fedipod-server 0.16.0 → 0.18.0

package/dist/handler.js

@@ -17,6 +17,14 @@ const adapt_1 = require("./adapt");
 const store_css_1 = require("./store-css");
 const store_pod_1 = require("./store-pod");
 const directory_1 = require("./directory");
+/** The pod's path as a mount prefix: `''` for a host root, else `/aisha`. */
+function mountOf(podBase) {
+    return new URL(podBase).pathname.replace(/\/+$/u, '');
+}
+/** Whether `a` is `b` or an ancestor path of `b` (both mount-shaped, no trailing slash). */
+function pathContains(a, b) {
+    return a === b || b.startsWith(a + '/') || a === '';
+}
 // The JS front-core is FediPod's own ESM tree, reached at runtime. A real
 // dynamic import() built via Function keeps tsc from downleveling it to
 // require() — which cannot load an ESM module with top-level await under a
@@ -54,7 +62,7 @@ function deriveHandle(podBase) {
 function normalizeUiPath(raw) {
     if (raw === '')
         return '';
-    const path = raw ?? '/fedipod/';
+    const path = raw ?? '/fp/';
     return `/${path.replace(/^\/+|\/+$/gu, '')}/`;
 }
 class FediPodServerHandler extends community_server_1.HttpHandler {
@@ -63,12 +71,17 @@ class FediPodServerHandler extends community_server_1.HttpHandler {
     dir;
     podPut;
     logger = (0, community_server_1.getLoggerFor)(this);
-    agentHosts = new Set();
+    // Every pod whose routes this server claims, keyed by pod base. A claim
+    // records the host it answers on and the mount — the pod's own path, `''` for
+    // a host-root or subdomain pod, `/aisha` for a suffix pod on `server/aisha/`.
+    // A suffix pod shares its host (often the front's own) with others, so a
+    // request is matched to an identity by host AND mount, never host alone.
+    claimed = new Map(); // pod base → claim
     agentHandles = new Map(); // handle → pod base
     frontHost;
     uiPath;
     identities = new Map();
-    surfaces = new Map();
+    surfaces = new Map(); // pod base → running identity
     registry;
     doorSecrets = new Map(); // pod base → its door secret
     starting = new Set();
@@ -100,32 +113,81 @@ class FediPodServerHandler extends community_server_1.HttpHandler {
             : null;
     }
     /**
-     * Whether this pod may become an identity here: a real URL, an origin of its
-     * own, not the front's host, and a handle no other identity already uses —
-     * two pods must never share <agentDataDir>/<handle>/.
+     * Whether this pod may become an identity here, and the claim it earns: a
+     * real URL, a place no other identity already sits, and a handle no other
+     * identity uses — two pods must never share <agentDataDir>/<handle>/.
+     *
+     * A HOST-ROOT or subdomain pod needs an origin of its own, and it may not be
+     * the front's host: the whole surface answers at the origin root, so two of
+     * them, or one sharing the front, would collide. A SUFFIX pod lives on a path
+     * (`server/aisha/`), so it may share its host — with the front and with other
+     * suffix pods — provided no claim already contains or nests under its path.
      */
-    validateAgentHost(podBase) {
+    validateAgentPod(podBase) {
         let host;
+        let mount;
         try {
-            host = new URL(podBase).host.toLowerCase();
+            const u = new URL(podBase);
+            host = u.host.toLowerCase();
+            mount = mountOf(podBase);
         }
         catch {
             throw new Error(`not a pod URL: ${podBase}`);
         }
-        // The Mastodon client API is rooted at an origin, so two identities
-        // cannot share one — and an identity cannot share the front's origin.
-        if (this.agentHosts.has(host)) {
-            throw new Error(`the host ${host} already carries an identity — an identity needs an origin of its own`);
+        if (mount === '') {
+            // A pod at the root of its host: it owns the whole origin, so it cannot
+            // share it with the front or with any other claim.
+            if (host.split(':')[0] === String(this.frontHost).toLowerCase()) {
+                throw new Error(`${podBase} is on the front's own host — give the identity its own origin, or host it on a path`);
+            }
+            for (const c of this.claimed.values()) {
+                if (c.host === host) {
+                    throw new Error(`the host ${host} already carries an identity — a host-root identity needs an origin of its own`);
+                }
+            }
         }
-        if (host.split(':')[0] === String(this.frontHost).toLowerCase()) {
-            throw new Error(`${podBase} is on the front's own host — give the identity its own origin`);
+        else {
+            // A pod on a path: it owns only its subtree. Refuse anything that already
+            // contains it or that it would contain, so no identity can answer under
+            // another's path (and none straddles the front's own routes underneath).
+            for (const c of this.claimed.values()) {
+                if (c.host !== host)
+                    continue;
+                if (pathContains(c.mount, mount) || pathContains(mount, c.mount)) {
+                    throw new Error(`${podBase} nests with the identity already at ${c.podBase} — a path pod owns only its own subtree`);
+                }
+            }
         }
         const handle = deriveHandle(podBase);
         const holder = this.agentHandles.get(handle);
         if (holder && holder !== podBase) {
             throw new Error(`the name ${handle} already belongs to ${holder} — two identities cannot share it`);
         }
-        return host;
+        return { host, mount, podBase, handle };
+    }
+    /**
+     * The claim a request belongs to, or null. A request matches when its host is
+     * the claim's host and its path is at or under the claim's mount; the deepest
+     * mount wins, so a suffix pod's own routes are never swallowed by a shallower
+     * claim on the same host.
+     */
+    resolveClaim(host, pathname) {
+        let best = null;
+        for (const c of this.claimed.values()) {
+            if (c.host !== host)
+                continue;
+            if (c.mount === '' || pathname === c.mount || pathname.startsWith(c.mount + '/')) {
+                if (!best || c.mount.length > best.mount.length)
+                    best = c;
+            }
+        }
+        return best;
+    }
+    /** A request path relative to a mount: `/aisha/ap/actor` under `/aisha` → `/ap/actor`. */
+    stripMount(pathname, mount) {
+        if (!mount)
+            return pathname;
+        return pathname.slice(mount.length) || '/';
     }
     /**
      * Start an agent for each opted-in pod. Runs before the server listens, so
@@ -164,21 +226,22 @@ class FediPodServerHandler extends community_server_1.HttpHandler {
         // persist, and the next start recovers them.
         const pods = [];
         try {
-            const hosts = await this.registry.listHosts();
-            for (const host of hosts) {
-                const row = await this.registry.get(host);
+            const keys = await this.registry.listKeys();
+            for (const key of keys) {
+                const row = await this.registry.get(key);
                 if (!row)
                     continue;
-                if (this.agentHosts.has(row.host) || this.identities.has(row.podBase))
+                if (this.claimed.has(row.podBase) || this.identities.has(row.podBase))
                     continue; // already claimed
+                let claim;
                 try {
-                    this.validateAgentHost(row.podBase);
+                    claim = this.validateAgentPod(row.podBase);
                 }
                 catch (e) {
                     this.logger.error(`opted-in pod ${row.podBase} no longer valid: ${e.message}`);
                     continue;
                 }
-                this.agentHosts.add(row.host);
+                this.claimed.set(row.podBase, claim);
                 this.agentHandles.set(row.handle, row.podBase);
                 pods.push(row.podBase);
             }
@@ -266,10 +329,15 @@ class FediPodServerHandler extends community_server_1.HttpHandler {
                         return;
                     }
                     this.identities.set(podBase, identity);
-                    this.surfaces.set(identity.host, identity);
+                    this.surfaces.set(podBase, identity);
                     this.logger.info(`FediPod agent @${identity.handle} running on ${podBase}`);
-                    if (this.args.agentAutoFront)
+                    // A suffix pod cannot answer WebFinger for itself — its host root is
+                    // the front's — so it is followable ONLY through the door's apex
+                    // dispatch. Front it whether or not auto-front is on: the row is the
+                    // whole of what makes @handle@host resolve to it.
+                    if (this.args.agentAutoFront || this.claimed.get(podBase)?.mount) {
                         await this.frontIdentity(podBase, identity);
+                    }
                     return;
                 }
                 catch (e) {
@@ -318,14 +386,20 @@ class FediPodServerHandler extends community_server_1.HttpHandler {
         }
     }
     async canHandle({ request }) {
-        const host = request.headers.host;
+        const host = String(request.headers.host ?? '').toLowerCase();
         const pathname = new URL(request.url ?? '/', `https://${host}`).pathname;
-        // Claimed from the opt-in roster, never from what is running: a pod resource
-        // must not be served by CSS for the seconds before an identity finishes
-        // starting, and then stop being served once it has.
+        // The front's own routes win first, so a suffix pod can never shadow the
+        // door's dispatch, its WebFinger or its API even where its mount would
+        // otherwise contain that path.
         if ((0, claims_1.claims)({ host, pathname }, this.frontHost))
             return;
-        if ((0, claims_1.agentClaims)({ host, pathname, method: request.method }, this.agentHosts, this.uiPath))
+        // Claimed from the opt-in roster, never from what is running: a pod resource
+        // must not be served by CSS for the seconds before an identity finishes
+        // starting, and then stop being served once it has. The path is matched
+        // relative to the claim's mount, so a suffix pod's `/aisha/ap/actor` is
+        // judged as `/ap/actor`.
+        const c = this.resolveClaim(host, pathname);
+        if (c && (0, claims_1.agentClaims)({ pathname: this.stripMount(pathname, c.mount), method: request.method }, this.uiPath))
             return;
         throw new Error('not a gateway route'); // reject → CSS's LDP handler takes it
     }
@@ -340,9 +414,17 @@ class FediPodServerHandler extends community_server_1.HttpHandler {
         const cluster = this.args.clusterManager;
         return !cluster || cluster.isSingleThreaded() || cluster.isPrimary();
     }
-    /** The running identity answering on a host, if it has finished starting. */
-    surfaceFor(host) {
-        return this.surfaces.get(String(host ?? '').toLowerCase());
+    /**
+     * The identity a request belongs to (matched by host and mount) and the
+     * request path relative to that identity's mount, or null. The identity is
+     * undefined when the pod is claimed but still starting. Used by the streaming
+     * upgrade, which has only the request to go on.
+     */
+    matchIdentity(host, pathname = '/') {
+        const c = this.resolveClaim(String(host ?? '').toLowerCase(), pathname);
+        if (!c)
+            return null;
+        return { identity: this.surfaces.get(c.podBase), rel: this.stripMount(pathname, c.mount) };
     }
     /**
      * A pod owner, already proven to control podBase, asks this server to run
@@ -366,13 +448,14 @@ class FediPodServerHandler extends community_server_1.HttpHandler {
             return { httpStatus: 201, ok: true, handle, host: new URL(base).host.toLowerCase(),
                 doorSecret: door.secret, doorPath: this.uiPath, status: 'rotated' };
         }
-        let host;
+        let claim;
         try {
-            host = this.validateAgentHost(base);
+            claim = this.validateAgentPod(base);
         }
         catch (e) {
             return { httpStatus: 409, error: e.message };
         }
+        const { host } = claim;
         try {
             await this.registry.add({ podBase: base, handle, host, webId, optedInAt: new Date().toISOString() });
         }
@@ -382,7 +465,7 @@ class FediPodServerHandler extends community_server_1.HttpHandler {
         }
         // From this instant the pod's identity routes answer 503 instead of LDP,
         // until the agent registers its surface.
-        this.agentHosts.add(host);
+        this.claimed.set(base, claim);
         this.agentHandles.set(handle, base);
         const door = await this.doorSecretFor(base, undefined, { rotate: true });
         this.doorSecrets.set(base, door.secret);
@@ -397,19 +480,20 @@ class FediPodServerHandler extends community_server_1.HttpHandler {
             return { httpStatus: 501, error: 'this server does not offer runtime opt-in' };
         const base = podBase.endsWith('/') ? podBase : `${podBase}/`;
         const host = new URL(base).host.toLowerCase();
-        const row = await this.registry.get(host);
+        const key = (0, directory_1.agentKey)(host, base);
+        const row = await this.registry.get(key);
         if (!row || row.podBase !== base)
             return { httpStatus: 404, error: 'this pod has not opted in' };
-        this.agentHosts.delete(host); // routes fall to LDP now
+        this.claimed.delete(base); // routes fall to LDP now
         this.startCancelled.add(base); // a pending start stands down
         const identity = this.identities.get(base);
         this.identities.delete(base);
-        this.surfaces.delete(host);
+        this.surfaces.delete(base);
         this.agentHandles.delete(row.handle);
         this.doorSecrets.delete(base);
         if (identity)
             await identity.stop();
-        await this.registry.remove(host);
+        await this.registry.remove(key);
         this.logger.info(`runtime opt-out: @${row.handle} on ${base} — the pod serves plain LDP again`);
         return { httpStatus: 200, ok: true, stopped: Boolean(identity) };
     }
@@ -442,8 +526,13 @@ class FediPodServerHandler extends community_server_1.HttpHandler {
     }
     async handle({ request, response }) {
         const host = String(request.headers.host ?? '').toLowerCase();
-        if (this.agentHosts.has(host)) {
-            const identity = this.surfaces.get(host);
+        const pathname = new URL(request.url ?? '/', `https://${host}`).pathname;
+        // The front's own routes win first — its dispatch, WebFinger and API sit at
+        // the apex above every suffix pod — so a claim is consulted only where the
+        // front does not answer.
+        const claimed = (0, claims_1.claims)({ host, pathname }, this.frontHost) ? null : this.resolveClaim(host, pathname);
+        if (claimed) {
+            const identity = this.surfaces.get(claimed.podBase);
             if (!identity) {
                 // Claimed, but nothing here can answer for it. Saying which of the two
                 // reasons it is beats letting the pod answer for a route that is not
@@ -459,8 +548,10 @@ class FediPodServerHandler extends community_server_1.HttpHandler {
                 response.end(JSON.stringify({ error: 'this identity is still starting' }));
                 return;
             }
-            const pathname = new URL(request.url ?? '/', `https://${host}`).pathname;
-            if (pathname === claims_1.INBOX_PATH && String(request.method).toUpperCase() === 'POST') {
+            // This identity's own inbox path — <mount>/<root>/ap/inbox/, from its
+            // actor, so it already carries the mount for a suffix pod.
+            const inboxPath = new URL(identity.actorUrl).pathname.replace(/ap\/actor$/u, 'ap/inbox/');
+            if (pathname === inboxPath && String(request.method).toUpperCase() === 'POST') {
                 await this.deliverAtDoor(identity, request, response);
                 return;
             }

package/dist/handler.jsonld

@@ -249,8 +249,8 @@
           "memberFieldName": "logger"
         },
         {
-          "@id": "fps:dist/handler.jsonld#FediPodServerHandler__member_agentHosts",
-          "memberFieldName": "agentHosts"
+          "@id": "fps:dist/handler.jsonld#FediPodServerHandler__member_claimed",
+          "memberFieldName": "claimed"
         },
         {
           "@id": "fps:dist/handler.jsonld#FediPodServerHandler__member_agentHandles",
@@ -301,8 +301,16 @@
           "memberFieldName": "constructor"
         },
         {
-          "@id": "fps:dist/handler.jsonld#FediPodServerHandler__member_validateAgentHost",
-          "memberFieldName": "validateAgentHost"
+          "@id": "fps:dist/handler.jsonld#FediPodServerHandler__member_validateAgentPod",
+          "memberFieldName": "validateAgentPod"
+        },
+        {
+          "@id": "fps:dist/handler.jsonld#FediPodServerHandler__member_resolveClaim",
+          "memberFieldName": "resolveClaim"
+        },
+        {
+          "@id": "fps:dist/handler.jsonld#FediPodServerHandler__member_stripMount",
+          "memberFieldName": "stripMount"
         },
         {
           "@id": "fps:dist/handler.jsonld#FediPodServerHandler__member_initialize",
@@ -333,8 +341,8 @@
           "memberFieldName": "runsIdentities"
         },
         {
-          "@id": "fps:dist/handler.jsonld#FediPodServerHandler__member_surfaceFor",
-          "memberFieldName": "surfaceFor"
+          "@id": "fps:dist/handler.jsonld#FediPodServerHandler__member_matchIdentity",
+          "memberFieldName": "matchIdentity"
         },
         {
           "@id": "fps:dist/handler.jsonld#FediPodServerHandler__member_optInPod",

package/dist/streaming-handler.js

@@ -23,12 +23,17 @@ class FediPodStreamingHandler extends community_server_1.WebSocketHandler {
     async canHandle({ upgradeRequest }) {
         const host = upgradeRequest.headers.host;
         const { pathname } = new URL(upgradeRequest.url ?? '/', `http://${host}`);
-        if (!pathname.startsWith(STREAMING_PATH) || !this.server.surfaceFor(host)) {
+        // Matched relative to the identity's mount, so a suffix pod's own streaming
+        // socket at `/aisha/api/v1/streaming` is recognised as `/api/v1/streaming`.
+        const match = this.server.matchIdentity(host, pathname);
+        if (!match || !match.rel.startsWith(STREAMING_PATH)) {
             throw new Error('not a FediPod streaming socket');
         }
     }
     async handle({ webSocket, upgradeRequest }) {
-        const identity = this.server.surfaceFor(upgradeRequest.headers.host);
+        const host = upgradeRequest.headers.host;
+        const { pathname } = new URL(upgradeRequest.url ?? '/', `http://${host}`);
+        const identity = this.server.matchIdentity(host, pathname)?.identity;
         const streaming = identity?.surface?.streaming;
         if (!streaming) {
             webSocket.close(1011, 'identity not running');