
+  const lookup2 = (a) => lookupWebFinger(a, { fetchImpl: remote });
+  const jrd2 = await lookup2("acct:" + clean);
   const self2 = selfLink(jrd2);
   if (!self2?.href) throw new Error(`webfinger found no actor for ${clean}`);
   const doc = await agent2.intake.fetchAP(self2.href);
   if (!doc?.id) throw new Error(`actor document unusable for ${clean}`);
   if (agent2.store.isBlocked(doc.id)) throw new Error("actor is blocked");
-  await confirmDelegation(clean.slice(clean.lastIndexOf("@") + 1), doc);
+  await confirmDelegation(clean.slice(clean.lastIndexOf("@") + 1), doc, lookup2);
   await cacheCounts(agent2, doc);
   return doc;
 }
@@ -69764,7 +69766,11 @@ var BrowserAgent = class _BrowserAgent {
       deliverer: this.deliverer,
       publicKeyPem: keys.rsaPublicPem,
       assertionKey: null,
-      log: this.log
+      log: this.log,
+      // Who a post names, resolved — the same lookup the installed agent
+      // gives its publisher. Without it no mention from the browser ever
+      // resolved: a direct message went to nobody, a mention notified no one.
+      resolveMention: (h) => resolveHandle(this, h)
     });
     this.atproto = new BrowserAtproto({ store: this.store, actorId: this.urls.actor, log: this.log });
     this.publisher.atproto = this.atproto;