fedipod-server 0.14.1 → 0.16.0

package/web/app/dist/sw.js

@@ -141,6 +141,13 @@ function apUrls(remotePod, root, { publicBase = null } = {}) {
   }
   return urls;
 }
+function podBaseOfWebId(webId) {
+  const u = new URL(webId);
+  u.hash = "";
+  u.search = "";
+  const dir = u.pathname.replace(/profile\/card$/u, "").replace(/[^/]*$/u, "");
+  return `${u.origin}${dir.endsWith("/") ? dir : dir + "/"}`;
+}
 function webfingerHost(podUrl) {
   const u = new URL(podUrl);
   return u.pathname === "/" ? u.host : null;
@@ -9651,9 +9658,10 @@ function hostMeta(base) {
 </XRD>
 `;
 }
-function jrd({ handle: handle7, host, actor }) {
+function jrd({ handle: handle7, host, actor, aliases = [] }) {
   return {
     subject: `acct:${handle7}@${host}`,
+    ...aliases.length ? { aliases } : {},
     links: [{ rel: "self", type: "application/activity+json", href: actor }]
   };
 }
@@ -56499,7 +56507,7 @@ var Publisher = class {
     }
     const pubName = publicHandle(this.config);
     const pubHost = this.config.gateway?.frontActor ? new URL(this.config.gateway.frontActor).host : host;
-    this.log(this.config.gateway?.frontActor || webfingerHost(urls.base) ? `profile published: @${pubName}@${pubHost} \u2192 ${urls.actor}` : `profile published \u2192 ${urls.actor} \u2014 NOT discoverable as @${pubName}@${pubHost}: this pod is a path on a shared host, and WebFinger is only answered at a host root`);
+    this.log(this.config.gateway?.frontActor || webfingerHost(urls.base) ? `profile published: @${pubName}@${pubHost} \u2192 ${urls.actor}` : `profile published \u2192 ${urls.actor} \u2014 NOT discoverable as @${pubName}@${pubHost}: this pod is a suffix-based host, and WebFinger is only answered at a host root`);
     return { unreachable, updated };
   }
   // Fires when the document differs from the one last published — including
@@ -66231,8 +66239,11 @@ var MastoApi = class _MastoApi {
     });
     return this._push;
   }
+  // The host in the owner's own address: the gateway's when the identity is
+  // fronted (its documents still live on the pod, but its name does not).
   get host() {
-    return this.urls ? new URL(this.urls.base).host : "unconfigured.invalid";
+    if (!this.urls) return "unconfigured.invalid";
+    return new URL(this.urls.publicHome || this.urls.base).host;
   }
   // Where the live feed is, as the CLIENT must address it: this agent's own
   // origin, taken from the request, not the pod's host. An instance document
@@ -66846,9 +66857,10 @@ var PodTransport = class {
     return serialize(doc, g, url, "text/turtle");
   }
   async setAcl(targetUrl, publicModes, opts = {}) {
-    const url = await this.aclUrlFor(targetUrl);
+    const podTarget = this.toPod ? this.toPod(targetUrl) : targetUrl;
+    const url = await this.aclUrlFor(podTarget);
     if (!await this.aclWritable(url)) return null;
-    return this.put(url, this.aclDoc(targetUrl, publicModes, { ...opts, aclUrl: url }), "text/turtle");
+    return this.put(url, this.aclDoc(podTarget, publicModes, { ...opts, aclUrl: url }), "text/turtle");
   }
   // Child documents of an LDP container (URLs under it, excluding aux docs).
   // Revalidated: the inbox is polled every couple of minutes and is usually
@@ -67166,14 +67178,16 @@ async function cacheOpenedKeys(actorUrl, keysRecord) {
   return keys;
 }
 var keyCacheKey = (actorUrl) => `signing-keys:${actorUrl}`;
+var podActorOf = (urls) => urls.toPod ? urls.toPod(urls.actor) : urls.actor;
 async function loadKeysFromPod(remote, urls) {
-  const cached = await kvGet(keyCacheKey(urls.actor)).catch(() => null);
+  const podActor = podActorOf(urls);
+  const cached = await kvGet(keyCacheKey(podActor)).catch(() => null);
   if (isOpenedKey(cached)) return fromCache(cached);
-  if (cached?.rsa?.privatePem) return cacheOpenedKeys(urls.actor, cached);
+  if (cached?.rsa?.privatePem) return cacheOpenedKeys(podActor, cached);
   const doc = await readWrappedKeys(remote, urls);
   if (isKeyEnvelope(doc)) throw new KeyPasswordNeeded();
   if (!doc || !doc.rsa) throw new Error("no signing key on the pod \u2014 sign up did not finish");
-  return cacheOpenedKeys(urls.actor, doc);
+  return cacheOpenedKeys(podActor, doc);
 }
 
 // lib/core/deliver.mjs
@@ -68259,7 +68273,7 @@ var AdminFacade = class {
         const aliases = [...cfg.aliases || []];
         if (body.add) {
           if (!webfingerHost(urls.base) && !cfg.gateway?.frontActor) {
-            return json2(400, { error: "this pod is a path on a shared host, so other servers could never resolve it as a Move target" });
+            return json2(400, { error: "this pod is a suffix-based host, so other servers could never resolve it as a Move target" });
           }
           const id = await this.resolveActor(body.add);
           if (!id) return json2(400, { error: `could not fetch the old account (${body.add}) \u2014 enter its URL or @user@host, and it must answer` });
@@ -69602,6 +69616,7 @@ var AcctFeed = class {
 };
 
 // web/app/agent.mjs
+init_urls();
 var originAuthorities = (host) => ({
   set: /* @__PURE__ */ new Set([String(host || "").toLowerCase()]),
   has(authority) {
@@ -69726,7 +69741,7 @@ var BrowserAgent = class _BrowserAgent {
     if (oidc) {
       session = { fetch: (u, i) => oidc.fetch(u, i) };
       webId = oidc.webId;
-      remotePod = new URL(webId).origin + "/";
+      remotePod = podBaseOfWebId(webId);
     } else {
       const dpop = await makeDpopSession(credential);
       session = { fetch: (u, i) => dpop.fetch(u, i) };
@@ -69744,8 +69759,11 @@ var BrowserAgent = class _BrowserAgent {
     const cfg = config || this.store.getConfig();
     if (!cfg) throw new Error("no account config on this pod \u2014 sign up first");
     this.store.setConfig({ ...this.store.getConfig() || {}, ...cfg, root });
-    const keys = keysRecord ? await importSigningKey(keysRecord) : await loadKeysFromPod(this.remote, this.urls);
     config = this.store.getConfig();
+    const publicBase = config.gateway?.frontActor ? config.gateway.frontActor.replace(/ap\/actor\/?$/, "") : null;
+    this.urls = apUrls2(remotePod, root, { publicBase });
+    if (this.urls.toPod) this.remote.setUrlMap(this.urls.toPod);
+    const keys = keysRecord ? await importSigningKey(keysRecord) : await loadKeysFromPod(this.remote, this.urls);
     this.deliverer = new RelayDeliverer({
       passive: true,
       store: this.store,
@@ -69767,7 +69785,7 @@ var BrowserAgent = class _BrowserAgent {
       publicKeyPem: keys.rsaPublicPem,
       assertionKey: null,
       log: this.log,
-      // Who a post names, resolved — the same lookup the installed agent
+      // Who a post names, resolved — the same lookup the DeviceAgent
       // gives its publisher. Without it no mention from the browser ever
       // resolved: a direct message went to nobody, a mention notified no one.
       resolveMention: (h) => resolveHandle(this, h)
@@ -69870,7 +69888,7 @@ var BrowserAgent = class _BrowserAgent {
     const rec = await generateKeys();
     rec.mintedFor = this.urls.actor;
     await writeWrappedKeys(this.remote, this.urls, await wrapKeys(rec, password));
-    const keys = await cacheOpenedKeys(this.urls.actor, rec);
+    const keys = await cacheOpenedKeys(podActorOf(this.urls), rec);
     this.publisher.publicKeyPem = keys.rsaPublicPem;
     this.deliverer.rsaPrivate = keys.rsaPrivate;
     await this.publisher.publishProfile();