fedipod-server 0.15.0 → 0.17.0

package/web/admin/setup/setup.js

@@ -93,12 +93,18 @@ function answers() {
   const f = $('form').elements;
   const kind = f.kind.value;
   const mode = state.resumable ? 'existing' : f.mode.value;
+  const issuer = mode === 'new'
+    ? (f.issuerNew.value || (f.issuerOther ? f.issuerOther.value : '')).trim()
+    : f.issuer.value.trim();
   const a = {
     kind,
     mode,
     handle: f.handle.value.trim(),
-    issuer: (mode === 'new' ? f.issuerNew.value : f.issuer.value).trim(),
+    issuer,
     email: f.email.value.trim(),
+    // Where the address lives; a group cannot front (yet), so it stays 'pod'.
+    shape: (kind === 'group') ? 'pod' : (f.shape ? f.shape.value : 'pod'),
+    gatewayOrigin: (f.gatewayOrigin ? f.gatewayOrigin.value.trim() : '') || 'https://fedipod.net',
   };
   if (mode === 'new') a.podName = f.podName.value.trim() || a.handle;
   else a.pod = f.pod.value.trim();
@@ -128,6 +134,9 @@ function onEdit() {
   $('row-pod').hidden = mode === 'new';
   $('row-issuer-new').hidden = mode !== 'new';
   $('row-issuer-existing').hidden = mode === 'new';
+  const f = $('form').elements;
+  if ($('row-issuer-other')) $('row-issuer-other').hidden = !(mode === 'new' && f.issuerNew.value === '');
+  if ($('row-gateway')) $('row-gateway').hidden = !(f.shape && f.shape.value === 'front');
   clearTimeout(editTimer);
   editTimer = setTimeout(preview, 150);
 }
@@ -140,6 +149,26 @@ async function preview() {
   const { json } = await postJson('/setup/check', a);
   if (!json) return;
   $('preview').textContent = json.address || '…';
+  // The address-shape choice: hidden for a group (a group cannot front yet),
+  // locked to the gateway for a pod on a suffix-based host, an open choice
+  // for a pod at its own host.
+  const f = $('form').elements;
+  const shapeFs = $('fs-shape');
+  if (shapeFs) {
+    const isGroup = a.kind === 'group';
+    shapeFs.hidden = isGroup || (a.mode === 'existing' && !a.pod);
+    const forced = !!json.forced;
+    for (const r of f.shape) r.disabled = forced;
+    if (forced) { for (const r of f.shape) r.checked = r.value === 'front'; }
+    if ($('row-gateway')) $('row-gateway').hidden = !(f.shape.value === 'front');
+    const note = $('shape-note');
+    if (note) {
+      note.hidden = !forced;
+      note.textContent = forced
+        ? 'Your pod is on a suffix-based host, so its address lives at the gateway. Your posts, key and data stay on your pod.'
+        : '';
+    }
+  }
   const notes = $('preview-notes');
   for (const w of json.warnings || []) {
     const p = document.createElement('p');

package/web/app/README.md

@@ -72,6 +72,6 @@ See the `MastoApi` options in `agent.mjs`.
 | **Streaming** | a service worker answers fetches, not sockets. No streaming URL is advertised, so clients poll. |
 | **Web push** | `shims/web-push.mjs` is a no-op. `vapid` is omitted, and a client that subscribes anyway gets a 422 rather than a subscription nothing will push to. |
 | **Scheduled posts** | nothing runs between now and the scheduled time. A `scheduled_at` is refused with a 422 that says so — accepting one was silent loss. |
-| **Groups** | sign-up makes personal identities only (`signup.mjs`), and the moderation surface is not here. Joining a group works; hosting one needs the installed agent. See `groups.md`. |
-| **Changing where the address lives** | the shape is chosen at sign-up (`signup.mjs`): on the pod, `@you@yourpod` with the gateway as a mail door, or at the gateway, `@you@front` — and a pod on a path of a shared host is always fronted. `admin-facade.mjs` refuses changing it afterwards, because a rename needs a restart a browser does not have. |
+| **Groups** | sign-up makes personal identities only (`signup.mjs`), and the moderation surface is not here. Joining a group works; hosting one needs the DeviceAgent. See `groups.md`. |
+| **Changing where the address lives** | the shape is chosen at sign-up (`signup.mjs`): on the pod, `@you@yourpod` with the gateway as a mail door, or at the gateway, `@you@front` — and a pod on a suffix-based host is always fronted. `admin-facade.mjs` refuses changing it afterwards, because a rename needs a restart a browser does not have. |
 | **Moving the private half** | `/state-move` is about filesystem paths and `credential.json`. A browser has neither; its private half is always on the pod. |

package/web/app/admin-facade.mjs

@@ -317,7 +317,7 @@ export class AdminFacade {
         const aliases = [...(cfg.aliases || [])];
         if (body.add) {
           if (!webfingerHost(urls.base) && !cfg.gateway?.frontActor) {
-            return json(400, { error: 'this pod is a path on a shared host, so other servers could never resolve it as a Move target' });
+            return json(400, { error: 'this pod is a suffix-based host, so other servers could never resolve it as a Move target' });
           }
           const id = await this.resolveActor(body.add);
           if (!id) return json(400, { error: `could not fetch the old account (${body.add}) — enter its URL or @user@host, and it must answer` });

package/web/app/agent.mjs

@@ -160,7 +160,7 @@ export class BrowserAgent {
     if (oidc) {
       session = { fetch: (u, i) => oidc.fetch(u, i) };
       webId = oidc.webId;
-      remotePod = podBaseOfWebId(webId);              // the pod, which on a shared host is a path
+      remotePod = podBaseOfWebId(webId);              // the pod, which on a suffix-based host is a path
     } else {
       const dpop = await makeDpopSession(credential);
       session = { fetch: (u, i) => dpop.fetch(u, i) };
@@ -189,7 +189,7 @@ export class BrowserAgent {
     // builds its own urls from `config.root` (publisher.mjs), and a config
     // without one falls to the Node default — so an account set up elsewhere
     // and signed into here would keep its state under `fedipod/` while every
-    // document it published landed under `activitypods-js/`. One root, decided
+    // document it published landed under a different root. One root, decided
     // once, carried by the config everything downstream reads.
     this.store.setConfig({ ...(this.store.getConfig() || {}), ...cfg, root });
     config = this.store.getConfig();
@@ -224,7 +224,7 @@ export class BrowserAgent {
     this.publisher = new Publisher({
       config: this.store.getConfig(), remote: this.remote, store: this.store,
       deliverer: this.deliverer, publicKeyPem: keys.rsaPublicPem, assertionKey: null, log: this.log,
-      // Who a post names, resolved — the same lookup the installed agent
+      // Who a post names, resolved — the same lookup the DeviceAgent
       // gives its publisher. Without it no mention from the browser ever
       // resolved: a direct message went to nobody, a mention notified no one.
       resolveMention: (h) => resolveHandle(this, h),

package/web/app/boot.mjs

@@ -70,7 +70,7 @@ window.fedipodUnlock = async (password) => {
   if (!session) throw new Error('Sign in first.');
   // The config on the pod says where this account's state lives; the key sits
   // beside it. Both are read with the session, as the owner.
-  const podFromWebId = podBaseOfWebId(session.webId);   // a path on a shared host, or its own host
+  const podFromWebId = podBaseOfWebId(session.webId);   // a suffix-based host, or its own host
   const state = `${podFromWebId}${AP_ROOT}ap-state/`;
   // Through the transport rather than the bare session: this is a pod read
   // like any other, and going round it skipped the retry ladder that exists
@@ -288,7 +288,7 @@ if (typeof document !== 'undefined') (async () => {
   // brought by its address, which may be its own host or a path on a shared one.
   const podHostOf = () => { const sub = f().podName.value.trim().toLowerCase(); const ph = providerHost(); return (sub && ph) ? `${sub}.${ph}` : ''; };
   const podUrl = () => { let v = f().pod.value.trim(); if (!v) return ''; if (!/^https?:\/\//i.test(v)) v = 'https://' + v; if (!v.endsWith('/')) v += '/'; try { return new URL(v).href; } catch { return ''; } };
-  // A pod on a path of a shared host cannot answer WebFinger, so its address
+  // A pod on a suffix-based host cannot answer WebFinger, so its address
   // lives at this site; a pod at its own host root gets the choice.
   const isPathPod = (u) => { try { return new URL(u).pathname !== '/'; } catch { return false; } };
   // Where the chosen provider puts new pods, asked of the provider itself

package/web/app/dist/boot.js

@@ -33208,6 +33208,47 @@ async function provisionKey(pod, { stateUrl, keysUrl, envelope }) {
   await pod.putJson(keysUrl, envelope, "application/json");
 }
 
+// lib/pod/root.mjs
+var OWNER_LOOKUP_MS = 5e3;
+var PUBLIC_DOC_MAX_BYTES = 1024 * 1024;
+async function podLayout(fetchImpl, providerOrigin, { timeoutMs = OWNER_LOOKUP_MS } = {}) {
+  let origin;
+  try {
+    origin = new URL(providerOrigin).origin;
+  } catch {
+    return null;
+  }
+  let res;
+  try {
+    res = await fetchImpl(
+      `${origin}/.well-known/solid`,
+      { headers: { accept: "text/turtle" }, signal: AbortSignal.timeout(timeoutMs) }
+    );
+  } catch {
+    return null;
+  }
+  if (res.status === 501) return "host";
+  if (res.status !== 200) return null;
+  let body = "";
+  try {
+    body = await readCapped(res, 64 * 1024);
+  } catch {
+    return null;
+  }
+  return /ns\/pim\/space#Storage|pim:Storage/u.test(body) ? "path" : null;
+}
+async function resourceExists(fetchImpl, url, { timeoutMs = OWNER_LOOKUP_MS } = {}) {
+  try {
+    const res = await fetchImpl(
+      url,
+      { headers: { accept: "application/activity+json" }, signal: AbortSignal.timeout(timeoutMs) }
+    );
+    return !!res && res.status === 200;
+  } catch {
+    return false;
+  }
+}
+
 // web/app/idb-kv.mjs
 var DB = "fedipod-accounts";
 function open() {
@@ -33310,6 +33351,7 @@ async function signUp(answers, { onStep = () => {
       acct.running("checking your pod");
       const head = await fetch(brought, { method: "HEAD" }).catch(() => null);
       if (!head || head.status >= 400) throw new Error(`the pod at ${brought} did not answer (HTTP ${head?.status || "no response"})`);
+      if (await resourceExists(fetch, actorUrlFor(brought))) throw new Error("The pod already hosts a FediPod account. If you want a second account, put it on a different pod.");
       prog.pod = brought;
       acct.skip("using the pod you brought");
     }
@@ -33321,7 +33363,7 @@ async function signUp(answers, { onStep = () => {
   const pathPod = new URL(pod).pathname !== "/";
   const fronted = pathPod || wantsFront;
   if (fronted && !frontOrigin) {
-    throw new Error(`${pod} is a path on a shared host, so its address must live at a gateway, and this page has none.`);
+    throw new Error(`${pod} is a suffix-based host, so its address must live at a gateway, and this page has none.`);
   }
   if (pathPod && !wantsFront) await assertFrontNameFree(frontOrigin, handle);
   const actorUrl = actorUrlFor(pod);
@@ -33450,36 +33492,6 @@ function podBaseOfWebId(webId) {
   return `${u.origin}${dir.endsWith("/") ? dir : dir + "/"}`;
 }
 
-// lib/pod/root.mjs
-var OWNER_LOOKUP_MS = 5e3;
-var PUBLIC_DOC_MAX_BYTES = 1024 * 1024;
-async function podLayout(fetchImpl, providerOrigin, { timeoutMs = OWNER_LOOKUP_MS } = {}) {
-  let origin;
-  try {
-    origin = new URL(providerOrigin).origin;
-  } catch {
-    return null;
-  }
-  let res;
-  try {
-    res = await fetchImpl(
-      `${origin}/.well-known/solid`,
-      { headers: { accept: "text/turtle" }, signal: AbortSignal.timeout(timeoutMs) }
-    );
-  } catch {
-    return null;
-  }
-  if (res.status === 501) return "host";
-  if (res.status !== 200) return null;
-  let body = "";
-  try {
-    body = await readCapped(res, 64 * 1024);
-  } catch {
-    return null;
-  }
-  return /ns\/pim\/space#Storage|pim:Storage/u.test(body) ? "path" : null;
-}
-
 // web/app/oidc-session.mjs
 var DB2 = "fedipod-oidc";
 var STORE = "session";