fedipod-server 0.21.0 → 0.28.0

package/web/app/agent.mjs

@@ -5,6 +5,7 @@
 // the signing key comes from WebCrypto (keys-browser), and delivery goes through
 // the relay (deliver-relay). Everything between — wire, the store, the
 // publisher, intake, the Mastodon facade — is lib/, unchanged.
+import { kvGet, kvPut } from './idb-kv.mjs';
 import { apUrls } from '../../lib/core/wire.mjs';
 import * as containers from '../../lib/pod/containers.mjs';
 import * as podState from '../../lib/pod/state.mjs';
@@ -19,9 +20,10 @@ import { TagFeed } from '../../lib/connections/tagfeed.mjs';
 import { makeDpopSession } from './pod-auth.mjs';
 import { BrowserRemotePod } from './pod-remote.mjs';
 import { importSigningKey, loadKeysFromPod, cacheOpenedKeys, podActorOf } from './keys-browser.mjs';
-import { generateKeys, wrapKeys } from './keystore.mjs';
+import { generateKeys } from './keystore.mjs';
 import { RelayDeliverer, doorKeyOf } from './deliver-relay.mjs';
 import { AdminFacade } from './admin-facade.mjs';
+import { completeGatewayMove } from './gateway-move.mjs';
 import { BrowserAtproto } from './atproto-browser.mjs';
 import { BskyFeed } from '../../lib/connections/bskyfeed.mjs';
 import { BrowserFediAccounts } from './fediacct-browser.mjs';
@@ -49,6 +51,69 @@ const originAuthorities = (host) => ({
   wsAuthorities() { return []; },     // fetch-only: this build serves no socket
 });
 
+// Why an account did not open, in words for the person it happened to, and a
+// `code` the sign-in page turns into a title and the one button that leads
+// somewhere (boot.mjs). Every one of these used to be the same sentence —
+// "no account config on this pod — sign up first" — which named the wrong
+// cause, offered the wrong cure, and left the reader with nothing to press.
+//
+// Each message says three things and stops: what the pod did, what that means
+// for the account, what to do about it. The pod's own wording is carried only
+// where it adds something the status code does not.
+async function accountNotRead({ unread, podBase, state, webId, actorUrl = null, fetchImpl = globalThis.fetch }) {
+  const host = (() => { try { return new URL(podBase).host; } catch { return podBase; } })();
+  const of = (code, message) => { const e = new Error(message); e.code = code; return e; };
+  if (!unread) {
+    // A pod that holds the account's actor and no record is an account a
+    // DeviceAgent runs: the record lives on the device, and only the device
+    // can open it. Said so, rather than "there is no account".
+    const actor = actorUrl
+      ? await fetchImpl(actorUrl, { headers: { accept: 'application/activity+json' } }).then((r) => (r.ok ? r.json() : null)).catch(() => null)
+      : null;
+    if (actor?.preferredUsername) {
+      const at = (() => { try { return `@${actor.preferredUsername}@${new URL(actor.id || actorUrl).host}`; } catch { return actor.preferredUsername; } })();
+      return of('device-account', `${host} holds the account ${at}, but not its record: this account is run by a`
+        + ` DeviceAgent, and its record lives on that device. Open it from that device's admin page, not here.`
+        + ` The sign-in used here was ${webId}.`);
+    }
+    return of('no-account', `${host} answered, and there is no FediPod account in it.`
+      + ` Sign in with the pod that holds your account, or make an account in this one —`
+      + ` both start from the sign-in page. The sign-in used here was ${webId}.`);
+  }
+  const status = Number((/HTTP (\d{3})/u.exec(unread.message) || [])[1]) || 0;
+  if (status === 401 || status === 403) {
+    // The page renews a refused sign-in by itself, and takes the person to
+    // their pod's login when the renewal is refused too (boot.mjs). By the
+    // time anybody reads this, both have already been tried.
+    return of('sign-in-refused', `${host} would not let this sign-in read your account — it answered`
+      + ` "not allowed" (HTTP ${status}) — and renewing the sign-in did not change its mind.`
+      + ` Your account and everything in it are untouched. Signing in at ${host} again is the`
+      + ` one thing that helps.`);
+  }
+  if (status === 429) {
+    return of('pod-busy', `${host} is telling this browser it has asked for too much too quickly`
+      + ` (HTTP 429), so your account could not be read. Nothing is wrong with your account, and`
+      + ` nothing here needs doing: this page is waiting the throttle out and will ask again by`
+      + ` itself. While a pod is rate-limiting you, only time helps.`);
+  }
+  if (status >= 500) {
+    return of('pod-error', `${host} broke while handing your account over (HTTP ${status}).`
+      + ` That is the pod's own failure, not your account's. This page asks again by itself in`
+      + ` a moment; if it keeps saying this, the pod is down and there is nothing to do here.`);
+  }
+  if (status === 404) {
+    return of('no-account-here', `${host} says there is nothing at ${state} (HTTP 404).`
+      + ` Either no FediPod account has ever been set up in this pod, or you signed in with a`
+      + ` different pod than the one holding yours. Sign in with that one, or make an account`
+      + ` in this one — both start from the sign-in page.`);
+  }
+  // No status at all: the request never got an answer. The pod's own words are
+  // the only thing that says anything here, so they come along.
+  return of('pod-unreachable', `This browser could not reach ${host} to read your account`
+    + ` (${unread.message}). Your account is still there. This page tries again by itself;`
+    + ` if it keeps saying this, check that you are online and that the pod is up.`);
+}
+
 export class BrowserAgent {
   constructor({ log = console.log } = {}) {
     this.log = log;
@@ -72,10 +137,35 @@ export class BrowserAgent {
     return true;
   }
 
+  // One call to the gateway's owner API, proved with the pod session. What
+  // comes back on 200 or 410 is the account's standing there, kept for the
+  // manage page; anything else is logged and forgotten.
+  async tellGateway(what, body) {
+    if (!this.gatewayApi) return null;
+    let res;
+    try {
+      res = await this.sessionFetch(`${this.gatewayApi}/${what}`, {
+        method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(body),
+      });
+    } catch (e) { this.log(`gateway ${what}: ${e.message}`); return null; }
+    const json = await res.json().catch(() => ({}));
+    const out = { status: res.status, ...json };
+    if (res.status === 200 || res.status === 410) this.gatewayStanding = out;
+    else this.log(`gateway ${what}: ${res.status} ${json.error || ''}`);
+    return out;
+  }
+  openAtGateway() { return this.tellGateway('open', { handle: this.doorKey }); }
+  pauseAtGateway(paused) { return this.tellGateway('pause', { handle: this.doorKey, paused: !!paused }); }
+  closeAtGateway() { return this.tellGateway('close', { handle: this.doorKey, confirm: true }); }
+  static OPEN_EVERY_MS = 60 * 60_000;
+
   // Become the active agent: renew the lease, then start what a viewer skips —
   // publish the face, drain the inbox, run the mirrors.
   async goActive() {
     this.viewer = false;
+    // Reading here is being here: the gateway hears so once an hour.
+    clearInterval(this._openTimer);
+    this._openTimer = setInterval(() => { this.openAtGateway(); }, BrowserAgent.OPEN_EVERY_MS);
     this.lease.onLost = () => this.demote();
     this.lease.startRenewal();
     try {
@@ -94,6 +184,9 @@ export class BrowserAgent {
       this.deliverer?.startQueue?.();
       await this.publisher.publishProfile();
       await this.store.flush?.();
+      // An address that just moved here from another gateway: the new
+      // actor is published, so the old gateway and the followers can be told.
+      await completeGatewayMove(this).catch((e) => this.log(`gateway move: ${e.message}`));
       await this.intake.start();
       this.startBsky();
       this.startAccts();
@@ -111,6 +204,7 @@ export class BrowserAgent {
     this.viewer = true;
     this.log('another device took over — read-only here');
     this.lease.stopRenewal();
+    clearInterval(this._openTimer); this._openTimer = null;
     this.intake?.stop?.();
     // The delivery queue as well. Its timer starts in the Deliverer's
     // constructor and nothing here ever switched it off, so a demoted device
@@ -160,6 +254,22 @@ export class BrowserAgent {
    *  - { credential, keysRecord, config }: a client-credential session with the
    *    material in hand (the offline test path).
    */
+  // This browser's name for itself, minted once and kept. Not an identity and
+  // not a secret — it says only "the same browser as last time" to the lease.
+  // If storage cannot be reached, a fresh one is honest: this browser cannot
+  // prove it is the one that held the lease, so it should not claim to be.
+  async deviceId() {
+    try {
+      const had = await kvGet('device-id');
+      if (had) return had;
+      const made = crypto.randomUUID();
+      await kvPut('device-id', made);
+      return made;
+    } catch {
+      return null;
+    }
+  }
+
   async boot({ oidc, credential, keysRecord, config, frontOrigin }) {
     let session; let webId; let remotePod;
     if (oidc) {
@@ -173,6 +283,9 @@ export class BrowserAgent {
       remotePod = credential.remotePod;
     }
     this.webId = webId;
+    // The pod session's own fetch, for the gateway APIs that take it as
+    // proof of the pod (attach, move) — the transport below is for the pod.
+    this.sessionFetch = session.fetch;
     const root = (config && config.root) || 'fedipod/';
     this.remote = new BrowserRemotePod(session, { webId, log: this.log });
     // Pod-native for now: the state store below is read with these, and only
@@ -186,10 +299,18 @@ export class BrowserAgent {
     // The Node agent has always passed remote.fetch here.
     const podFetch = (u, i) => this.remote.fetch(u, i);
     this.store = new PodStore({ storage: new HttpStorage(this.urls.state, podFetch), log: this.log });
-    await this.store.load().catch(() => { /* first boot: nothing there yet */ });
+    // A read that FAILED is not an account that is not there. load() already
+    // tells those apart — a missing container, a refused token, a pod saying
+    // "too many requests" each come back with their own reason — and throwing
+    // the reason away turned every one of them into "sign up first", said to
+    // somebody who had just signed in and whose account was sitting on the pod
+    // unread. Keep it: below is the only place that can tell whether it
+    // mattered, because a sign-up hands its config in and needs no read at all.
+    let unread = null;
+    await this.store.load().catch((e) => { unread = e; });
     // Config: handed in on sign-up, or read from the pod on a returning sign-in.
     const cfg = config || this.store.getConfig();
-    if (!cfg) throw new Error('no account config on this pod — sign up first');
+    if (!cfg) throw await accountNotRead({ unread, podBase: remotePod, state: this.urls.state, webId, actorUrl: this.urls.actor });
     // `root` is written INTO the config, not just used above. The Publisher
     // builds its own urls from `config.root` (publisher.mjs), and a config
     // without one falls to the Node default — so an account set up elsewhere
@@ -227,6 +348,28 @@ export class BrowserAgent {
       onGone: () => this.publisher.publishCollections({ followers: true }),
     });
 
+    // The gateway this account's mail comes through, and the account's own
+    // standing there — paused, closed, how much arrived unread (front-core:
+    // accounts that go quiet). The gateway is told on every sign-in and
+    // hourly while this device is active: that is what keeps an account
+    // somebody reads from counting as a quiet one. Only a closed address
+    // stops the boot; a gateway that cannot be reached is no reason to
+    // refuse a sign-in.
+    this.gatewayApi = null;
+    try { if (config.gateway?.url) this.gatewayApi = `${new URL(config.gateway.url).origin}/api`; } catch { this.gatewayApi = null; }
+    this.doorKey = doorKeyOf(config.gateway?.url) || config.handle;
+    this.gatewayStanding = null;
+    const standing = await this.openAtGateway();
+    if (standing?.status === 410) {
+      const host = (() => { try { return new URL(this.gatewayApi).host; } catch { return 'the gateway'; } })();
+      const address = this.doorKey.includes('@') ? `@${this.doorKey}` : `@${this.doorKey}@${host}`;
+      const why = standing.closedBy === 'owner' ? 'you closed it' : 'nothing opened it for six months';
+      const e = new Error(`${address} is closed at ${host}: ${why}, and a closed address does not come back.`
+        + ` Everything on your pod is untouched. The sign-in used here was ${webId}.`);
+      e.code = 'address-closed';
+      throw e;
+    }
+
     this.publisher = new Publisher({
       config: this.store.getConfig(), remote: this.remote, store: this.store,
       deliverer: this.deliverer, publicKeyPem: keys.rsaPublicPem, assertionKey: null, log: this.log,
@@ -263,7 +406,13 @@ export class BrowserAgent {
     // one browser/device may ACT on a pod at a time — a later arrival runs
     // read-only until the owner acts on it and it takes over. Written with fresh
     // fetches, never the cached store. Passed into Intake so the drain checks it.
-    this.lease = new Lease({ url: this.urls.state + 'lease.json', fetchImpl: podFetch, log: this.log });
+    this.lease = new Lease({ url: this.urls.state + 'lease.json', fetchImpl: podFetch, log: this.log,
+      // Kept on this origin, so THIS browser is one holder however many times
+      // its worker is killed and restarted. Without it every restart was a new
+      // holder: the old lease still had minutes to run, so the browser found
+      // its own account "active on another device" and asked to take it over.
+      // Switching between the clients did it every time, being a navigation.
+      id: await this.deviceId() });
     // The client-to-server dispatcher, here only for what the Gateway's
     // outbox door takes on the owner's behalf: the browser answers no
     // /ap/outbox of its own.
@@ -377,24 +526,11 @@ export class BrowserAgent {
   // actor so the new public key is on the wire. The old key stops signing the
   // moment this returns — same one-way change as the Node agent's rotateKey
   // (run-agent.mjs).
-  //
-  // The pod's copy is wrapped, so this needs the account password. There is
-  // nowhere to get it from without asking: the worker boots from a stored
-  // session and holds no password, and caching one to save a prompt on a
-  // once-in-a-while action would put the account password in storage to avoid
-  // typing it. So the caller supplies it, and rotating without one is refused
-  // rather than quietly writing a bare key back where a wrapped one was.
-  async rotateKey({ password } = {}) {
-    if (!password) {
-      const e = new Error('rotating the signing key needs your account password — '
-        + 'it is what the new key is locked under on the pod');
-      e.code = 'key-password-needed';
-      throw e;
-    }
+  async rotateKey() {
     const before = this.publisher.publicKeyPem;
     const rec = await generateKeys();
     rec.mintedFor = this.urls.actor;                  // one key, one actor (lib/keys.mjs)
-    await podState.writeWrappedKeys(this.remote, this.urls, await wrapKeys(rec, password));
+    await podState.writeKeys(this.remote, this.urls, rec);
     const keys = await cacheOpenedKeys(podActorOf(this.urls), rec);
     this.publisher.publicKeyPem = keys.rsaPublicPem;
     this.deliverer.rsaPrivate = keys.rsaPrivate;
@@ -518,3 +654,5 @@ export class BrowserAgent {
     return { ...moved, ...r, snapshot: following.length };
   }
 }
+
+export { accountNotRead };

package/web/app/authorize_interaction.html

@@ -0,0 +1,56 @@
+<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<!-- The remote-follow door, at the path every Fediverse server sends its
+     readers to: /authorize_interaction?uri=<who>. Another server's Follow
+     button asks its reader which server they are on; when they say this one,
+     that server looks up the subscribe link in our WebFinger (front-core.mjs)
+     and lands them here. A static page, not a function: the account that does
+     the following is the agent in THIS browser, and the page asks it over the
+     same origin routes the record page uses. The underscore is Mastodon's
+     spelling of the path, kept so the address is the one other servers
+     already know. -->
+<title>Follow — FediPod</title>
+<link rel="icon" href="/icons/local.svg" type="image/svg+xml">
+<link rel="stylesheet" href="/admin/tokens.css">
+<style>
+  body { margin: 0; background: var(--surface); color: var(--fg); font-family: var(--font); }
+  main { max-width: 34rem; margin: 0 auto; padding: 2.5rem 1.25rem 3rem; }
+  h1 { color: var(--heading); margin: 0 0 1.5rem; font-size: 1.6rem; }
+  .address { background: var(--raised); border: 1px solid var(--line); border-radius: 8px;
+             padding: 1rem 1.1rem; margin: 0 0 1.25rem; word-break: break-word; }
+  .as { color: var(--ok); margin: 0 0 1.5rem; }
+  .row { margin: 0 0 1.25rem; }
+  button { font: inherit; padding: 0.6rem 1.4rem; border-radius: 8px; border: 1px solid var(--btn);
+           background: var(--btn); color: var(--btn-text); cursor: pointer; }
+  button:hover { background: var(--btn-hover); }
+  button:focus-visible { outline: 3px solid var(--focus); outline-offset: 2px; }
+  .msg { margin: 0 0 1.25rem; }
+  .msg.err { color: var(--err); }
+  .msg.ok { color: var(--ok); }
+  p { line-height: 1.55; }
+  a { color: var(--accent); }
+  .hint { color: var(--sub); }
+</style>
+<script src="/authorize_interaction.js" defer></script>
+</head>
+<body>
+<main>
+  <h1>Follow</h1>
+  <p class="address" id="target">…</p>
+  <p class="as" id="as" hidden></p>
+  <p class="row"><button id="go" hidden>Follow</button></p>
+  <p class="msg" id="msg" role="status" aria-live="polite"></p>
+  <div id="by-hand" hidden>
+    <p>No FediPod account is signed in to this browser, so the follow cannot be
+      sent from here. If your agent runs on your own machine, or you are signed
+      in somewhere else, paste the address above into your client's search box
+      and follow from the profile it finds.</p>
+    <p><a href="/">Sign in to FediPod</a></p>
+  </div>
+  <p class="hint"><a href="/admin/client/">Your account</a></p>
+</main>
+</body>
+</html>

package/web/app/authorize_interaction.js

@@ -0,0 +1,69 @@
+// authorize_interaction.js — the script for the remote-follow page.
+//
+// It reads who is to be followed out of the `uri` parameter, asks the agent in
+// this browser who it is, and sends the follow through the same same-origin
+// route the record page uses (/follow, admin-facade.mjs). The header is what
+// the service worker's gate reads: a cross-site form cannot set one, and a
+// cross-origin fetch that does is preflighted and never answered (sw-src.mjs).
+const PAGE = { 'x-fedipod-page': '1' };
+const $ = (id) => document.getElementById(id);
+
+const say = (text, kind = '') => { const m = $('msg'); m.textContent = text; m.className = `msg ${kind}`.trim(); };
+
+// What the other server put in `uri`: an acct URI, a bare or @-prefixed
+// handle, or the actor's address. Anything with a scheme is taken as the
+// actor itself — pasting an actor url is a normal way to follow.
+function readTarget(raw) {
+  const s = String(raw || '').trim();
+  if (!s) return null;
+  if (/^https?:\/\//iu.test(s)) return { actor: s, label: s };
+  const handle = s.replace(/^acct:/iu, '').replace(/^@/u, '');
+  if (!/^[^@\s/]+@[^@\s/]+$/u.test(handle)) return null;
+  return { handle, label: `@${handle}` };
+}
+
+const target = readTarget(new URLSearchParams(location.search).get('uri'));
+
+async function whoIsHere() {
+  try {
+    const res = await fetch('/config', { headers: PAGE });
+    if (!res.ok) return null;
+    const cfg = await res.json();
+    return cfg.address || (cfg.handle ? `@${cfg.handle}` : null);
+  } catch { return null; }
+}
+
+async function follow() {
+  $('go').disabled = true;
+  say('sending…');
+  try {
+    const res = await fetch('/follow', {
+      method: 'POST', headers: { ...PAGE, 'content-type': 'application/json' },
+      body: JSON.stringify(target.actor ? { actor: target.actor } : { handle: target.handle }),
+    });
+    const out = await res.json().catch(() => ({}));
+    if (!res.ok) { say(out.error || `the follow was refused (${res.status})`, 'err'); $('go').disabled = false; return; }
+    // A Follow is delivered, not granted: it counts once the other server
+    // answers it, and a locked account answers when its owner gets to it.
+    say(`sent to ${target.label} — it counts once their server accepts it`, 'ok');
+    $('go').hidden = true;
+  } catch (err) {
+    say(err.message || 'the follow could not be sent', 'err');
+    $('go').disabled = false;
+  }
+}
+
+(async () => {
+  if (!target) {
+    $('target').textContent = 'nobody';
+    say('This address opens from another server’s Follow button, and it did not name anybody to follow.', 'err');
+    return;
+  }
+  $('target').textContent = target.label;
+  const me = await whoIsHere();
+  if (!me) { $('by-hand').hidden = false; return; }
+  $('as').textContent = `signed in as ${me}`;
+  $('as').hidden = false;
+  $('go').hidden = false;
+  $('go').addEventListener('click', follow);
+})();