fedipod-server 0.14.0 → 0.15.0

package/web/app/dist/sw.js

@@ -141,6 +141,13 @@ function apUrls(remotePod, root, { publicBase = null } = {}) {
   }
   return urls;
 }
+function podBaseOfWebId(webId) {
+  const u = new URL(webId);
+  u.hash = "";
+  u.search = "";
+  const dir = u.pathname.replace(/profile\/card$/u, "").replace(/[^/]*$/u, "");
+  return `${u.origin}${dir.endsWith("/") ? dir : dir + "/"}`;
+}
 function webfingerHost(podUrl) {
   const u = new URL(podUrl);
   return u.pathname === "/" ? u.host : null;
@@ -9651,9 +9658,10 @@ function hostMeta(base) {
 </XRD>
 `;
 }
-function jrd({ handle: handle7, host, actor }) {
+function jrd({ handle: handle7, host, actor, aliases = [] }) {
   return {
     subject: `acct:${handle7}@${host}`,
+    ...aliases.length ? { aliases } : {},
     links: [{ rel: "self", type: "application/activity+json", href: actor }]
   };
 }
@@ -57393,7 +57401,7 @@ async function onUndo(intake, activity, actor, { trusted = false } = {}) {
   await intake.republish({ followers: true });
   intake.log(`unfollowed by ${actor}`);
 }
-async function onCreate(intake, activity, actor) {
+async function onCreate(intake, activity, actor, { trusted = false } = {}) {
   const objectId = typeof activity.object === "string" ? activity.object : activity.object?.id;
   if (!objectId) return "Create without object id";
   if (intake.store.isBlocked(objectId)) return `blocked domain (${objectId})`;
@@ -57402,7 +57410,8 @@ async function onCreate(intake, activity, actor) {
   if (!intake.concernsUs(envelope, actor)) return `not addressed to us (${objectId})`;
   const ingested = intake.store.getStatuses().some((x) => x.noteId === objectId && (x.kind === "timeline" || x.kind === "mention"));
   if (!ingested) {
-    const rejected = await intake.ingestNote(objectId, actor);
+    const inline = trusted && typeof activity.object === "object" && activity.object?.id === objectId ? activity.object : null;
+    const rejected = await intake.ingestNote(objectId, actor, { inline });
     if (rejected) return rejected;
   }
   if (intake.config.kind === "group") await intake.amplify(objectId, { activity });
@@ -57616,8 +57625,8 @@ function referencesOurObject(intake, activity) {
   if (refs.some((r) => r.startsWith(intake.urls.notes))) return true;
   return intake.config.kind === "group" && refs.some((r) => intake.store.getStatuses().some((s) => s.noteId === r));
 }
-async function ingestNote(intake, objectId, actor, { via } = {}) {
-  const note = await intake.fetchAP(objectId);
+async function ingestNote(intake, objectId, actor, { via, inline = null } = {}) {
+  const note = inline || await intake.fetchAP(objectId);
   if (!note) return `object fetch failed (${objectId})`;
   if (note.id !== objectId || !isContentType(note.type)) return `object not verifiable content (${objectId}, ${note.type})`;
   const { attachmentsOf: attachmentsOf3, titledContent: titledContent2 } = await Promise.resolve().then(() => (init_wire(), wire_exports));
@@ -63143,7 +63152,7 @@ var Intake = class {
       case "Undo":
         return this.onUndo(activity, actor, { trusted });
       case "Create":
-        return this.onCreate(activity, actor);
+        return this.onCreate(activity, actor, { trusted });
       case "Accept":
         return this.onAccept(activity, actor, { trusted });
       case "Like":
@@ -64122,7 +64131,7 @@ __export(social_exports, {
 });
 init_node_crypto();
 init_wire();
-async function lookupWebFinger(acct) {
+async function lookupWebFinger(acct, { fetchImpl = null } = {}) {
   const clean = String(acct || "").replace(/^acct:/, "");
   const at = clean.lastIndexOf("@");
   if (at < 1) return null;
@@ -64130,9 +64139,8 @@ async function lookupWebFinger(acct) {
   if (!host || /[/\\?#]/.test(host)) return null;
   const { safeFetch: safeFetch2, readCapped: readCapped3 } = await Promise.resolve().then(() => (init_safefetch(), safefetch_exports));
   const url = `https://${host}/.well-known/webfinger?resource=${encodeURIComponent(`acct:${clean}`)}`;
-  const res = await safeFetch2(url, {
-    headers: { accept: "application/jrd+json, application/json" }
-  }).catch(() => null);
+  const headers = { accept: "application/jrd+json, application/json" };
+  const res = await (fetchImpl ? fetchImpl(url, { headers }) : safeFetch2(url, { headers })).catch(() => null);
   if (!res || res.status >= 400) return null;
   let jrd2;
   try {
@@ -64168,13 +64176,15 @@ async function resolveHandle(agent2, handle7) {
   const clean = String(handle7 || "").replace(/^@/, "");
   if (!/^[^@]+@[^@]+$/.test(clean)) throw new Error("handle must look like user@host");
   if (agent2.store.isBlocked("https://" + clean.split("@")[1] + "/")) throw new Error("domain is blocked");
-  const jrd2 = await lookupWebFinger("acct:" + clean);
+  const remote = agent2.intake?.deliverer?.signedFetch ? (u, i) => agent2.intake.deliverer.signedFetch(u, i) : null;
+  const lookup2 = (a) => lookupWebFinger(a, { fetchImpl: remote });
+  const jrd2 = await lookup2("acct:" + clean);
   const self2 = selfLink(jrd2);
   if (!self2?.href) throw new Error(`webfinger found no actor for ${clean}`);
   const doc = await agent2.intake.fetchAP(self2.href);
   if (!doc?.id) throw new Error(`actor document unusable for ${clean}`);
   if (agent2.store.isBlocked(doc.id)) throw new Error("actor is blocked");
-  await confirmDelegation(clean.slice(clean.lastIndexOf("@") + 1), doc);
+  await confirmDelegation(clean.slice(clean.lastIndexOf("@") + 1), doc, lookup2);
   await cacheCounts(agent2, doc);
   return doc;
 }
@@ -66229,8 +66239,11 @@ var MastoApi = class _MastoApi {
     });
     return this._push;
   }
+  // The host in the owner's own address: the gateway's when the identity is
+  // fronted (its documents still live on the pod, but its name does not).
   get host() {
-    return this.urls ? new URL(this.urls.base).host : "unconfigured.invalid";
+    if (!this.urls) return "unconfigured.invalid";
+    return new URL(this.urls.publicHome || this.urls.base).host;
   }
   // Where the live feed is, as the CLIENT must address it: this agent's own
   // origin, taken from the request, not the pod's host. An instance document
@@ -66844,9 +66857,10 @@ var PodTransport = class {
     return serialize(doc, g, url, "text/turtle");
   }
   async setAcl(targetUrl, publicModes, opts = {}) {
-    const url = await this.aclUrlFor(targetUrl);
+    const podTarget = this.toPod ? this.toPod(targetUrl) : targetUrl;
+    const url = await this.aclUrlFor(podTarget);
     if (!await this.aclWritable(url)) return null;
-    return this.put(url, this.aclDoc(targetUrl, publicModes, { ...opts, aclUrl: url }), "text/turtle");
+    return this.put(url, this.aclDoc(podTarget, publicModes, { ...opts, aclUrl: url }), "text/turtle");
   }
   // Child documents of an LDP container (URLs under it, excluding aux docs).
   // Revalidated: the inbox is polled every couple of minutes and is usually
@@ -67164,14 +67178,16 @@ async function cacheOpenedKeys(actorUrl, keysRecord) {
   return keys;
 }
 var keyCacheKey = (actorUrl) => `signing-keys:${actorUrl}`;
+var podActorOf = (urls) => urls.toPod ? urls.toPod(urls.actor) : urls.actor;
 async function loadKeysFromPod(remote, urls) {
-  const cached = await kvGet(keyCacheKey(urls.actor)).catch(() => null);
+  const podActor = podActorOf(urls);
+  const cached = await kvGet(keyCacheKey(podActor)).catch(() => null);
   if (isOpenedKey(cached)) return fromCache(cached);
-  if (cached?.rsa?.privatePem) return cacheOpenedKeys(urls.actor, cached);
+  if (cached?.rsa?.privatePem) return cacheOpenedKeys(podActor, cached);
   const doc = await readWrappedKeys(remote, urls);
   if (isKeyEnvelope(doc)) throw new KeyPasswordNeeded();
   if (!doc || !doc.rsa) throw new Error("no signing key on the pod \u2014 sign up did not finish");
-  return cacheOpenedKeys(urls.actor, doc);
+  return cacheOpenedKeys(podActor, doc);
 }
 
 // lib/core/deliver.mjs
@@ -69600,6 +69616,7 @@ var AcctFeed = class {
 };
 
 // web/app/agent.mjs
+init_urls();
 var originAuthorities = (host) => ({
   set: /* @__PURE__ */ new Set([String(host || "").toLowerCase()]),
   has(authority) {
@@ -69724,7 +69741,7 @@ var BrowserAgent = class _BrowserAgent {
     if (oidc) {
       session = { fetch: (u, i) => oidc.fetch(u, i) };
       webId = oidc.webId;
-      remotePod = new URL(webId).origin + "/";
+      remotePod = podBaseOfWebId(webId);
     } else {
       const dpop = await makeDpopSession(credential);
       session = { fetch: (u, i) => dpop.fetch(u, i) };
@@ -69742,8 +69759,11 @@ var BrowserAgent = class _BrowserAgent {
     const cfg = config || this.store.getConfig();
     if (!cfg) throw new Error("no account config on this pod \u2014 sign up first");
     this.store.setConfig({ ...this.store.getConfig() || {}, ...cfg, root });
-    const keys = keysRecord ? await importSigningKey(keysRecord) : await loadKeysFromPod(this.remote, this.urls);
     config = this.store.getConfig();
+    const publicBase = config.gateway?.frontActor ? config.gateway.frontActor.replace(/ap\/actor\/?$/, "") : null;
+    this.urls = apUrls2(remotePod, root, { publicBase });
+    if (this.urls.toPod) this.remote.setUrlMap(this.urls.toPod);
+    const keys = keysRecord ? await importSigningKey(keysRecord) : await loadKeysFromPod(this.remote, this.urls);
     this.deliverer = new RelayDeliverer({
       passive: true,
       store: this.store,
@@ -69764,7 +69784,11 @@ var BrowserAgent = class _BrowserAgent {
       deliverer: this.deliverer,
       publicKeyPem: keys.rsaPublicPem,
       assertionKey: null,
-      log: this.log
+      log: this.log,
+      // Who a post names, resolved — the same lookup the installed agent
+      // gives its publisher. Without it no mention from the browser ever
+      // resolved: a direct message went to nobody, a mention notified no one.
+      resolveMention: (h) => resolveHandle(this, h)
     });
     this.atproto = new BrowserAtproto({ store: this.store, actorId: this.urls.actor, log: this.log });
     this.publisher.atproto = this.atproto;
@@ -69864,7 +69888,7 @@ var BrowserAgent = class _BrowserAgent {
     const rec = await generateKeys();
     rec.mintedFor = this.urls.actor;
     await writeWrappedKeys(this.remote, this.urls, await wrapKeys(rec, password));
-    const keys = await cacheOpenedKeys(this.urls.actor, rec);
+    const keys = await cacheOpenedKeys(podActorOf(this.urls), rec);
     this.publisher.publicKeyPem = keys.rsaPublicPem;
     this.deliverer.rsaPrivate = keys.rsaPrivate;
     await this.publisher.publishProfile();