fedipod-server 0.16.0 → 0.17.0

package/lib/gateway/front-core.mjs

@@ -20,6 +20,7 @@ import { handleDelivery } from './gateway-core.mjs';
 import { readCapped, safeFetch, isLoopbackHost } from '../shared/safefetch.mjs';
 import * as podRoot from '../pod/root.mjs';
 import * as podPolicy from '../pod/policy.mjs';
+import { podBaseOfWebId } from '../pod/urls.mjs';
 
 // The one WebFinger document, spelled out here rather than imported from
 // wire.mjs: wire drags the agent's whole HTML pipeline (sanitize-html and
@@ -513,20 +514,31 @@ async function route(request, ctx) {
     if (!/^https?:\/\/\S+\/$/.test(podBase)) {
       return j(400, { error: 'podBase must be a URL ending in /' });
     }
-    // An identity needs an origin of its own, so only an origin root may opt
-    // in. Anything deeper would also let one path-pod user claim an ancestor
-    // of another's pod.
-    try {
-      if (new URL(podBase).pathname !== '/') {
-        return j(403, { error: 'podBase must be a pod origin root, like https://mei.example.org/' });
-      }
-    } catch { return j(400, { error: 'podBase is not a URL' }); }
+    let podUrl;
+    try { podUrl = new URL(podBase); } catch { return j(400, { error: 'podBase is not a URL' }); }
+    // A pod may be host-root (its own origin) or on a PATH of a shared host — a
+    // suffix pod, which the Server runs at `https://server/aisha/`. What is
+    // refused is the gateway's own origin root itself: that is where the
+    // gateway lives, not a pod, and admitting it would (with the ownership
+    // fallback below) let a co-tenant claim the whole origin.
+    if (ctx.frontOrigin) {
+      try {
+        if (podUrl.origin === new URL(ctx.frontOrigin).origin && podUrl.pathname === '/') {
+          return j(403, { error: 'that is this gateway, not a pod — name the pod that holds your data' });
+        }
+      } catch { /* no usable frontOrigin: the checks below still apply */ }
+    }
+    if (/(^|\/)\.internal(\/|$)/u.test(podUrl.pathname) || /(^|\/)\.\.(\/|$)/u.test(podUrl.pathname)) {
+      return j(403, { error: 'that is not a pod address' });
+    }
     const webid = await verifyPodToken(request, pathname, ctx.verifier);
     if (!webid) return j(401, { error: 'a Solid-OIDC token proving the pod is required' });
-    // The pod's own server names its owner when it can. Where it does, that is
-    // the proof; where it does not, the WebID must at least live under the pod.
+    // The pod's own server names its owner when it can, and where it does that
+    // is the proof. Where it does not, the WebID must live in EXACTLY this pod
+    // — its own pod base equal to podBase, not merely starting with it, which on
+    // a path server an ancestor of another's pod would.
     const owners = await podOwners(podBase, ctx.fetchImpl || fetch);
-    const proven = owners.length ? owners.includes(webid) : webid.startsWith(podBase);
+    const proven = owners.length ? owners.includes(webid) : podBaseOfWebId(webid) === podBase;
     if (!proven) {
       return j(403, { error: 'the token proves a different pod than the one you listed' });
     }

package/lib/pod/root.mjs

@@ -66,6 +66,17 @@ export async function podLayout(fetchImpl, providerOrigin, { timeoutMs = OWNER_L
   return /ns\/pim\/space#Storage|pim:Storage/u.test(body) ? 'path' : null;
 }
 
+// Whether a document is there — one unauthenticated GET, 200 or not. The caller
+// names the URL; asked before a second setup, so a pod that already serves an
+// actor at the app's container refuses another rather than growing a duplicate.
+export async function resourceExists(fetchImpl, url, { timeoutMs = OWNER_LOOKUP_MS } = {}) {
+  try {
+    const res = await fetchImpl(url,
+      { headers: { accept: 'application/activity+json' }, signal: AbortSignal.timeout(timeoutMs) });
+    return !!res && res.status === 200;
+  } catch { return false; }
+}
+
 export async function probeAnswers(podUrl, fetchImpl = fetch) {
   try {
     const res = await fetchImpl(podUrl, { method: 'HEAD' });

package/lib/server/embed.mjs

@@ -47,7 +47,8 @@ const mintSecret = () => crypto.randomBytes(32).toString('base64');
  */
 export async function ensureDoorSecret(session, podBase, { rotate = false, dataDir = null, handle = null, log = () => {} } = {}) {
   const base = podBase.endsWith('/') ? podBase : podBase + '/';
-  const url = apUrls(base, DEFAULT_ROOT).state + 'door-secret.json';
+  // Under the identity's own tree (fedipod/), where the gate reads it back.
+  const url = apUrls(base, 'fedipod/').state + 'door-secret.json';
   const onHost = dataDir && handle ? path.join(dataDir, handle, 'door-secret.json') : null;
 
   if (!rotate) {
@@ -136,7 +137,7 @@ function ensureCredential(home, { podBase, webId }) {
   const rec = {
     webId,
     remotePod: podBase.endsWith('/') ? podBase : podBase + '/',
-    root: 'activitypods-js/',
+    root: 'fedipod/',
     keysMode: 'pod',
   };
   writeJsonAtomic(file, rec, { mode: 0o600 });
@@ -275,7 +276,7 @@ export async function startEmbeddedAgent({
   pollSeconds = null,
   autoAcceptFollows = true,
   gateToken = null,
-  uiPath = '/fedipod/',
+  uiPath = '/fp/',
 }) {
   const base = podBase.endsWith('/') ? podBase : podBase + '/';
   const handle = handleFor(base);
@@ -323,7 +324,7 @@ export async function startEmbeddedAgent({
       throw new Error(`no pod at ${base} yet — its owner profile is not there`);
     }
     log(`no identity on ${base} yet — provisioning @${handle}`);
-    await agent.bootstrap({ handle, name: handle, kind: 'person' });
+    await agent.bootstrap({ handle, name: handle, kind: 'person', root: cred.root });
     if (autoAcceptFollows) {
       agent.store.setConfig({ ...agent.store.getConfig(), autoAcceptFollows: true });
       await agent.store.flush();
@@ -342,15 +343,31 @@ export async function startEmbeddedAgent({
   // speaks, the write API, nodeinfo, and behind the door the admin routes and
   // the web client. Same code the standalone agent serves, minus the routes
   // that only mean something to a process of one's own.
+  //
+  // A pod that lives on a PATH of its host (a suffix pod, e.g.
+  // https://server.example/aisha/) shares its origin with the front and with
+  // every other suffix pod, so its whole surface answers UNDER that path: the
+  // mount is the pod's own pathname, and it is stripped before a route is
+  // matched and folded back into every self-URL. A host-root or subdomain pod
+  // has an empty mount and everything is exactly as it was.
   const authorities = new FixedAuthorities(base);
   agent.authorities = authorities;
+  const mount = new URL(base).pathname.replace(/\/+$/u, '');
   const surface = buildAdminSurface({
     agent,
     log,
-    gate: makeGate(gateToken, { secureCookie: authorities.secure }),
+    // The door cookie is named the same for every identity; on a shared origin
+    // (suffix pods) it has to be scoped to this identity's own door path so two
+    // co-tenants do not overwrite each other's. A host-root/subdomain pod keeps
+    // the whole-origin cookie it always had.
+    gate: makeGate(gateToken, {
+      secureCookie: authorities.secure,
+      cookiePath: mount ? mount + uiPath : '/',
+    }),
     allowed: authorities,
     embedded: true,
     basePath: uiPath,
+    mount,
     publicOrigin: base,
     scheme: new URL(base).protocol,
   });
@@ -399,7 +416,7 @@ export async function startEmbeddedAgent({
   // podHome and actorUrl are the identity's own locations on the pod. They are
   // returned rather than rebuilt by the caller so the root name lives here.
   return {
-    agent, handle, home, surface, host: authorities.host,
+    agent, handle, home, surface, host: authorities.host, mount,
     podHome: urls.home, actorUrl: urls.actor, inboxUrl: urls.inbox, stop,
   };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fedipod-server",
-  "version": "0.16.0",
+  "version": "0.17.0",
   "description": "The FediPod Server: a full ActivityPub server as a Community Solid Server component.",
   "license": "MIT",
   "main": "dist/index.js",
@@ -55,6 +55,7 @@
     "build:components": "componentsjs-generator -s src -c dist/components -r fps",
     "test": "npm run build && node --test test/*.mjs",
     "test:e2e": "node test/e2e/live-agent.mjs",
+    "test:e2e:suffix": "node test/e2e/live-suffix.mjs",
     "prepublishOnly": "npm test",
     "prepack": "node scripts/pack-tree.mjs copy",
     "postpack": "node scripts/pack-tree.mjs clean"

package/run-agent.mjs

@@ -1,6 +1,6 @@
 // run-agent.mjs — fedipod: a standalone single-actor ActivityPub
 // agent. The remote pod is a RELAY: it serves the public wire face
-// (/activitypods-js/ap/) and buffers inbound mail in a public-append inbox
+// (/fedipod/ap/) and buffers inbound mail in a public-append inbox
 // while this process is off, and it keeps one private document, the lease,
 // because a lock only one machine can reach coordinates nothing.
 //

package/vendor/gate.cjs

@@ -85,7 +85,7 @@ function cookieValue(header, name) {
 // AP_ALLOWED_HOSTS has nothing but this token, so the gate has to be total.
 // `token` may be a function, resolved per request: an identity's secret can
 // rotate while the server runs, and the very next request sees the new one.
-function makeGate(token, { allowOrigins = [], publicEndpoints = false, secureCookie = false } = {}) {
+function makeGate(token, { allowOrigins = [], publicEndpoints = false, secureCookie = false, cookiePath = '/' } = {}) {
   const tokenNow = () => (typeof token === 'function' ? token() : token);
   // gate(req, res) → true when the gate handled the response (caller stops).
   function gate(req, res) {
@@ -102,7 +102,10 @@ function makeGate(token, { allowOrigins = [], publicEndpoints = false, secureCoo
       url.searchParams.delete(COOKIE);
       url.searchParams.delete('dk-bless');
       res.writeHead(302, {
-        'set-cookie': `${COOKIE}=${t}; Path=/; HttpOnly; SameSite=Strict; Max-Age=31536000`
+        // Path scopes the cookie to this identity's own door: on a shared
+        // origin (suffix pods) two co-tenants must not clobber each other's,
+        // and a whole-origin cookie would. Defaults to '/'.
+        'set-cookie': `${COOKIE}=${t}; Path=${cookiePath}; HttpOnly; SameSite=Strict; Max-Age=31536000`
           + (secureCookie ? '; Secure' : ''),
         'location': url.pathname + url.search,
       });

package/web/app/agent.mjs

@@ -189,7 +189,7 @@ export class BrowserAgent {
     // builds its own urls from `config.root` (publisher.mjs), and a config
     // without one falls to the Node default — so an account set up elsewhere
     // and signed into here would keep its state under `fedipod/` while every
-    // document it published landed under `activitypods-js/`. One root, decided
+    // document it published landed under a different root. One root, decided
     // once, carried by the config everything downstream reads.
     this.store.setConfig({ ...(this.store.getConfig() || {}), ...cfg, root });
     config = this.store.getConfig();

package/web/app/dist/boot.js

@@ -33208,6 +33208,47 @@ async function provisionKey(pod, { stateUrl, keysUrl, envelope }) {
   await pod.putJson(keysUrl, envelope, "application/json");
 }
 
+// lib/pod/root.mjs
+var OWNER_LOOKUP_MS = 5e3;
+var PUBLIC_DOC_MAX_BYTES = 1024 * 1024;
+async function podLayout(fetchImpl, providerOrigin, { timeoutMs = OWNER_LOOKUP_MS } = {}) {
+  let origin;
+  try {
+    origin = new URL(providerOrigin).origin;
+  } catch {
+    return null;
+  }
+  let res;
+  try {
+    res = await fetchImpl(
+      `${origin}/.well-known/solid`,
+      { headers: { accept: "text/turtle" }, signal: AbortSignal.timeout(timeoutMs) }
+    );
+  } catch {
+    return null;
+  }
+  if (res.status === 501) return "host";
+  if (res.status !== 200) return null;
+  let body = "";
+  try {
+    body = await readCapped(res, 64 * 1024);
+  } catch {
+    return null;
+  }
+  return /ns\/pim\/space#Storage|pim:Storage/u.test(body) ? "path" : null;
+}
+async function resourceExists(fetchImpl, url, { timeoutMs = OWNER_LOOKUP_MS } = {}) {
+  try {
+    const res = await fetchImpl(
+      url,
+      { headers: { accept: "application/activity+json" }, signal: AbortSignal.timeout(timeoutMs) }
+    );
+    return !!res && res.status === 200;
+  } catch {
+    return false;
+  }
+}
+
 // web/app/idb-kv.mjs
 var DB = "fedipod-accounts";
 function open() {
@@ -33310,6 +33351,7 @@ async function signUp(answers, { onStep = () => {
       acct.running("checking your pod");
       const head = await fetch(brought, { method: "HEAD" }).catch(() => null);
       if (!head || head.status >= 400) throw new Error(`the pod at ${brought} did not answer (HTTP ${head?.status || "no response"})`);
+      if (await resourceExists(fetch, actorUrlFor(brought))) throw new Error("The pod already hosts a FediPod account. If you want a second account, put it on a different pod.");
       prog.pod = brought;
       acct.skip("using the pod you brought");
     }
@@ -33450,36 +33492,6 @@ function podBaseOfWebId(webId) {
   return `${u.origin}${dir.endsWith("/") ? dir : dir + "/"}`;
 }
 
-// lib/pod/root.mjs
-var OWNER_LOOKUP_MS = 5e3;
-var PUBLIC_DOC_MAX_BYTES = 1024 * 1024;
-async function podLayout(fetchImpl, providerOrigin, { timeoutMs = OWNER_LOOKUP_MS } = {}) {
-  let origin;
-  try {
-    origin = new URL(providerOrigin).origin;
-  } catch {
-    return null;
-  }
-  let res;
-  try {
-    res = await fetchImpl(
-      `${origin}/.well-known/solid`,
-      { headers: { accept: "text/turtle" }, signal: AbortSignal.timeout(timeoutMs) }
-    );
-  } catch {
-    return null;
-  }
-  if (res.status === 501) return "host";
-  if (res.status !== 200) return null;
-  let body = "";
-  try {
-    body = await readCapped(res, 64 * 1024);
-  } catch {
-    return null;
-  }
-  return /ns\/pim\/space#Storage|pim:Storage/u.test(body) ? "path" : null;
-}
-
 // web/app/oidc-session.mjs
 var DB2 = "fedipod-oidc";
 var STORE = "session";