fedipod-server 0.20.0 → 0.26.0

package/lib/core/wire.mjs

@@ -124,7 +124,9 @@ export function actorDoc({ urls, handle, name, publicKeyPem, assertionKey = null
   return {
     '@context': context,
     id: urls.actor,
-    type: kind === 'group' ? 'Group' : 'Person',
+    // A group is a community; an application is a service that speaks for a
+    // site rather than a person — the actor a forum publishes for itself.
+    type: kind === 'group' ? 'Group' : kind === 'application' ? 'Application' : 'Person',
     ...(approveJoins ? { manuallyApprovesFollowers: true } : {}),
     ...(assertionKey ? { assertionMethod: [{
       id: assertionKeyId(urls), type: 'Multikey', controller: urls.actor,
@@ -196,66 +198,7 @@ export function actorDoc({ urls, handle, name, publicKeyPem, assertionKey = null
 // the actor document. It says who this is and how to follow — the handle to
 // paste, and the remote-follow control that hands the visitor to their own
 // server's follow screen.
-export function profilePageHtml({ name, address, summary = null, icon = null, kind = 'person' }) {
-  const esc = (s) => String(s ?? '').replace(/[&<>"]/g, c => ({ ...HTML_ESCAPES, '"': '&quot;' }[c]));
-  const what = kind === 'group' ? 'a group' : 'an account';
-  return `<!doctype html>
-<html lang="en">
-<head>
-<meta charset="utf-8">
-<meta name="viewport" content="width=device-width, initial-scale=1">
-<title>${esc(name)} (${esc(address)})</title>
-<style>
-:root { color-scheme: light dark; }
-body { font: 112.5%/1.5 system-ui, sans-serif; max-width: 34rem; margin: 3rem auto; padding: 0 1rem; }
-img.avatar { width: 6rem; height: 6rem; border-radius: 1rem; object-fit: cover; }
-h1 { margin: .5rem 0 0; }
-.address { font-size: 1.1rem; user-select: all; }
-form { margin-top: 2rem; }
-label { display: block; margin-bottom: .3rem; }
-input { font: inherit; padding: .5rem; width: 14rem; max-width: 100%; }
-button { font: inherit; padding: .5rem 1rem; }
-.hint { color: #777; font-size: .9rem; }
-.err { color: #b00020; }
-.err:empty { display: none; }
-@media (prefers-color-scheme: dark) {
-  .hint { color: #aaa; }
-  .err { color: #ff8a80; }
-}
-</style>
-</head>
-<body>
-<main>
-${icon ? `<img class="avatar" src="${esc(icon)}" alt="">` : ''}
-<h1>${esc(name)}</h1>
-<p class="address">${esc(address)}</p>
-${summary ? `<div>${summary}</div>` : ''}
-<p>This is ${what} on the Fediverse. To follow it, paste the address above
-into the search box of Mastodon or any Fediverse app — or use the form.</p>
-<form id="follow">
-  <label for="server">your server</label>
-  <input id="server" type="text" placeholder="mastodon.social" autocomplete="off"
-    required aria-describedby="follow-err">
-  <button type="submit">Follow</button>
-  <p class="err" id="follow-err" role="alert"></p>
-</form>
-<p class="hint">The form sends you to your own server's follow screen.</p>
-</main>
-<script>
-document.getElementById('follow').addEventListener('submit', (ev) => {
-  ev.preventDefault();
-  const s = document.getElementById('server').value.trim().replace(/^https?:\\/\\//, '').replace(/\\/.*$/, '');
-  const err = document.getElementById('follow-err');
-  const addr = document.querySelector('.address').textContent.trim();
-  if (!s) { err.textContent = 'Enter your server, e.g. mastodon.social'; return; }
-  err.textContent = '';
-  location.href = 'https://' + s + '/authorize_interaction?uri=' + encodeURIComponent(addr);
-});
-</script>
-</body>
-</html>
-`;
-}
+export { profilePageHtml } from './profile-page.mjs';
 
 // Retirement. An abandoned pod keeps accepting deliveries into a container
 // nobody will ever drain, and no remote server has any way to learn that. A
@@ -656,18 +599,47 @@ export function addressing(urls, visibility, who = []) {
   }[visibility] || { to: [PUBLIC], cc: [urls.followers, ...who] };
 }
 
+// The quote terms, declared exactly as Mastodon declares them on a post:
+// FEP-044f's `quote` and `quoteAuthorization`, and the two older spellings
+// (Fedibird's quoteUri, Misskey's _misskey_quote) that older servers read.
+export const QUOTE_CTX = {
+  quote: { '@id': 'https://w3id.org/fep/044f#quote', '@type': '@id' },
+  quoteUri: { '@id': 'http://fedibird.com/ns#quoteUri', '@type': '@id' },
+  _misskey_quote: { '@id': 'https://misskey-hub.net/ns#_misskey_quote', '@type': '@id' },
+  quoteAuthorization: { '@id': 'https://w3id.org/fep/044f#quoteAuthorization', '@type': '@id' },
+};
+// The interaction policy terms, GoToSocial's, declared as Mastodon declares them.
+export const POLICY_CTX = {
+  gts: 'https://gotosocial.org/ns#',
+  interactionPolicy: { '@id': 'gts:interactionPolicy', '@type': '@id' },
+  canQuote: { '@id': 'gts:canQuote', '@type': '@id' },
+  automaticApproval: { '@id': 'gts:automaticApproval', '@type': '@id' },
+  manualApproval: { '@id': 'gts:manualApproval', '@type': '@id' },
+};
+
+// Who may quote a post: anyone, for a post the world can read; nobody, for a
+// followers-only or direct one. Said on every note, because a server that
+// finds no policy offers no quote button.
+export function quotePolicy(visibility) {
+  const open = visibility === 'public' || visibility === 'unlisted';
+  return { canQuote: { automaticApproval: open ? [PUBLIC] : [], manualApproval: [] } };
+}
+
 // `also`: actors addressed without being mentioned — the parent's author on
 // a reply. In cc but not in tag, so their server receives the post and does
 // not notify them. A direct post names its audience in the text alone.
+// `quote`: the post this one quotes, `{ id, authorization }` — the
+// authorization is the quoted author's QuoteAuthorization, once granted.
 export function noteDoc({ urls, slug, content, published, inReplyTo, attachments, mentions = [],
-  visibility = 'public', summary = null, sensitive = false, updated = null, container = null, also = [] }) {
+  visibility = 'public', summary = null, sensitive = false, updated = null, container = null, also = [],
+  quote = null }) {
   const id = (container || urls.notes) + slug;
   const who = mentions.map(m => m.actor);
   const extra = visibility === 'direct' ? [] : also.filter(a => a && !who.includes(a));
   const addressed = addressing(urls, visibility, [...who, ...extra]);
   const hashtags = hashtagsIn(content).map(name => ({ name, href: tagHref(urls, name) }));
   const note = {
-    '@context': AS_CTX,
+    '@context': [AS_CTX, { ...POLICY_CTX, ...(quote?.id ? QUOTE_CTX : {}) }],
     id, type: 'Note',
     attributedTo: urls.actor,
     content: contentHtml(content, mentions, hashtags),
@@ -675,7 +647,15 @@ export function noteDoc({ urls, slug, content, published, inReplyTo, attachments
     to: addressed.to,
     cc: addressed.cc,
     replies: repliesId(id),
+    interactionPolicy: quotePolicy(visibility),
   };
+  if (quote?.id) {
+    // All three spellings name the same post, as Mastodon writes them.
+    note.quote = quote.id;
+    note.quoteUri = quote.id;
+    note._misskey_quote = quote.id;
+    if (quote.authorization) note.quoteAuthorization = quote.authorization;
+  }
   if (summary) note.summary = summary;      // the content warning
   // A content warning is what a receiver hides behind; media marked
   // sensitive without one is hidden the same way.
@@ -723,7 +703,7 @@ export function questionDoc({ options = [], multiple = false, endTime = null,
   if (endTime) question.endTime = endTime;
   if (closed) question.closed = closed;
   if (votersCount !== null && votersCount !== undefined) {
-    question['@context'] = [AS_CTX, {
+    question['@context'] = [...[].concat(note['@context']), {
       toot: 'http://joinmastodon.org/ns#',
       votersCount: {
         '@id': 'toot:votersCount',
@@ -839,10 +819,13 @@ export function updateActorActivity({ urls, actor, serial, published = new Date(
 // An edit: same Note id, `updated` stamped, so receivers replace their copy
 // and show it as edited. The activity id carries the stamp — each edit is a
 // new activity, and a replay of an old one is already seen.
-export function updateActivity(note, urls) {
+// `serial` names the activity when the note is not being edited — a quote
+// authorization arriving on it changes what the note says about its quote,
+// not what it says.
+export function updateActivity(note, urls, { serial = null } = {}) {
   return {
     '@context': AS_CTX,
-    id: note.id + '#update-' + String(note.updated || '').replace(/[^0-9TZ]/g, ''),
+    id: note.id + '#update-' + (note.updated ? String(note.updated).replace(/[^0-9TZ]/g, '') : 'q' + (serial ?? Date.now())),
     type: 'Update',
     actor: urls.actor,
     to: note.to, cc: note.cc,

package/lib/device/admin/routes/lifecycle.mjs

@@ -14,6 +14,15 @@ export async function post(p, body, ctx, req, res) {   // eslint-disable-line no
     // lease exists to keep to a single agent. A viewer must claim it first
     // and give up if it cannot — the facade has refused viewer writes since
     // multi-device landed, and these two were simply missed.
+    // The account back in this agent's hands. A viewer publishes nothing and
+    // drains nothing, so a lease left behind by something that is gone leaves
+    // the account silent with nothing in the interface to say so.
+    case '/takeover': {
+      if (!await agent.requestTakeover?.()) {
+        return json(res, 503, { error: 'the lease could not be taken — the pod refused the write' });
+      }
+      return json(res, 200, { ok: true, mode: agent.status().mode });
+    }
     case '/drain': {
       if (!await agent.requestTakeover?.()) {
         return json(res, 503, { error: 'another agent is active for this pod — it is doing the draining' });

package/lib/device/admin/static.mjs

@@ -52,7 +52,10 @@ const UI_DIR = path.join(projectRoot, 'ui');       // extra client dists: ui/<na
 // One surface, /admin/, with setup as its first section: /admin/setup/ is the
 // first run, /admin/ is the record, and there is room for the rest.
 const WEB_DIR = path.join(projectRoot, 'web');
-const WEB_MOUNTS = ['admin'];
+// `icons` alongside `admin`: the favicons the agent's own pages name. One
+// file each, no authority behind them, and the same jail as everything else
+// under web/.
+const WEB_MOUNTS = ['admin', 'icons'];
 export const webMount = (pathname) => {
   const seg = decodeURIComponent(pathname).replace(/^\/+/, '').split('/')[0];
   return WEB_MOUNTS.includes(seg) ? seg : null;

package/lib/device/admin/surface.mjs

@@ -6,6 +6,8 @@
 // served off disk, and the dispatch to the routes modules beside it. Each of
 // those exports get() and post() over the same ctx.
 
+import fs from 'node:fs';
+import path from 'node:path';
 import { MastoApi } from '../../client/masto/index.mjs';
 import { C2S } from '../../client/c2s.mjs';
 import { makeC2sAuth } from '../../client/oidc-auth.mjs';
@@ -75,15 +77,27 @@ const ROUTES = [owner, setup, lifecycle, gateway, social, connections];
 // meaning inside a server that is not one — and moves the gate: a pod that is
 // a fediverse instance must let strangers reach /api and /oauth, so the gate
 // guards the operator's door (basePath) instead of the whole surface.
+const SESSION_FILES = {
+  '/oauth/session/signin.mjs': 'web/admin/oauth-signin.mjs',
+  '/oauth/session/fedi-login.mjs': 'lib/session/fedi-login.mjs',
+  '/oauth/session/oidc-session.mjs': 'lib/session/oidc-session.mjs',
+};
+
 export function buildAdminSurface({ agent, gate, allowed, log = console.log,
   port = null, handle = null, embedded = false, basePath = '/', mount = '',
   publicOrigin = null, scheme = null,
   versionOnDisk = () => localVersion(projectRoot) }) {
   const json = (res, status, obj) => sendJson(res, status, obj, allowed);
-  const masto = new MastoApi({ agent, log, allowed, scheme, embedded, mount });
+  const masto = new MastoApi({ agent, log, allowed, scheme, embedded, mount,
+    throughDoor: (req) => Boolean(gate?.upgradeOk?.(req)) });
+  // A client's sign-in can be proved with the owner's pod sign-in instead of a
+  // password: the same verification the post door uses, and the owner it names.
+  masto.podAuth = makeC2sAuth({ agent, log, scheme, mount });
+  masto.ownerWebId = () => agent.remote?.webId || null;
   // The spec's own write API (§6), beside the facade. Its bearer fallback is
   // the facade's token, so the two surfaces share one notion of the operator.
-  const c2s = new C2S({ agent, log, auth: makeC2sAuth({ agent, masto, log, scheme, mount }) });
+  const c2s = new C2S({ agent, log, scheme, mount,
+    auth: makeC2sAuth({ agent, masto, log, scheme, mount }) });
   const streaming = new Streaming({ masto, log, allowed, gate, gateOptional: embedded });
   // Asked per request, not once here: startAdmin runs before connect, so the
   // kind is not known yet at mount time.
@@ -171,6 +185,16 @@ export function buildAdminSurface({ agent, gate, allowed, log = console.log,
       if (p === '/ap/outbox' || p === '/ap/actor' || p === '/ap/inbox') {
         if (await c2s.handle(req, res, p, url)) return;
       }
+      // The sign-in page's script and the library it signs in with, outside
+      // the door like the sign-in itself. A fixed list; nothing in the request
+      // names a file.
+      const sessionFile = SESSION_FILES[p];
+      if (sessionFile) {
+        let body;
+        try { body = fs.readFileSync(path.join(projectRoot, sessionFile)); } catch { return json(res, 404, { error: 'not here' }); }
+        res.writeHead(200, { 'content-type': 'text/javascript; charset=utf-8', 'cache-control': 'no-cache' });
+        res.end(body); return;
+      }
       // Where a client looks first to find out how to sign in (RFC 8414), and
       // in front of the door for the same reason C2S is: a client that has to
       // be handed a secret before it can ask how to sign in cannot set itself

package/lib/device/certs.mjs

@@ -71,7 +71,16 @@ function nameConstraintsExtension() {
   return { id: '2.5.29.30', critical: true, value: der.getBytes() };
 }
 
-function makeCert({ subjectCN, issuer = null, issuerKeyPem = null, isCA = false, days, extraDns = [] }) {
+// The issuer's own key identifier, for the certificate it signs to name. A
+// verifier that finds several CAs under one name — this machine's browser
+// store has held dozens of "FediPod Local CA" from scratch agents — picks by
+// this, and without it picks by name, tries the wrong key and fails.
+const issuerKeyId = (issuerCertPem) => {
+  const ext = forge.pki.certificateFromPem(issuerCertPem).getExtension('subjectKeyIdentifier');
+  return ext?.subjectKeyIdentifier ? forge.util.hexToBytes(ext.subjectKeyIdentifier) : null;
+};
+
+function makeCert({ subjectCN, issuer = null, issuerKeyPem = null, issuerCertPem = null, isCA = false, days, extraDns = [] }) {
   const keys = forge.pki.rsa.generateKeyPair({ bits: 2048 });
   const cert = forge.pki.createCertificate();
   cert.publicKey = keys.publicKey;
@@ -89,6 +98,9 @@ function makeCert({ subjectCN, issuer = null, issuerKeyPem = null, isCA = false,
     : [{ name: 'basicConstraints', cA: false },
        { name: 'keyUsage', digitalSignature: true, keyEncipherment: true },
        { name: 'extKeyUsage', serverAuth: true },
+       { name: 'subjectKeyIdentifier' },
+       ...(issuerCertPem && issuerKeyId(issuerCertPem)
+         ? [{ name: 'authorityKeyIdentifier', keyIdentifier: issuerKeyId(issuerCertPem) }] : []),
        { name: 'subjectAltName',
          altNames: [...SANS, ...extraDns.map(v => ({ type: 2, value: v }))] }]);
   const signingKey = issuerKeyPem ? forge.pki.privateKeyFromPem(issuerKeyPem) : keys.privateKey;
@@ -131,6 +143,7 @@ export function ensureLocalTls(dir, { log = () => {}, names = [] } = {}) {
   const trust = !!(caKey && caCert);
   const isStale = (k, c) => !k || !c || daysLeft(c) < REMINT_DAYS || !coversLocalhost(c)
     || (trust && !issuedBy(c, caCert))
+    || (trust && !namesIssuerKey(c))
     || names.some(n => !certDnsNames(c).includes(n));
   let key = readPem(dir, FILES.key);
   let cert = readPem(dir, FILES.cert);
@@ -165,7 +178,7 @@ export function ensureLocalTls(dir, { log = () => {}, names = [] } = {}) {
         .filter(n => n !== 'localhost' && n !== '*.localhost');
       const minted = makeCert({
         subjectCN: 'localhost',
-        ...(trust ? { issuer: caSubject(caCert), issuerKeyPem: caKey } : {}),
+        ...(trust ? { issuer: caSubject(caCert), issuerKeyPem: caKey, issuerCertPem: caCert } : {}),
         days: LEAF_DAYS,
         extraDns: carried,
       });
@@ -181,6 +194,9 @@ export function ensureLocalTls(dir, { log = () => {}, names = [] } = {}) {
   return { key, cert, trust, dir, expiresInDays: Math.floor(daysLeft(cert)) };
 }
 
+const namesIssuerKey = (certPem) => {
+  try { return !!forge.pki.certificateFromPem(certPem).getExtension('authorityKeyIdentifier'); } catch { return false; }
+};
 const caSubject = (caCertPem) => forge.pki.certificateFromPem(caCertPem).subject.attributes
   .map(a => ({ name: a.name, value: a.value }));
 const issuedBy = (certPem, caCertPem) => {

package/lib/device/cli/commands/setup.mjs

@@ -163,6 +163,7 @@ const credential = await mintCredential({ origin: issuer, email, password, name:
 const rec = {
   ...credential,
   remotePod: pod.endsWith('/') ? pod : pod + '/',
+  createdAt: new Date().toISOString(),
   // The private half goes on THIS machine, exactly as the browser setup does
   // (lib/setup.mjs). Omitting it here meant the two paths produced different
   // installs from the same answers: the CLI put the timeline, contacts,

package/lib/device/cli/commands/state.mjs

@@ -289,7 +289,9 @@ for (const { name, dir } of homes) {
   // The kind lives in pod state, so it is only knowable from the live probe —
   // a stopped identity honestly shows nothing rather than a guess.
   rows.push({ name, pod: pod ? new URL(pod).host : '(no credential)', port: port || '—',
-    kind: live?.kind === 'group' ? 'group' : live ? 'person' : '—',
+    // A home can hold a forum, which says so itself; anything else that
+    // answers is a person unless it says group.
+    kind: live?.kind === 'group' ? 'group' : live?.kind === 'forum' ? 'forum' : live ? 'person' : '—',
     state: live ? `${live.mode}${live.podRequests ? ` · ${live.podRequests.perMinuteNow}/min` : ''}` : 'not running' });
 }
 

package/lib/device/setup.mjs

@@ -293,6 +293,7 @@ export async function runSetup({ home, agent, answers, run, deps = {}, log = ()
       const rec = {
         ...credential,
         remotePod: pod.endsWith('/') ? pod : pod + '/',
+        createdAt: new Date().toISOString(),
         ...(root ? { root } : {}),
         ...(keys === 'pod' ? { keysMode: 'pod' } : {}),
         // Where the private half lives. Per-machine, like keysMode.