fedipod-server 0.14.1 → 0.16.0

package/web/app/index.html

@@ -13,6 +13,7 @@
   --heading: #123f74; --sub: #565656; --line: #b0b0b0; --accent: #12467e;
   --btn: #3a5f43; --btn-hover: #30503a; --btn-text: #ffffff;
   --field-bg: #ececec; --field-text: #141414; --field-border: #6f6f6f;
+  --select-bg: #dce7f3; --select-border: #12467e;
   --err: #b00020; --warn: #8a4b00; --focus: #12467e;
 }
 @media (prefers-color-scheme: dark) {
@@ -20,6 +21,7 @@
     --bg: #191919; --fg: #f3f3f3;
     --heading: #8fc2f2; --sub: #d2d2d2; --line: #6d6d6d; --accent: #8fc2f2;
     --field-bg: #474747; --field-text: #f5f5f5; --field-border: #9aa0a6;
+    --select-bg: #2f4a66; --select-border: #8fc2f2;
     --btn: #4a7a54; --btn-hover: #3f6a49;
     --err: #ff9b9b; --warn: #ffb366; --focus: #8fc2f2;
   }
@@ -42,6 +44,10 @@ input[type=text], input[type=email], input[type=url], input[type=password], sele
   font: inherit; font-size: 1rem; width: 100%; padding: .55rem; box-sizing: border-box;
   border: 1px solid var(--field-border); border-radius: .3rem;
   background: var(--field-bg); color: var(--field-text); }
+/* A list to pick from looks different from a box to type in: its own tint,
+   the accent border, and the same on its options. */
+select { background: var(--select-bg); border-color: var(--select-border); }
+select option { background: var(--select-bg); color: var(--field-text); }
 ::placeholder { color: var(--sub); opacity: 1; }
 .choice { display: block; margin: .4rem 0; font-weight: normal; }
 .choice input { margin-right: .5rem; width: auto; }
@@ -88,7 +94,7 @@ a { color: var(--accent); }
 <section id="landing" hidden>
   <h2>Already have a FediPod account?</h2>
   <p class="row">
-    <input type="text" id="signin-address" autocapitalize="off" spellcheck="false" placeholder="@me@mypod"
+    <input type="text" id="signin-address" autocomplete="username" autocapitalize="off" spellcheck="false" placeholder="@me@mypod"
       aria-label="Your FediPod address, in the form @you@yourpod">
     <button type="button" class="primary" id="signin">sign in</button>
   </p>
@@ -136,18 +142,42 @@ a { color: var(--accent); }
         </div>
 
         <label for="provider">Pod provider</label>
-        <input type="url" id="provider" name="provider" autocomplete="url" placeholder="https://solidcommunity.net">
+        <!-- The providers listed at https://solidproject.org/get_a_pod that run Community
+             Solid Server, whose account API is what "A new pod" uses. Checked 2026-09-14. -->
+        <select id="provider" name="provider">
+          <option value="https://solidcommunity.net">solidcommunity.net</option>
+          <option value="https://privatedatapod.com">privatedatapod.com</option>
+          <option value="https://solid.redpencil.io">redpencil.io</option>
+          <option value="https://pods.solidcommunity.au">solidcommunity.au</option>
+          <option value="https://solidweb.me">solidweb.me</option>
+          <option value="https://teamid.live">teamid.live</option>
+          <option value="">Other…</option>
+        </select>
+        <div id="provider-other-field" hidden>
+          <label for="providerOther">Provider address</label>
+          <input type="url" id="providerOther" name="providerOther" autocomplete="url" placeholder="https://pods.example.org">
+        </div>
+
+        <div id="podname-field">
+          <label for="podName">Pod username</label>
+          <input type="text" id="podName" name="podName" autocomplete="off" aria-describedby="podname-hint">
+          <p class="hint" id="podname-hint">Depending on your provider's setup, your pod will be at
+            either https://USERNAME.podprovider or https://podprovider/USERNAME.</p>
+        </div>
 
-        <label for="podName">Pod username/subdomain</label>
-        <input type="text" id="podName" name="podName" autocomplete="off" aria-describedby="podname-hint">
-        <p class="hint" id="podname-hint">The subdomain of your pod. On solidcommunity.net, alice
-          becomes the pod https://alice.solidcommunity.net.</p>
+        <div id="pod-field" hidden>
+          <label for="pod">Pod address</label>
+          <input type="url" id="pod" name="pod" autocomplete="url" aria-describedby="pod-hint"
+            placeholder="https://alice.solidcommunity.net/ or https://server.example/alice/">
+          <p class="hint" id="pod-hint">The address of your pod: its own host, or a path on a
+            suffix-based host.</p>
+        </div>
 
-        <label for="email">Pod email</label>
+        <label for="email">Email (used as pod id)</label>
         <input type="email" id="email" name="email" autocomplete="email" placeholder="you@example.org">
 
         <label for="password">Pod password</label>
-        <input type="password" id="password" name="password" autocomplete="current-password"
+        <input type="password" id="password" name="password" autocomplete="new-password"
           aria-describedby="password-hint">
         <p class="hint" id="password-hint">Your password is sent once, to make your account and to
           lock your signing key. It is never stored. The credential used to set things up is
@@ -172,6 +202,14 @@ a { color: var(--accent); }
         <p class="hint" id="handle-hint">The name in your Fediverse address. This is permanent.
           Letters, digits, and hyphens only.</p>
 
+        <div role="radiogroup" aria-labelledby="shape-label" id="shape-group">
+          <span id="shape-label" class="grouplabel">Where your address lives</span>
+          <label class="choice"><input type="radio" name="shape" value="pod" checked> On your pod</label>
+          <label class="choice"><input type="radio" name="shape" value="front"> At this site</label>
+        </div>
+        <p class="hint" id="shape-hint" hidden>Your pod provider uses suffixes, so your only option
+          is to use an account on a gateway like this one.</p>
+
         <span id="addr-label" class="grouplabel">Your Fediverse address</span>
         <p class="address" id="preview" role="status" aria-live="polite" aria-labelledby="addr-label">@…@…</p>
       </fieldset>

package/web/app/keys-browser.mjs

@@ -44,6 +44,10 @@ export async function cacheOpenedKeys(actorUrl, keysRecord) {
 // already relies on. It is what lets the worker boot itself after an idle kill
 // without a soul around to type anything.
 export const keyCacheKey = (actorUrl) => `signing-keys:${actorUrl}`;
+// The cache is keyed by the POD actor, whatever the identity advertises: a
+// fronted identity's advertised actor is the gateway's, and keying by that
+// would hide the opened copy sign-up stored and ask for the password again.
+export const podActorOf = (urls) => (urls.toPod ? urls.toPod(urls.actor) : urls.actor);
 
 // Read the signing key for this actor and import it for signing.
 //
@@ -54,16 +58,17 @@ export const keyCacheKey = (actorUrl) => `signing-keys:${actorUrl}`;
 // there is from before wrapping and is used as it stands, while an envelope
 // needs the password and so has to go back to the page.
 export async function loadKeysFromPod(remote, urls) {
-  const cached = await kvGet(keyCacheKey(urls.actor)).catch(() => null);
+  const podActor = podActorOf(urls);
+  const cached = await kvGet(keyCacheKey(podActor)).catch(() => null);
   if (isOpenedKey(cached)) return fromCache(cached);
   // A copy stored as PEM by an earlier build: import it and store the key form
   // in its place, so the PEM is gone from storage after one boot.
-  if (cached?.rsa?.privatePem) return cacheOpenedKeys(urls.actor, cached);
+  if (cached?.rsa?.privatePem) return cacheOpenedKeys(podActor, cached);
 
   const doc = await podState.readWrappedKeys(remote, urls);
   if (isKeyEnvelope(doc)) throw new KeyPasswordNeeded();
   if (!doc || !doc.rsa) throw new Error('no signing key on the pod — sign up did not finish');
   // A pre-wrapping install. Cache it so the next boot is one read, and leave
   // the pod's copy alone: re-wrapping it would need the password we do not have.
-  return cacheOpenedKeys(urls.actor, doc);
+  return cacheOpenedKeys(podActor, doc);
 }

package/web/app/signup.mjs

@@ -48,9 +48,24 @@ const progressKey = (a) => [a.issuer, a.mode, a.handle, a.mode === 'new' ? (a.po
  * draw the same tick list the CLI setup shows. Resumable: see PROGRESS above.
  *
  * answers: { mode:'new'|'existing', issuer, email, password, handle,
- *            podName?, pod?, gateway? }
+ *            podName?, pod?, gateway?, shape?: 'pod'|'front' }
+ *
+ * `shape` is where the address lives. On the pod, `@handle@yourpod`, with the
+ * gateway as a mail door only — the default. At the gateway, `@handle@front`,
+ * a fronted identity whose documents still live on the pod. A pod on a path of
+ * a suffix-based host cannot answer WebFinger, so it is fronted whatever was asked.
+ *
  * returns: { credential, config, actorUrl, address, keysPublic }
  */
+/** A fronted name is one per gateway; a taken one is refused before anything is made. */
+async function assertFrontNameFree(frontOrigin, handle) {
+  const res = await fetch(`${frontOrigin.replace(/\/$/, '')}/api/handle?handle=${encodeURIComponent(handle)}`,
+    { headers: { accept: 'application/json' } }).catch(() => null);
+  const d = res ? await res.json().catch(() => ({})) : null;
+  if (!d) throw new Error(`${new URL(frontOrigin).host} did not answer whether @${handle} is free`);
+  if (!d.available) throw new Error(d.reason || `the name @${handle}@${new URL(frontOrigin).host} is taken — choose another handle`);
+}
+
 export async function signUp(answers, { onStep = () => {}, frontOrigin = null } = {}) {
   const { mode, issuer, email, password, handle } = answers;
   const bad = handleProblem(handle);
@@ -58,6 +73,10 @@ export async function signUp(answers, { onStep = () => {}, frontOrigin = null }
   if (!email) throw new Error('an email is required');           // recovery + account login
   if (!password) throw new Error('a password is required');
   if (mode === 'existing' && !answers.pod) throw new Error('a pod address is required');
+  const wantsFront = answers.shape === 'front';
+  if (wantsFront && !frontOrigin) throw new Error('an address at the gateway needs a gateway, and this page has none');
+  // A name at the gateway is one per gateway: settle it before making anything.
+  if (wantsFront) await assertFrontNameFree(frontOrigin, handle);
 
   const key = progressKey(answers);
   const prog = PROGRESS.get(key) || {};
@@ -91,17 +110,18 @@ export async function signUp(answers, { onStep = () => {}, frontOrigin = null }
   }
   const pod = prog.pod; const webId = prog.webId || null;
 
-  // WebFinger is answered at a host root, so the address only works if the pod
-  // is the root of its own host. Refuse a path pod rather than making an
-  // account nobody can find.
-  const podUrl = new URL(pod);
-  if (podUrl.pathname !== '/') {
-    throw new Error(`${pod} is a path on ${podUrl.host}, not its own host. `
-      + 'A Fediverse address lives at a host root, so this pod cannot carry one. '
-      + 'Use a pod that is the root of its own subdomain.');
+  // WebFinger is answered only at a host root. A pod on a path of a shared
+  // host therefore takes its address at the gateway, whatever was asked; a
+  // pod at its own root keeps the choice made on the form.
+  const pathPod = new URL(pod).pathname !== '/';
+  const fronted = pathPod || wantsFront;
+  if (fronted && !frontOrigin) {
+    throw new Error(`${pod} is a suffix-based host, so its address must live at a gateway, and this page has none.`);
   }
+  if (pathPod && !wantsFront) await assertFrontNameFree(frontOrigin, handle);
 
-  const actorUrl = actorUrlFor(pod);
+  const actorUrl = actorUrlFor(pod);                              // where the documents live, always
+  const frontActor = fronted ? `${frontOrigin.replace(/\/$/, '')}/u/${handle}/ap/actor` : null;
 
   // --- credential --- (a fresh attempt re-mints; a resumed one reuses it)
   const cred = step('credential');
@@ -143,12 +163,48 @@ export async function signUp(answers, { onStep = () => {}, frontOrigin = null }
   // The opened copy is kept in this browser (IndexedDB) so the worker can boot
   // itself after an idle kill with nobody there to type a password. A browser
   // that has no copy asks for the password once — see boot.mjs.
+  // Connect the gateway (fedipod.net) before the key is made, because a
+  // fronted identity's key is stamped with the gateway actor. Inbox-only: the
+  // actor advertises the door as its inbox and keeps its own ids. Fronted: the
+  // gateway answers WebFinger for @handle@front and serves the actor at its own
+  // address, rewriting reads onto the pod. Either way the door verifies each
+  // delivery and forwards the clean mail to the pod; the agent trusts the
+  // door's receipt. The same DPoP session proves the pod to the gateway — no
+  // password reaches it.
+  let gateway = answers.gateway || prog.gateway || null;
+  if (frontOrigin && !gateway) {
+    const gw = step('gateway');
+    gw.running(fronted ? `taking your address at ${new URL(frontOrigin).host}` : `connecting your mail door on ${new URL(frontOrigin).host}`);
+    const res = await session.fetch(`${frontOrigin.replace(/\/$/, '')}/api/attach`, {
+      method: 'POST', headers: { 'content-type': 'application/json' },
+      // podHome is the AP CONTAINER, not the pod root: the front builds the
+      // delivery target as `podHome + 'ap/inbox/'` (lib/front-core.mjs), so a
+      // bare pod root sends this identity's mail to <pod>/ap/inbox/ — outside
+      // the container the agent drains, where nothing would ever read it. The
+      // manage surface has always sent `urls.home`; this is the same value.
+      body: JSON.stringify({ handle, podHome: `${pod}${AP_ROOT}`, actorUrl, kind: 'person', fronted }),
+    });
+    const d = await res.json().catch(() => ({}));
+    if (res.status !== 201 || !d.hmacSecret) {
+      throw new Error(`could not connect the gateway (HTTP ${res.status}): ${d.error || ''}`);
+    }
+    gateway = fronted
+      ? { url: `${frontOrigin.replace(/\/$/, '')}/u/${handle}/ap/inbox/`, frontActor: String(d.frontActor || frontActor), hmacSecret: d.hmacSecret, mode: 'trust' }
+      : { url: d.doorInbox, hmacSecret: d.hmacSecret, mode: 'trust' };
+    prog.gateway = gateway;
+    gw.ok();
+  } else if (frontOrigin && gateway) {
+    step('gateway').ok();                                        // resumed
+  }
+
   const keysStep = step('keys');
   let keys;
   if (!prog.keysStored) {
     keysStep.running('making your signing key and locking it under your password');
     keys = await generateKeys();
-    keys.mintedFor = actorUrl;                                   // one key, one actor (lib/keys.mjs)
+    // One key, one actor (lib/keys.mjs): the actor the world knows, which for
+    // a fronted identity is the gateway's address for it.
+    keys.mintedFor = gateway?.frontActor || actorUrl;
     const remote = new BrowserRemotePod(session, { webId: credential.webId, role: 'signup', log: () => {} });
     // Owner-only, and THEN the key — one operation, so the order cannot be got
     // wrong here or anywhere else. A pod that refuses the ACL write is not a
@@ -174,34 +230,6 @@ export async function signUp(answers, { onStep = () => {}, frontOrigin = null }
     keysStep.ok();
   }
 
-  // Connect the mail door: attach to the gateway (fedipod.net), inbox-only, so
-  // the actor advertises the door as its inbox. The door verifies each delivery
-  // and forwards the clean mail to the pod; the agent trusts the door's receipt.
-  // The same DPoP session proves the pod to the gateway — no password reaches it.
-  let gateway = answers.gateway || prog.gateway || null;
-  if (frontOrigin && !gateway) {
-    const gw = step('gateway');
-    gw.running(`connecting your mail door on ${new URL(frontOrigin).host}`);
-    const res = await session.fetch(`${frontOrigin.replace(/\/$/, '')}/api/attach`, {
-      method: 'POST', headers: { 'content-type': 'application/json' },
-      // podHome is the AP CONTAINER, not the pod root: the front builds the
-      // delivery target as `podHome + 'ap/inbox/'` (lib/front-core.mjs), so a
-      // bare pod root sends this identity's mail to <pod>/ap/inbox/ — outside
-      // the container the agent drains, where nothing would ever read it. The
-      // manage surface has always sent `urls.home`; this is the same value.
-      body: JSON.stringify({ handle, podHome: `${pod}${AP_ROOT}`, actorUrl, kind: 'person' }),
-    });
-    const d = await res.json().catch(() => ({}));
-    if (res.status !== 201 || !d.hmacSecret) {
-      throw new Error(`could not connect the mail door (HTTP ${res.status}): ${d.error || ''}`);
-    }
-    gateway = { url: d.doorInbox, hmacSecret: d.hmacSecret, mode: 'trust' };
-    prog.gateway = gateway;
-    gw.ok();
-  } else if (frontOrigin && gateway) {
-    step('gateway').ok();                                        // resumed
-  }
-
   const config = {
     remotePod: pod, root: AP_ROOT, handle, name: handle, issuer: credential.issuerOrigin,
     ...(gateway ? { gateway } : {}),
@@ -233,7 +261,7 @@ export async function signUp(answers, { onStep = () => {}, frontOrigin = null }
 
   PROGRESS.delete(key);                                          // finished — nothing left to resume
 
-  const host = new URL(pod).host;
+  const host = gateway?.frontActor ? new URL(gateway.frontActor).host : new URL(pod).host;
   return {
     credential, config, actorUrl,
     address: `@${handle}@${host}`,

package/web/app/site/admin/setup/index.html

@@ -132,9 +132,20 @@ button:disabled { opacity: .5; cursor: default; }
         <label for="issuer-new">Solid pod provider</label>
         <select id="issuer-new" name="issuerNew" aria-describedby="issuer-new-hint">
           <option value="https://solidcommunity.net">solidcommunity.net</option>
+          <option value="https://privatedatapod.com">privatedatapod.com</option>
+          <option value="https://solid.redpencil.io">redpencil.io</option>
+          <option value="https://pods.solidcommunity.au">solidcommunity.au</option>
+          <option value="https://solidweb.me">solidweb.me</option>
+          <option value="https://teamid.live">teamid.live</option>
+          <option value="">Other…</option>
         </select>
-        <p class="hint" id="issuer-new-hint">Providers that give each pod its own subdomain, so the
-          Fediverse address works everywhere.</p>
+        <div id="row-issuer-other" hidden>
+          <label for="issuerOther">Provider address</label>
+          <input type="url" id="issuerOther" name="issuerOther" autocomplete="url" placeholder="https://pods.example.org">
+        </div>
+        <p class="hint" id="issuer-new-hint">The Community Solid Server providers from
+          solidproject.org. A provider that puts pods on paths gives your address at a
+          gateway instead.</p>
       </div>
 
       <div id="row-issuer-existing" hidden>
@@ -172,6 +183,18 @@ button:disabled { opacity: .5; cursor: default; }
       Wrong account or pod?
       <button type="button" id="form-reenter" title="   Discard the credential and enter the account and pod again">Re-enter credentials</button></p>
 
+    <fieldset id="fs-shape" hidden>
+      <legend>Where your address lives</legend>
+      <label class="choice"><input type="radio" name="shape" value="pod" checked> On your pod</label>
+      <label class="choice"><input type="radio" name="shape" value="front"> At a gateway</label>
+      <div id="row-gateway" hidden>
+        <label for="gatewayOrigin">Gateway</label>
+        <input type="url" id="gatewayOrigin" name="gatewayOrigin" value="https://fedipod.net" autocomplete="url">
+        <p class="hint">The gateway answers your address and forwards your mail to your pod.</p>
+      </div>
+      <p class="hint" id="shape-note" hidden></p>
+    </fieldset>
+
     <h2>You will be</h2>
     <p class="address" id="preview">…</p>
     <div id="preview-notes"></div>

package/web/app/site/admin/setup/setup.js

@@ -93,12 +93,18 @@ function answers() {
   const f = $('form').elements;
   const kind = f.kind.value;
   const mode = state.resumable ? 'existing' : f.mode.value;
+  const issuer = mode === 'new'
+    ? (f.issuerNew.value || (f.issuerOther ? f.issuerOther.value : '')).trim()
+    : f.issuer.value.trim();
   const a = {
     kind,
     mode,
     handle: f.handle.value.trim(),
-    issuer: (mode === 'new' ? f.issuerNew.value : f.issuer.value).trim(),
+    issuer,
     email: f.email.value.trim(),
+    // Where the address lives; a group cannot front (yet), so it stays 'pod'.
+    shape: (kind === 'group') ? 'pod' : (f.shape ? f.shape.value : 'pod'),
+    gatewayOrigin: (f.gatewayOrigin ? f.gatewayOrigin.value.trim() : '') || 'https://fedipod.net',
   };
   if (mode === 'new') a.podName = f.podName.value.trim() || a.handle;
   else a.pod = f.pod.value.trim();
@@ -128,6 +134,9 @@ function onEdit() {
   $('row-pod').hidden = mode === 'new';
   $('row-issuer-new').hidden = mode !== 'new';
   $('row-issuer-existing').hidden = mode === 'new';
+  const f = $('form').elements;
+  if ($('row-issuer-other')) $('row-issuer-other').hidden = !(mode === 'new' && f.issuerNew.value === '');
+  if ($('row-gateway')) $('row-gateway').hidden = !(f.shape && f.shape.value === 'front');
   clearTimeout(editTimer);
   editTimer = setTimeout(preview, 150);
 }
@@ -140,6 +149,26 @@ async function preview() {
   const { json } = await postJson('/setup/check', a);
   if (!json) return;
   $('preview').textContent = json.address || '…';
+  // The address-shape choice: hidden for a group (a group cannot front yet),
+  // locked to the gateway for a pod on a suffix-based host, an open choice
+  // for a pod at its own host.
+  const f = $('form').elements;
+  const shapeFs = $('fs-shape');
+  if (shapeFs) {
+    const isGroup = a.kind === 'group';
+    shapeFs.hidden = isGroup || (a.mode === 'existing' && !a.pod);
+    const forced = !!json.forced;
+    for (const r of f.shape) r.disabled = forced;
+    if (forced) { for (const r of f.shape) r.checked = r.value === 'front'; }
+    if ($('row-gateway')) $('row-gateway').hidden = !(f.shape.value === 'front');
+    const note = $('shape-note');
+    if (note) {
+      note.hidden = !forced;
+      note.textContent = forced
+        ? 'Your pod is on a suffix-based host, so its address lives at the gateway. Your posts, key and data stay on your pod.'
+        : '';
+    }
+  }
   const notes = $('preview-notes');
   for (const w of json.warnings || []) {
     const p = document.createElement('p');