fedipod-server 0.21.0 → 0.28.0

package/lib/client/masto/body.mjs

@@ -1,6 +1,6 @@
-// body.mjs — reading what a client sent: JSON or form-encoded bodies, the
-// poll a compose request carries, and the text of a post back out of its
-// HTML.
+// body.mjs — reading what a client sent: JSON, form-encoded or multipart
+// bodies, the poll a compose request carries, and the text of a post back out
+// of its HTML.
 
 
 
@@ -51,6 +51,12 @@ export function readBody(req) {
       const ct = String(req.headers['content-type'] || '');
       try {
         if (ct.includes('application/json')) return resolve(data ? JSON.parse(data) : {});
+        // A multipart body is not a query string: read as one it becomes a
+        // single nonsense key, so every field a client sent that way arrived
+        // undefined. Sengi registers its OAuth client with a FormData, which
+        // is multipart, so /api/v1/apps saw no redirect_uris and handed back
+        // the out-of-band URN, leaving the client nowhere to come back to.
+        if (ct.includes('multipart/form-data')) return resolve(textFields(data, ct));
         // A form-encoded list is the same key repeated, spelled with a
         // trailing `[]`. Reading it as a plain object kept only the last one,
         // so a client sending its poll or its media that way lost all but the
@@ -67,3 +73,84 @@ export function readBody(req) {
     req.on('error', reject);
   });
 }
+
+/**
+ * The text fields of a multipart body that arrived as text. readBody
+ * accumulates the body as a string, so this reads the fields out of that
+ * string rather than out of bytes — which is all a client sending a plain
+ * form this way has in it. A body with a FILE in it is not this reader's:
+ * a text round trip corrupts binary, and the upload endpoints take their
+ * bytes from readMultipart below.
+ */
+function textFields(data, contentType) {
+  const m = /boundary=(?:"([^"]+)"|([^;]+))/.exec(contentType);
+  if (!m) return {};
+  const out = {};
+  for (const part of data.split('--' + (m[1] || m[2]).trim())) {
+    const sep = part.indexOf('\r\n\r\n');
+    if (sep < 0) continue;
+    const head = part.slice(0, sep);
+    const name = /name="([^"]*)"/.exec(head)?.[1];
+    // A file part is skipped rather than kept as mangled text.
+    if (!name || /filename="/.test(head)) continue;
+    const value = part.slice(sep + 4).replace(/\r\n$/, '');
+    if (name.endsWith('[]')) (out[name] ||= []).push(value);
+    else out[name] = value;
+  }
+  return out;
+}
+
+// Minimal multipart/form-data reader for media uploads: string fields plus
+// at most one file part (Mastodon's media endpoints send exactly one).
+export function readMultipart(req, limit = 12e6) {
+  return new Promise((resolve, reject) => {
+    const chunks = [];
+    let n = 0;
+    req.on('data', c => {
+      n += c.length;
+      if (n > limit) { reject(new Error('upload too large')); req.destroy(); return; }
+      chunks.push(c);
+    });
+    req.on('error', reject);
+    req.on('end', () => {
+      try {
+        const m = /boundary=(?:"([^"]+)"|([^;]+))/.exec(String(req.headers['content-type'] || ''));
+        if (!m) return resolve({ fields: {}, file: null });
+        const buf = Buffer.concat(chunks);
+        const boundary = Buffer.from('--' + (m[1] || m[2]).trim());
+        const fields = {};
+        // `file` is the last one seen, which is what the single-file media
+        // upload wants. `files` keys them by field name, because the profile
+        // editor submits an avatar and a header in one request.
+        const files = {};
+        let file = null;
+        let i = buf.indexOf(boundary);
+        while (i >= 0) {
+          const start = i + boundary.length;
+          if (buf.slice(start, start + 2).toString() === '--') break;
+          const next = buf.indexOf(boundary, start);
+          if (next < 0) break;
+          const part = buf.slice(start + 2, next - 2);        // strip the CRLFs framing the part
+          const sep = part.indexOf('\r\n\r\n');
+          if (sep >= 0) {
+            const head = part.slice(0, sep).toString();
+            const body = part.slice(sep + 4);
+            const name = /name="([^"]*)"/.exec(head)?.[1];
+            const filename = /filename="([^"]*)"/.exec(head)?.[1];
+            if (filename !== undefined) {
+              file = {
+                filename,
+                contentType: /content-type:\s*([^\r\n]+)/i.exec(head)?.[1]?.trim() || 'application/octet-stream',
+                data: body,
+              };
+              if (name) files[name] = file;
+            } else if (name) fields[name] = body.toString();
+          }
+          i = next;
+        }
+        resolve({ fields, file, files });
+      } catch (e) { reject(e); }
+    });
+  });
+}
+

package/lib/client/masto/index.mjs

@@ -31,7 +31,7 @@ export { pollParams } from './body.mjs';
 export { attachmentType, extensionFor } from './media.mjs';
 
 export class MastoApi {
-  constructor({ agent, log = console.log, allowed = null, scheme = null, embedded = false,
+  constructor({ agent, log = console.log, allowed = null, scheme = null, embedded = false, throughDoor = null,
     mount = '', streaming = true, webPush = true, scheduling = true }) {
     this.agent = agent;
     // The path this identity's surface answers under, when it shares its origin
@@ -45,6 +45,9 @@ export class MastoApi {
     this.embedded = embedded;
     this.log = log;
     this.allowed = allowed;             // authorities a redirect_uri may name
+    // Whether a request already passed the owner's door (its key or cookie):
+    // an owner who opened the management page is the owner at the sign-in too.
+    this.throughDoor = throughDoor;
     // The scheme this identity is reached on, when the socket cannot say —
     // a server behind a TLS proxy terminates cleartext and still is https.
     this.scheme = scheme;
@@ -183,6 +186,7 @@ export class MastoApi {
   acctAction(...a) { return render.acctAction(this, ...a); }
   acctReply(...a) { return render.acctReply(this, ...a); }
   status(...a) { return render.status(this, ...a); }
+  quoteApproval(...a) { return render.quoteApproval(this, ...a); }
   filtersFor(...a) { return render.filtersFor(this, ...a); }
   lookup(...a) { return render.lookup(this, ...a); }
   statusOrBoost(...a) { return render.statusOrBoost(this, ...a); }

package/lib/client/masto/instance.mjs

@@ -14,7 +14,7 @@ const STUBS = new Map(Object.entries({
   '/api/v1/custom_emojis': [],
   '/api/v1/announcements': [],
   '/api/v1/instance/peers': [],
-  '/api/v1/trends/tags': [], '/api/v1/trends/links': [],
+  '/api/v1/trends/links': [],
   '/api/v2/suggestions': [],
   '/api/v1/preferences': {},
 }));   // followed_tags is served live from the tag feed, not stubbed
@@ -49,9 +49,9 @@ export function instanceTitle(api) {
 // A Mastodon Tag object. The client reads `following` in its Followed
 // Hashtags view and toggles it with the follow/unfollow endpoints. No usage
 // history — a single-actor instance has no firehose stats to report.
-export function tagObject(api, name, following, req) {
+export function tagObject(api, name, following, req, history = []) {
   const host = req?.headers?.host || api.host;
-  return { name, url: `https://${host}/tags/${name}`, history: [], following: !!following };
+  return { name, url: `https://${host}/tags/${name}`, history, following: !!following };
 }
 
 export function instanceBlurb(api) {
@@ -59,6 +59,12 @@ export function instanceBlurb(api) {
   return `Solid pod ActivityPub ${kind}`;
 }
 
+// The Mastodon API version this facade answers to. Clients read it for what
+// the server can do beyond the version string: grouped notifications from 2,
+// a filter's blur action from 5, quote posts from 7. Everything up to 7 is
+// served here; nothing past it is claimed.
+const API_VERSIONS = { mastodon: 7 };
+
 export async function handle(api, ctx) {
   const { req, res, pathname, url, send } = ctx;   // eslint-disable-line no-unused-vars
 
@@ -68,6 +74,7 @@ export async function handle(api, ctx) {
     return send(200, {
       uri: api.host, title: api.instanceTitle(), short_description: api.instanceBlurb(),
       description: api.instanceBlurb(), email: '', version: '4.2.0 (compatible; fedipod)',
+      api_versions: API_VERSIONS,
       urls: su ? { streaming_api: su } : {},
       stats: { user_count: 1, status_count: api.store.countStatuses(), domain_count: 1 },
       languages: ['en'], registrations: false, approval_required: false, invites_enabled: false,
@@ -79,6 +86,7 @@ export async function handle(api, ctx) {
     const su = api.streamingUrl(req);
     return send(200, {
       domain: api.host, title: api.instanceTitle(), version: '4.2.0 (compatible; fedipod)',
+      api_versions: API_VERSIONS,
       source_url: 'https://github.com/jeff-zucker/FediPod', description: api.instanceBlurb(),
       usage: { users: { active_month: 1 } },
       thumbnail: { url: TRANSPARENT_PNG },

package/lib/client/masto/media.mjs

@@ -1,10 +1,10 @@
 // media.mjs — an upload on its way to the pod's media container: what an
-// attachment is allowed to be, the multipart reader, and the two media
-// endpoints.
+// attachment is allowed to be and the two media endpoints. The multipart
+// reader moved to body.mjs, which is where a client's body is read.
 
 import crypto from 'node:crypto';
 import * as podMedia from '../../pod/media.mjs';
-import { readBody } from './body.mjs';
+import { readBody, readMultipart } from './body.mjs';
 
 // What an attachment is allowed to BE. Anything else is stored as bytes, which
 // a browser downloads rather than runs.
@@ -34,60 +34,6 @@ export function extensionFor(mediaType, filename = '') {
   return given && (given === sub || sub.startsWith(given) || given.startsWith(sub)) ? given : (sub || 'bin');
 }
 
-// Minimal multipart/form-data reader for media uploads: string fields plus
-// at most one file part (Mastodon's media endpoints send exactly one).
-export function readMultipart(req, limit = 12e6) {
-  return new Promise((resolve, reject) => {
-    const chunks = [];
-    let n = 0;
-    req.on('data', c => {
-      n += c.length;
-      if (n > limit) { reject(new Error('upload too large')); req.destroy(); return; }
-      chunks.push(c);
-    });
-    req.on('error', reject);
-    req.on('end', () => {
-      try {
-        const m = /boundary=(?:"([^"]+)"|([^;]+))/.exec(String(req.headers['content-type'] || ''));
-        if (!m) return resolve({ fields: {}, file: null });
-        const buf = Buffer.concat(chunks);
-        const boundary = Buffer.from('--' + (m[1] || m[2]).trim());
-        const fields = {};
-        // `file` is the last one seen, which is what the single-file media
-        // upload wants. `files` keys them by field name, because the profile
-        // editor submits an avatar and a header in one request.
-        const files = {};
-        let file = null;
-        let i = buf.indexOf(boundary);
-        while (i >= 0) {
-          const start = i + boundary.length;
-          if (buf.slice(start, start + 2).toString() === '--') break;
-          const next = buf.indexOf(boundary, start);
-          if (next < 0) break;
-          const part = buf.slice(start + 2, next - 2);        // strip the CRLFs framing the part
-          const sep = part.indexOf('\r\n\r\n');
-          if (sep >= 0) {
-            const head = part.slice(0, sep).toString();
-            const body = part.slice(sep + 4);
-            const name = /name="([^"]*)"/.exec(head)?.[1];
-            const filename = /filename="([^"]*)"/.exec(head)?.[1];
-            if (filename !== undefined) {
-              file = {
-                filename,
-                contentType: /content-type:\s*([^\r\n]+)/i.exec(head)?.[1]?.trim() || 'application/octet-stream',
-                data: body,
-              };
-              if (name) files[name] = file;
-            } else if (name) fields[name] = body.toString();
-          }
-          i = next;
-        }
-        resolve({ fields, file, files });
-      } catch (e) { reject(e); }
-    });
-  });
-}
-
 export async function handle(api, ctx) {
   const { req, res, pathname, url, send } = ctx;   // eslint-disable-line no-unused-vars
 

package/lib/client/masto/oauth.mjs

@@ -42,6 +42,42 @@ const escapeHtml = (s) => String(s).replace(/[&<>"']/g, c =>
 const parseRedirects = (v) => (Array.isArray(v) ? v : String(v || '').split(/\s+/))
   .map(s => s.trim()).filter(Boolean);
 
+// The sign-in page for an account whose owner signs in at their pod: no
+// password of ours exists, and none is asked for. The page carries the
+// client's request in its address, signs the owner in at the pod with the
+// fediverse-account library, and proves that sign-in back to /oauth/authorize.
+function sendPodSigninPage(res, client, webId, mount = '') {
+  let asking = '';
+  if (client && (client.name || client.redirect)) {
+    let where = '';
+    try { where = client.redirect ? new URL(client.redirect).host : ''; } catch { /* oob or blank */ }
+    const who = client.name ? escapeHtml(client.name) : (where ? escapeHtml(where) : 'A client');
+    asking = `<p><strong>${who}</strong> is asking to use your account`
+      + `${where ? `, and will be sent back to <code>${escapeHtml(where)}</code>` : ''}.</p>`;
+  }
+  res.writeHead(200, { 'content-type': 'text/html; charset=utf-8', 'cache-control': 'no-cache' });
+  res.end(`<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">
+<title>Sign in with your pod</title>
+<style>:root{color-scheme:light dark;--heading:#1a4f8a;--btn:#3d6b35;--line:#9a9a9a}
+body{font:20px Arial,Helvetica,sans-serif;max-width:28rem;margin:12vh auto;padding:0 1rem}
+h1{color:var(--heading);font-size:1.5rem}
+code{word-break:break-all;background:rgba(120,120,120,.12);padding:.05em .35em;border-radius:4px}
+button{font:inherit;padding:.6rem 1.1rem;background:var(--btn);color:#fff;border:none;border-radius:9px;cursor:pointer}
+button[hidden]{display:none}
+#signin-status{min-height:1.5em;padding:.6rem .8rem;border:1px solid var(--line);border-radius:8px;margin-top:1rem}
+@media (prefers-color-scheme:dark){:root{--heading:#7fb3e8;--btn:#5a8a4f}}</style></head><body>
+<main>
+<h1>Sign in with your pod</h1>
+${asking}
+<p>This account belongs to <a id="webid" href="${escapeHtml(webId)}">${escapeHtml(webId)}</a>. Sign in at that pod to allow it.</p>
+<p><button type="button" id="signin" hidden>Sign in with your pod</button></p>
+<p id="signin-status" role="status" aria-live="polite"></p>
+</main>
+<script type="module" src="${escapeHtml(mount)}/oauth/session/signin.mjs"></script>
+</body></html>`);
+  return true;
+}
+
 function sendLoginForm(res, params, error = '', client = null, status = null, headers = {}) {
   const hidden = [...params.entries()].filter(([k]) => k !== 'password')
     .map(([k, v]) => `<input type="hidden" name="${escapeHtml(k)}" value="${escapeHtml(v)}">`).join('\n');
@@ -378,6 +414,21 @@ export async function handle(api, ctx) {
     let body = null;
     if (req.method === 'POST') { body = await readBody(req); params = new URLSearchParams(body); }
     const redirect = params.get('redirect_uri') || '';
+    // The owner's pod sign-in, proved: a Solid-OIDC token with its DPoP proof,
+    // from the WebID this account belongs to. It stands in for the password
+    // everywhere below.
+    let proved = false;
+    if (req.method === 'POST' && req.headers.authorization && req.headers.dpop && api.podAuth) {
+      const proof = await api.podAuth(req, pathname);
+      if (!proof.ok) return send(proof.status || 401, { error: proof.error });
+      proved = true;
+    }
+    const ownerWebId = api.ownerWebId?.() || null;
+    // The way back from the pod's login: no client named, only the pod's
+    // code. The page finishes the sign-in and returns to the client's request.
+    if (req.method === 'GET' && !params.get('client_id') && params.get('code') && params.get('state') && ownerWebId) {
+      return sendPodSigninPage(res, null, ownerWebId, api.mount || '');
+    }
     const app = api.findApp(params.get('client_id') || '');
     // A client that published its own metadata document needs no
     // registration here: the document is its name and says where it may be
@@ -419,14 +470,16 @@ export async function handle(api, ctx) {
     //    port is the owner" is a statement about the machine rather than
     //    about a web page. Anything pointing elsewhere has to be approved by
     //    somebody who knows the password.
-    if (external && !api.store.getConfig()?.uiPassword && !api.redirectAllowed(redirect)) {
+    const client = { name: app?.name || doc?.name || null, redirect, scope: params.get('scope') || 'read' };
+    if (external && !proved && !api.store.getConfig()?.uiPassword && !api.redirectAllowed(redirect)) {
+      // With a pod to sign in at, the owner approves the client there.
+      if (req.method === 'GET' && ownerWebId) return sendPodSigninPage(res, client, ownerWebId, api.mount || '');
       api.log(`authorize refused: no UI password, and "${redirect}" is not an address of this agent`);
       return send(403, {
         error: 'this client asks to be sent somewhere other than this agent, and no password is '
           + 'set to approve that with. Run `fedipod passwd` and try again.',
       });
     }
-    const client = { name: app?.name || doc?.name || null, redirect, scope: params.get('scope') || 'read' };
     if (app) {
       if (!app.redirectUris.includes(redirect)) {
         api.log(`authorize refused: redirect_uri "${redirect}" not registered for ${app.clientId}`);
@@ -448,7 +501,7 @@ export async function handle(api, ctx) {
       api.log(`authorize refused: redirect_uri "${redirect}" is not this agent`);
       return send(400, { error: 'redirect_uri must be an address of this agent' });
     }
-    if (req.method === 'POST') {
+    if (req.method === 'POST' && !proved) {
       if (api.rateLimited()) {
         api.log('authorize rate limited');
         // 429, not 401: a client that reads this as a wrong password will
@@ -460,11 +513,13 @@ export async function handle(api, ctx) {
       if (!pw || !checkPassword(pw, body.password || '')) {
         return sendLoginForm(res, params, 'wrong password — try again', client);
       }
-    } else if (pw) {
+    } else if (pw && !proved) {
       // The login/approve screen names what is asking before the owner types
       // the password — a cross-site client cannot forge past that.
       return sendLoginForm(res, params, '', client);
-    } else if (api.allowed && !api.allowed.isLocalRequest(req)) {
+    } else if (!proved && api.allowed && !api.allowed.isLocalRequest(req) && !api.throughDoor?.(req)) {
+      // With a pod to sign in at, the owner does that instead of a password.
+      if (req.method === 'GET' && ownerWebId) return sendPodSigninPage(res, client, ownerWebId, api.mount || '');
       // No password set, and this request did not come from this machine.
       //
       // The instant-authorize path is honest theatre on loopback: whoever can
@@ -477,10 +532,9 @@ export async function handle(api, ctx) {
       // dispatched before that check ever runs, so it needs its own.
       api.log(`authorize refused: no UI password, and "${req.headers.host}" is not this machine`);
       return send(403, {
-        error: 'this agent answers on an address outside this machine and has no password set — '
-          + (api.embedded
-            ? 'POST {"password":"…"} to the owner door\'s /config with its door secret before logging in'
-            : 'run `fedipod passwd` before logging in over that address'),
+        error: api.embedded
+          ? 'Open your account\'s management page first, then sign in from there.'
+          : 'Signing in from another machine needs a password. On the machine that runs your account, run: fedipod passwd',
       });
     }
     // External clients get a bound code; the local flow keeps code==token.
@@ -493,6 +547,9 @@ export async function handle(api, ctx) {
     const target = new URL(redirect);
     target.searchParams.set('code', code);
     if (params.get('state')) target.searchParams.set('state', params.get('state'));
+    // A proved sign-in came from the page's own request, which cannot follow
+    // a redirect to a client's address; the page is told where to go.
+    if (proved) return send(200, { redirect: target.href });
     res.writeHead(302, { location: target.href });
     res.end();
     return true;

package/lib/client/masto/render.mjs

@@ -9,9 +9,25 @@ import { sanitizeHtml, followsNeedApproval, publicHandle } from '../../core/wire
 import { profileUrl, postUrl } from '../../connections/bskyfeed.mjs';
 import { htmlToText } from './body.mjs';
 
-// 1x1 transparent PNG — placeholder avatar/header for accounts without icons.
+// 1x1 transparent PNG — placeholder header, and the instance thumbnail. A
+// banner nobody set should take up no room and show nothing; an avatar is a
+// different matter (below).
 export const TRANSPARENT_PNG = 'data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mNkYPhfDwAChwGA60e6kgAAAABJRU5ErkJggg==';
 
+// The avatar for an account with no icon of its own: a head and shoulders on a
+// slate square, 64x64. It used to be the transparent pixel above, which is
+// correct JSON and invisible on screen — in Sengi's left bar the account button
+// (the one control that opens the account) rendered as an empty square, so
+// clicking it looked like nothing happening.
+//
+// A PNG rather than the SVG this was first written as, and not by preference:
+// Angular sanitizes every `<img src>` binding and trusts raster data URIs only,
+// because an SVG can carry script. An `svg+xml` one comes back out of it as
+// `unsafe:data:image/svg+xml` and draws nothing. Sengi is Angular.
+//
+// Redraw it with `node claude/scratch/make-default-avatar.mjs`.
+export const DEFAULT_AVATAR = 'data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAEAAAABACAYAAACqaXHeAAABd0lEQVR42u3ZoW4CQRDG8Xk6NBLbVCJ5gBpMTQ2iBlFR29RXNsFhz1JHXV9hydfkEkoobW5n2F34i0kIHMfN73ZvdwYbTabpmsMAAAAAAAAAAAAAAAAAAACiY3wzS/ePz+n1bZW6zTZ9fH59h17rPX2mYy4OQEktnl5+JP1b6Bgdey6IcIDb2Ty9r7s/Ez8MfUffbRpACfznrp8aDdEIFjnsh9z5YyMhcjqEAWge5ybfh87VFIDuWM7QPzYVokZBCICWM6/k+9A5mwHQmu4NoHM2A+A5/PenQTMA3sn3AQBTgIcgyyAbIbbCFEOUwzREaInRFKUtDgAAFQLcPSxDCqH9Z4V+o0oAXVhU4ofhiWCtJe+NYKV3e6V3idkAHvv9nDqhKIBnxVeqUrRaav5SvQKrqetTols0GGDdbaoB0LWcFUBP31qS72PoimCtD//caWC1tL1Ltc2ttbXfe08wCKC25HP+OgMAAAAAAAAAAAAAAAAArhNgB1PE/x/JOiuNAAAAAElFTkSuQmCC';
+
 const selfIcon = (api, self, cached) =>
   (self ? api.store.getConfig()?.icon : null) || cached.icon;
 
@@ -49,8 +65,8 @@ export function account(api, actorUrl, { selfAcct } = {}) {
     created_at: (self && api.store.getConfig()?.createdAt) || '2026-01-01T00:00:00.000Z',
     note: (self ? api.store.getConfig()?.summary : cached.summary) || '',
     url: actorUrl, uri: actorUrl,
-    avatar: selfIcon(api, self, cached) || TRANSPARENT_PNG,
-    avatar_static: selfIcon(api, self, cached) || TRANSPARENT_PNG,
+    avatar: selfIcon(api, self, cached) || DEFAULT_AVATAR,
+    avatar_static: selfIcon(api, self, cached) || DEFAULT_AVATAR,
     header: (self ? api.store.getConfig()?.image : null) || TRANSPARENT_PNG,
     header_static: (self ? api.store.getConfig()?.image : null) || TRANSPARENT_PNG,
     // A remote actor's counts are whatever its own collections said when we
@@ -217,7 +233,37 @@ export async function acctReply(api, send, body, parent, visibility) {
   } catch (e) { return send(422, { error: e.message }); }
 }
 
-export function status(api, s, { all } = {}) {
+// The post a status quotes, and how the quote stands: `pending` until the
+// quoted author allows it, `accepted` once they have, `rejected` if they
+// refused. The quoted post is shown whenever it is held — a reader wants to
+// see what was quoted, whatever the state says. One level deep: a quote
+// inside a quote is named by id, not rendered, so the shape stays finite.
+export function quoteJson(api, s, { all, depth = 0 } = {}) {
+  if (!s.quote) return null;
+  const state = s.quoteState || 'pending';
+  const quoted = state !== 'rejected' && (all || api.store.getStatuses()).find(x => x.noteId === s.quote);
+  if (depth > 0) return { state, quoted_status_id: quoted ? api.store.idFor(quoted.noteId) : null };
+  return { state, quoted_status: quoted ? api.status(quoted, { all, depth: depth + 1 }) : null };
+}
+
+// Who may quote a post, in the client's words, and what that means for this
+// account. Our own posts: anyone, when the world can read it; nobody
+// otherwise. Another's: whatever policy the post carried — `unknown` when it
+// carried none, which is what a client hides the quote button on.
+export function quoteApproval(api, s) {
+  if (s.actor === api.urls?.actor) {
+    const open = !s.visibility || s.visibility === 'public' || s.visibility === 'unlisted';
+    return { automatic: open ? ['public'] : [], manual: [], current_user: open ? 'automatic' : 'denied' };
+  }
+  const p = s.quotePolicy;
+  if (!p) return { automatic: [], manual: [], current_user: 'unknown' };
+  const follows = () => api.store.getContacts().following.some(f => f.actor === s.actor && f.accepted);
+  const may = (list) => list.includes('public') || (list.includes('followers') && follows());
+  const current = may(p.automatic) ? 'automatic' : may(p.manual) ? 'manual' : 'denied';
+  return { automatic: p.automatic, manual: p.manual, current_user: current };
+}
+
+export function status(api, s, { all, depth = 0 } = {}) {
   const replies = (all || api.store.getStatuses()).filter(x => x.inReplyTo === s.noteId).length;
   return {
     id: api.store.idFor(s.noteId),
@@ -258,6 +304,8 @@ export function status(api, s, { all } = {}) {
       shortcode: e.shortcode, url: e.url, static_url: e.url, visible_in_picker: false,
     })),
     card: null, poll: s.poll ? api.pollJson(s) : null,
+    quote: quoteJson(api, s, { all, depth }),
+    quote_approval: quoteApproval(api, s),
     // What a filter matched, if any. Mastodon's clients read this and do the
     // hiding or warning; they do NOT match keywords themselves — Phanpy does
     // not — so filters that were stored and served but never applied were a
@@ -346,6 +394,7 @@ export function pushNotify(api, n) {
     mention: 'mentioned you', favourite: 'favourited your post',
     reblog: 'boosted your post', follow: 'followed you',
     'follow-request': 'asked to follow you', move: 'moved account',
+    reaction: `reacted ${n.emoji || ''} to your post`, quote: 'quoted your post',
   };
   const s = n.noteId && api.store.getStatuses().find(x => x.noteId === n.noteId);
   return api.push.notify(n, {
@@ -419,10 +468,18 @@ export function relationship(api, actorUrl) {
 // and a client that does not know the type shows "Unknown notification type"
 // — which is what every Mastodon client did with a follow request here. The
 // stored spelling is left alone so existing state keeps reading.
-export function notificationType(api, t) { return t === 'follow-request' ? 'follow_request' : t; }
+// Mastodon's spellings for what is stored here. A reaction is what Pleroma's
+// API calls an emoji reaction, and what clients render as one.
+export function notificationType(api, t) {
+  return t === 'follow-request' ? 'follow_request' : t === 'reaction' ? 'emoji_reaction' : t;
+}
 
 export function notification(api, n) {
   const out = { id: n.id, type: api.notificationType(n.type), created_at: n.at, account: api.account(n.actor) };
+  if (n.type === 'reaction') {
+    out.emoji = n.emoji;
+    if (n.url) out.emoji_url = n.url;
+  }
   if (n.noteId) {
     const s = api.store.getStatuses().find(x => x.noteId === n.noteId);
     if (s) out.status = api.status(s);

package/lib/client/masto/statuses.mjs

@@ -42,10 +42,28 @@ export async function handle(api, ctx) {
     const media = api.store.getMedia();
     const attachments = mediaIds.map(id => media[id] && { id, ...media[id] }).filter(Boolean);
 
+    // A quote: the post named is one this account holds, and its author has
+    // said it may be quoted. The author's answer decides what the reader sees;
+    // the reasons a quote cannot even be asked for are the client's to show.
+    let quote = null;
+    if (body.quoted_status_id) {
+      const quotedUrl = api.store.urlFor(String(body.quoted_status_id));
+      const quoted = quotedUrl && api.store.getStatuses().find(x => x.noteId === quotedUrl);
+      if (!quoted) return send(404, { error: 'Record not found' });
+      if (['bsky', 'acct'].includes(quoted.kind)) return send(422, { error: 'that post cannot be quoted from this account' });
+      if (visibility === 'private' || visibility === 'direct') return send(422, { error: 'a quote post is public or unlisted' });
+      const may = api.quoteApproval(quoted).current_user;
+      if (may === 'denied') return send(422, { error: 'the author of that post does not allow quotes' });
+      if (may === 'unknown') return send(422, { error: 'the author of that post has not said whether it may be quoted' });
+      if (body.scheduled_at) return send(422, { error: 'a quote cannot be scheduled' });
+      quote = { id: quoted.noteId, actor: quoted.actor };
+    }
+
     const asking = pollParams(body);
     if (asking) {
       // Mastodon's own rules, stated here rather than discovered inside the
       // publisher, so a client gets the reason back on the request it made.
+      if (quote) return send(422, { error: 'a poll cannot quote a post' });
       if (attachments.length) return send(422, { error: 'a poll cannot carry media' });
       if (body.scheduled_at) return send(422, { error: 'a poll cannot be scheduled' });
       if (asking.options.length < 2) return send(422, { error: 'a poll needs at least two options' });
@@ -99,7 +117,7 @@ export async function handle(api, ctx) {
     let note;
     try {
       note = await api.agent.publisher.publishNote(body.status,
-        { inReplyTo, attachments, visibility, spoilerText, sensitive });
+        { inReplyTo, attachments, visibility, spoilerText, sensitive, quote });
     } catch (e) {
       // A direct message nobody could be found for: the sender's mistake to
       // fix, said in the client, not a fault of the server.
@@ -110,6 +128,12 @@ export async function handle(api, ctx) {
     return send(200, api.status(s));
   }
 
+  // Who may quote a post is the same for every post here — anyone, when the
+  // world can read it — and is not set per post.
+  if (/^\/api\/v1\/statuses\/[a-f0-9]+\/interaction_policy$/.test(pathname) && req.method === 'PUT') {
+    return send(422, { error: 'the quote policy is the same for every post here: anyone may quote a public or unlisted post, nobody a followers-only or direct one' });
+  }
+
   // The composer reads the raw text back before an edit.
   const mSource = /^\/api\/v1\/statuses\/([a-f0-9]+)\/source$/.exec(pathname);
   if (mSource && req.method === 'GET') {