fedipod-server 0.21.0 → 0.28.0

package/lib/gateway/front-core.mjs

@@ -21,19 +21,29 @@ import { readCapped, safeFetch, isLoopbackHost } from '../shared/safefetch.mjs';
 import * as podRoot from '../pod/root.mjs';
 import * as podPolicy from '../pod/policy.mjs';
 import { podBaseOfWebId } from '../pod/urls.mjs';
+import { routeQuietApi, noteOpened, noteReceived, closedState, accountState, closedAnswer } from './quiet.mjs';
+import { routeNoticesApi } from './notices.mjs';
 
 // The one WebFinger document, spelled out here rather than imported from
 // wire.mjs: wire drags the agent's whole HTML pipeline (sanitize-html and
 // friends), which a serverless front must never carry — it crashed the
 // deployed function before it answered its first request.
-const jrd = ({ handle, host, actor, aliases = [], page = null }) => ({
+const jrd = ({ handle, host, actor, aliases = [], page = null, subscribe = null }) => ({
   subject: `acct:${handle}@${host}`,
   ...(aliases.length ? { aliases } : {}),
   links: [
     { rel: 'self', type: 'application/activity+json', href: actor },
     ...(page ? [{ rel: 'http://webfinger.net/rel/profile-page', type: 'text/html', href: page }] : []),
+    // Remote follow. Somebody reading this account on another server presses
+    // Follow, says they are here, and that server looks for this link to find
+    // out where to send them. `{uri}` is a literal the other server fills in
+    // with whatever they are following — it must not be escaped.
+    ...(subscribe ? [{ rel: 'http://ostatus.org/schema/1.0/subscribe', template: subscribe }] : []),
   ],
 });
+// The door that link names, which the site staged beside this function serves.
+const subscribeTemplate = (origin) => (origin
+  ? `${String(origin).replace(/\/$/u, '')}/authorize_interaction?uri={uri}` : null);
 // The public profile page of any account the front answers for lives on
 // its pod, whether the address is the front's or the pod's own.
 const profilePageOf = (rec) => (rec?.podHome ? rec.podHome + 'ap/profile.html' : null);
@@ -136,10 +146,25 @@ const RELAY_MAX_BODY = 1024 * 1024;
 const RELAY_TIMEOUT_MS = 8_000;
 // The only headers a relayed request may carry to the remote server. Host
 // comes from the URL; the user agent from safeFetch.
+const SERVER_PROBE_MS = 6000;
+const SERVER_PROBE_BYTES = 64 * 1024;
 const RELAY_HEADERS = new Set(['date', 'digest', 'signature', 'content-type', 'accept']);
 
 const keyIdOf = (signature) => (/keyId="([^"]+)"/.exec(signature || '') || [])[1] || null;
 
+// The owner's APIs a browser at ANOTHER origin may call: an address moving
+// to a new gateway is driven from the new gateway's page, and it has to tell
+// this one it moved and send the Move through this one's relay. Both take a
+// pod token as proof, the way the outbox door does, so any origin may ask.
+const API_CORS = {
+  'access-control-allow-origin': '*',
+  'access-control-allow-methods': 'POST, OPTIONS',
+  'access-control-allow-headers': 'Authorization, DPoP, Content-Type',
+  'access-control-max-age': '86400',
+};
+const withApiCors = (out) => ({ ...out, headers: { ...(out.headers || {}), ...API_CORS } });
+const apiPreflight = () => ({ status: 204, headers: { ...API_CORS, allow: 'POST, OPTIONS' }, body: null });
+
 async function relayOne(item, rec, fetchImpl) {
   const url = String(item?.url || '');
   const method = String(item?.method || 'POST').toUpperCase();
@@ -203,9 +228,57 @@ function parseUserPath(pathname) {
   return m ? { handle: decodeURIComponent(m[1]), rest: m[2] } : null;
 }
 
+// A public document is the same for everybody who asks, so the edge may hold
+// it and answer the next reader itself. Without this every read of an actor,
+// a topic, a post or a card was a function call: one visit to a forum is
+// twenty of them, and every visitor and every refresh paid again.
+//
+// `netlify-cdn-cache-control` is the edge's own instruction; `cache-control`
+// is what the reader's browser is told. The edge may serve a stale copy while
+// it fetches a fresh one, so nobody waits on the pod for a document that is
+// merely minutes old. The edge holds a document far longer than a browser
+// is asked to: the edge is what turns a thousand readers into one function
+// call, while a browser that held an actor for ten minutes would show one
+// person a stale profile they had just edited.
+const BROWSER_MAX_AGE = 60;
+const publicFor = (seconds, stale = seconds * 4) => ({
+  'cache-control': `public, max-age=${Math.min(seconds, BROWSER_MAX_AGE)}`,
+  'netlify-cdn-cache-control': `public, s-maxage=${seconds}, stale-while-revalidate=${stale}`,
+});
+// How long the edge holds a public document, and a handle's WebFinger
+// answer. Every server that has heard of an account asks for its actor and
+// its handle again and again; a post or a collection changes when its owner
+// acts, and ten minutes of edge is what the plan's budget of function calls
+// can afford.
+const PUBLIC_EDGE_SECONDS = 600;
+const WEBFINGER_EDGE_SECONDS = 3600;
+
+// Where a pod owner opts their identity in. An operator may name it, because
+// the path it takes is one their pod server can no longer serve; the dot says
+// it belongs to the server rather than to anybody's data, the way
+// `.well-known` and `.account` do.
+export const DEFAULT_RUN_PATH = '/.fediverse-account';
+export const runPath = (ctx) => {
+  const said = String(ctx?.runPath || '').trim().replace(/\/+$/u, '');
+  if (!said) return DEFAULT_RUN_PATH;
+  return said.startsWith('/') ? said : `/${said}`;
+};
+
+// A request the browser itself says came from this very origin. `Sec-Fetch-Site`
+// is the browser's word and a page cannot forge it; an `Origin` that matches is
+// the older way of saying the same. This is what makes it safe to read a
+// session cookie as proof: a page on another site gets neither.
+const sameOriginRequest = (request, origin) => {
+  const site = request.headers.get('sec-fetch-site');
+  if (site) return site === 'same-origin';
+  const said = request.headers.get('origin');
+  if (!said || !origin) return false;
+  try { return new URL(said).origin === new URL(origin).origin; } catch { return false; }
+};
+
 // Top-level paths a handle may not take, so a name never shadows a route.
 const RESERVED = new Set(['u', 'api', 'signup', 'new-account', 'run', 'admin', 'roster', 'gateway',
-  'gw', 'well-known', 'inbox', 'outbox', 'actor', 'install']);
+  'gw', 'well-known', 'inbox', 'outbox', 'actor', 'install', 'notices']);
 
 // Why a handle is unusable, or null when it is fine. Lowercase letters, digits
 // and hyphens; 2–30 chars; not edge-hyphenated; not a reserved route.
@@ -240,7 +313,9 @@ const policyFor = (rec, fetchImpl = fetch) =>
 // `policy` is the person's published filtering policy when there is one.
 function identFor(rec, policy = null) {
   return {
-    inboxUrl: rec.podHome + 'ap/inbox/',
+    // A row may name the inbox its deliveries are written to: a forum's
+    // categories share one, on the forum's pod, above their own trees.
+    inboxUrl: rec.inboxUrl || rec.podHome + 'ap/inbox/',
     actorUrl: rec.actorUrl,                 // the FRONT actor id (what mail is addressed to)
     followersUrl: rec.actorUrl.replace(/actor$/, 'followers'),
     notesPrefix: rec.actorUrl.replace(/ap\/actor$/, 'ap/notes/'),
@@ -259,6 +334,7 @@ function identFor(rec, policy = null) {
 //   listDirectory() -> { handle: record }  every row, for the admin roster
 //   removeDirectory(handle) -> boolean     drop a row; false when a seeded row remains
 //   podPut(url, body, ct) -> boolean      append to a user's pod (per-user cred inside)
+//   readReceived / writeReceived / dropReceived, pauseItems, closeDays — see quiet.mjs
 //   podGet(url, { podHome }) -> Response   read a user's pod (public reads; plain fetch
 //                                          is fine). `podHome` is the row's own pod, for
 //                                          an adapter that reads a store directly and so
@@ -330,20 +406,19 @@ async function route(request, ctx) {
   // The run page: a pod owner opting their identity in or out of being run by
   // this server. Meaningful only on a host that embeds the agent; a host that
   // does not simply supplies no page.
-  if (pathname === '/run') {
+  if (pathname === runPath(ctx)) {
     if (request.method !== 'GET' && request.method !== 'HEAD') return { status: 405, headers: {}, body: '' };
     if (!ctx.runPage) return notFound();
-    return { status: 200, headers: { 'content-type': 'text/html; charset=utf-8' }, body: ctx.runPage };
+    return { status: 200, headers: { 'content-type': 'text/html; charset=utf-8', 'cache-control': 'no-cache' }, body: ctx.runPage };
   }
 
-  // The roster page: the host reading who has accounts here. The page signs in
-  // and calls the roster API below; a deploy with no admin supplies no page.
-  // Off /admin, which is the owner's own record page on every agent.
-  if (pathname === '/roster') {
-    if (request.method !== 'GET' && request.method !== 'HEAD') return { status: 405, headers: {}, body: '' };
-    if (!ctx.adminPage) return notFound();
-    return { status: 200, headers: { 'content-type': 'text/html; charset=utf-8' }, body: ctx.adminPage };
-  }
+  // The roster page (/roster, off /admin, which is the owner's own record
+  // page on every agent) is served with the notices page, in notices.mjs.
+
+  // Notices from the operator to every account here, and the page they are
+  // written on (notices.mjs).
+  const notices = await routeNoticesApi(request, pathname, ctx, { j, verifyPodToken, publicFor, notFound });
+  if (notices) return notices;
 
   // The roster: every directory row, secrets stripped, for the host's own
   // eyes. The reader proves themself the way attach proves a pod — a
@@ -359,6 +434,7 @@ async function route(request, ctx) {
         handle: r.handle, kind: r.kind || 'person', fronted: !r.inboxOnly,
         podHome: r.podHome, webId: r.webId || null, actorUrl: r.actorUrl,
         address: r.address || `@${r.handle}@${ctx.host}`,
+        openedAt: r.openedAt || null, pausedAt: r.pausedAt || null, closedAt: r.closedAt || null,
       }))
       .sort((a, b) => (a.address || a.handle).localeCompare(b.address || b.handle));
     return j(200, { host: ctx.host, accounts });
@@ -398,6 +474,48 @@ async function route(request, ctx) {
       offersPods: !!ctx.offersPods, version: ctx.version || null });
   }
 
+  // What a reader's own server speaks, asked here rather than in their
+  // browser: a page cannot probe a stranger's server (no CORS), and the
+  // answer decides how that reader takes part in a forum.
+  if (pathname === '/api/server') {
+    const host = (url.searchParams.get('host') || '').trim().toLowerCase();
+    const open = { 'access-control-allow-origin': '*' };
+    const said = (kind, extra = {}) => ({ ...j(200, { host, kind, ...extra }), headers: { ...j(200, {}).headers, ...open } });
+    // An address at this front is a FediPod account: its client is the
+    // browser here, and no other server holds it. Asked before the shape of
+    // the host, since a front may answer at a name with no dot in it.
+    if (host && host === String(ctx.host || '').toLowerCase()) {
+      const handle = (url.searchParams.get('handle') || '').toLowerCase();
+      const rec = handle ? await ctx.lookup(handle) : null;
+      if (!rec) return said('fedipod');
+      // Where the owner of this pod signs in: the pod says so itself, at the
+      // well-known document every Solid server answers (or redirects to).
+      let issuer = null;
+      try {
+        const res = await safeFetch(new URL('/.well-known/openid-configuration', rec.podHome).href,
+          { headers: { accept: 'application/json' }, redirect: 'follow', signal: AbortSignal.timeout(SERVER_PROBE_MS) },
+          ctx.fetchImpl || fetch);
+        if (res.ok) issuer = JSON.parse(await readCapped(res, SERVER_PROBE_BYTES)).issuer || null;
+      } catch { /* a pod that will not say leaves the reader to type it */ }
+      return said('fedipod', { podHome: rec.podHome, actor: rec.actorUrl, issuer, inbox: identFor(rec).inboxUrl });
+    }
+    if (!/^[a-z0-9.-]+\.[a-z0-9-]+(:\d+)?$/u.test(host)) return said('invalid');
+    const f = ctx.fetchImpl || fetch;
+    const ask = async (path) => {
+      try {
+        const res = await safeFetch(`https://${host}${path}`,
+          { headers: { accept: 'application/json' }, signal: AbortSignal.timeout(SERVER_PROBE_MS) }, f);
+        if (!res.ok) return null;
+        return JSON.parse(await readCapped(res, SERVER_PROBE_BYTES));
+      } catch { return null; }
+    };
+    const masto = await ask('/api/v1/instance');
+    if (masto) return said('mastodon-api', { name: masto.title || masto.domain || host });
+    const lemmy = await ask('/api/v3/site');
+    if (lemmy) return said('lemmy', { name: lemmy.site_view?.site?.name || host });
+    return said('unknown');
+  }
+
   // Attach: create the account. The user proves control of the pod they claim
   // by presenting a Solid-OIDC token whose WebID lives on that pod — no
   // password reaches the front. On success the directory gets a row and the
@@ -463,10 +581,20 @@ async function route(request, ctx) {
     const claimedActor = typeof body.actorUrl === 'string' && body.actorUrl.startsWith(podHome) ? body.actorUrl : null;
     const actorUrl = fronted ? `${userBase(ctx.frontOrigin, key)}ap/actor` : (claimedActor || podHome + 'ap/actor');
     const hmacSecret = prior?.hmacSecret || crypto.randomBytes(32).toString('base64');
+    // Where the door writes: the row's own tree unless the caller names an
+    // inbox on the same pod — a forum's categories name the forum's.
+    let inboxUrl = null;
+    if (typeof body.inboxUrl === 'string' && body.inboxUrl) {
+      let ok = false;
+      try { ok = new URL(body.inboxUrl).origin === new URL(podHome).origin && body.inboxUrl.endsWith('/'); } catch { ok = false; }
+      if (!ok) return j(400, { error: 'inboxUrl must be a container on the same pod' });
+      inboxUrl = body.inboxUrl;
+    }
     const record = {
       handle, address, podHome, webId: webid, actorUrl,
-      kind: body.kind === 'group' ? 'group' : 'person',
+      kind: body.kind === 'group' ? 'group' : body.kind === 'application' ? 'application' : 'person',
       gatewayWebId: ctx.gatewayWebId || null, hmacSecret,
+      ...(inboxUrl ? { inboxUrl } : {}),
       ...(fronted ? {} : { inboxOnly: true }),
     };
     await ctx.putDirectory(key, record);
@@ -481,6 +609,43 @@ async function route(request, ctx) {
       command: `fedipod gateway ${doorInbox} --secret ${hmacSecret} --inbox-only` });
   }
 
+  // An address at this gateway moving to another one. Its owner, proved the
+  // way attach proves a pod, says where it went. From then on this front
+  // answers the old actor as a moved stub — the same key under the old id,
+  // `movedTo` the new one, so the Move the owner sends from the old address
+  // verifies — every other old id redirects to its new address, and the
+  // mail door is shut: deliveries belong at the new one. Repeating it with
+  // the same target changes nothing.
+  if (pathname === '/api/move' && request.method === 'OPTIONS') return apiPreflight();
+  if (pathname === '/api/move' && request.method === 'POST') {
+    if (!ctx.putDirectory) return withApiCors(j(501, { error: 'this front keeps no directory' }));
+    let body;
+    try { body = JSON.parse(await request.clone().text()); } catch { return withApiCors(j(400, { error: 'bad JSON' })); }
+    const handle = String(body.handle || '').toLowerCase();
+    const rec = await ctx.lookup(handle);
+    if (!rec) return withApiCors(j(404, { error: 'no such account' }));
+    if (rec.inboxOnly) return withApiCors(j(400, { error: 'this address lives on its pod; only an address at this gateway can move' }));
+    const movedTo = String(body.movedTo || '');
+    let mu;
+    try { mu = new URL(movedTo); } catch { return withApiCors(j(400, { error: 'movedTo must be the new actor URL' })); }
+    if (!((mu.protocol === 'https:' || (mu.protocol === 'http:' && isLoopbackHost(mu.hostname))) && /\/ap\/actor$/u.test(mu.pathname))) {
+      return withApiCors(j(400, { error: 'movedTo must be an https …/ap/actor URL' }));
+    }
+    if (ctx.frontOrigin && mu.origin === new URL(ctx.frontOrigin).origin) return withApiCors(j(400, { error: 'that address is at this gateway' }));
+    const webid = await verifyPodToken(request, pathname, ctx.verifier);
+    if (!webid) return withApiCors(j(401, { error: 'a Solid-OIDC token proving the pod is required' }));
+    const owner = rec.webId ? webid === rec.webId : webidUnderPod(webid, rec.podHome);
+    if (!owner) return withApiCors(j(403, { error: "the token proves a different pod than this account's" }));
+    const movedAt = rec.movedTo === movedTo && rec.movedAt ? rec.movedAt : new Date().toISOString();
+    await ctx.putDirectory(handle, { ...rec, movedTo, movedAt });
+    console.log(`front @${handle}: moved to ${movedTo}`);
+    return withApiCors(j(200, { ok: true, handle, movedTo, movedAt }));
+  }
+
+  // The owner's say over an account that goes quiet (quiet.mjs).
+  const quiet = await routeQuietApi(request, pathname, ctx, { j, verifyPodToken, webidUnderPod });
+  if (quiet) return quiet;
+
   // The relay: the front sends requests a browser has already signed. A page
   // may not set the Date or Host header, and both are inside an HTTP
   // signature, so a browser-run agent signs and hands the request here; the
@@ -488,24 +653,49 @@ async function route(request, ctx) {
   // a signature and cannot make one. Only the account's own key may sign,
   // only the account's own pod may call, and nothing unsigned-for reaches
   // the remote server.
+  if (pathname === '/api/relay' && request.method === 'OPTIONS') return apiPreflight();
   if (pathname === '/api/relay' && request.method === 'POST') {
     let body;
-    try { body = JSON.parse(await request.clone().text()); } catch { return j(400, { error: 'bad JSON' }); }
+    try { body = JSON.parse(await request.clone().text()); } catch { return withApiCors(j(400, { error: 'bad JSON' })); }
     const handle = String(body.handle || '').toLowerCase();
     const rec = await ctx.lookup(handle);
-    if (!rec) { console.log(`relay: no account named ${handle}`); return j(404, { error: 'no such account' }); }
+    if (!rec) { console.log(`relay: no account named ${handle}`); return withApiCors(j(404, { error: 'no such account' })); }
     const webid = await verifyPodToken(request, pathname, ctx.verifier);
-    if (!webid) { console.log(`relay @${handle}: no usable pod token`); return j(401, { error: 'a Solid-OIDC token proving the pod is required' }); }
+    if (!webid) { console.log(`relay @${handle}: no usable pod token`); return withApiCors(j(401, { error: 'a Solid-OIDC token proving the pod is required' })); }
     const owner = rec.webId ? webid === rec.webId : webidUnderPod(webid, rec.podHome);
-    if (!owner) { console.log(`relay @${handle}: token is for ${webid}, not this account's pod`); return j(403, { error: "the token proves a different pod than this account's" }); }
+    if (!owner) { console.log(`relay @${handle}: token is for ${webid}, not this account's pod`); return withApiCors(j(403, { error: "the token proves a different pod than this account's" })); }
     const items = Array.isArray(body.requests) ? body.requests : [];
-    if (!items.length) return j(400, { error: 'requests must be a non-empty list' });
-    if (items.length > RELAY_MAX_REQUESTS) return j(400, { error: `at most ${RELAY_MAX_REQUESTS} requests per call` });
+    if (!items.length) return withApiCors(j(400, { error: 'requests must be a non-empty list' }));
+    // Acting through the relay is being here. Hourly at most; see noteOpened.
+    await noteOpened(ctx, handle, rec).catch((e) => console.log(`relay @${handle}: stamp not written: ${e?.message || e}`));
+    if (items.length > RELAY_MAX_REQUESTS) return withApiCors(j(400, { error: `at most ${RELAY_MAX_REQUESTS} requests per call` }));
     const results = await Promise.all(items.map((it) => relayOne(it, rec, ctx.fetchImpl || fetch)));
     // One line per relayed request, so a lookup that fails on the far side is
     // visible here and not only as an empty result in someone's browser.
     for (const r of results) console.log(`relay @${handle}: ${r.method || ''} ${r.url} → ${r.status}${r.error ? ` (${r.error})` : ''}`);
-    return j(200, { results });
+    return withApiCors(j(200, { results }));
+  }
+
+  // Who is here, and which pod of theirs could opt in. The opt-in page asks
+  // this first: on a pod server that issued the reader's session, the answer
+  // names their pod and its address, and the page shows one button instead of
+  // a form. A Gateway holds no such session and says so; the page then asks
+  // for the pod by hand and proves it with a sign-in, as before.
+  if (pathname === '/api/agent' && request.method === 'GET') {
+    if (!ctx.agentControl) return j(501, { error: 'this server does not run identities' });
+    if (!ctx.webIdsFromSession) return j(200, { offered: true, session: 'unknown' });
+    if (!sameOriginRequest(request, ctx.frontOrigin)) return j(200, { offered: true, session: 'none' });
+    const webIds = await ctx.webIdsFromSession(request).catch(() => []);
+    if (!webIds.length) return j(200, { offered: true, session: 'none', loginUrl: '/.account/login/password/' });
+    const pods = [];
+    for (const webId of webIds) {
+      let podBase;
+      try { podBase = podBaseOfWebId(webId); } catch { continue; }
+      let about = null;
+      try { about = ctx.agentControl.describe ? await ctx.agentControl.describe({ podBase }) : null; } catch { about = null; }
+      pods.push({ webId, podBase, ...(about || {}) });
+    }
+    return j(200, { offered: true, session: 'ok', pods });
   }
 
   // Runtime opt-in: a pod owner asks the server this front sits on to RUN
@@ -540,15 +730,27 @@ async function route(request, ctx) {
     if (/(^|\/)\.internal(\/|$)/u.test(podUrl.pathname) || /(^|\/)\.\.(\/|$)/u.test(podUrl.pathname)) {
       return j(403, { error: 'that is not a pod address' });
     }
-    const webid = await verifyPodToken(request, pathname, ctx.verifier);
-    if (!webid) return j(401, { error: 'a Solid-OIDC token proving the pod is required' });
     // The pod's own server names its owner when it can, and where it does that
     // is the proof. Where it does not, the WebID must live in EXACTLY this pod
     // — its own pod base equal to podBase, not merely starting with it, which on
     // a path server an ancestor of another's pod would.
     const owners = await podOwners(podBase, ctx.fetchImpl || fetch);
-    const proven = owners.length ? owners.includes(webid) : podBaseOfWebId(webid) === podBase;
-    if (!proven) {
+    const ownsIt = (who) => (owners.length ? owners.includes(who) : podBaseOfWebId(who) === podBase);
+    const token = await verifyPodToken(request, pathname, ctx.verifier);
+    // A server that issued the reader's own session can simply read it. On a
+    // pod server the page, the session and the pod are one origin, and a token
+    // proves nothing the session does not — so opting in cost a round trip to
+    // an identity provider that had just said who they were. A Gateway fronting
+    // somebody else's pod holds no such session and this does nothing there.
+    //
+    // One account can hold several WebIDs, so it is the one that owns this pod
+    // that is taken, not whichever came back first.
+    const session = !token && ctx.webIdsFromSession && sameOriginRequest(request, ctx.frontOrigin)
+      ? (await ctx.webIdsFromSession(request).catch(() => [])).find(ownsIt) || null
+      : null;
+    const webid = token || session;
+    if (!webid) return j(401, { error: 'a Solid-OIDC token proving the pod is required' });
+    if (!ownsIt(webid)) {
       return j(403, { error: 'the token proves a different pod than the one you listed' });
     }
     if (action === 'opt-in') {
@@ -574,14 +776,16 @@ async function route(request, ctx) {
   //
   // The name is matched against a literal list, so nothing about the request
   // chooses a file.
-  const mPageScript = /^\/(new-account|run|admin)\.js$/u.exec(pathname);
+  const mPageScript = /^\/(new-account|run|admin|notices)\.js$/u.exec(pathname);
   if (mPageScript) {
     const body = ctx.pageScripts?.[`${mPageScript[1]}.js`];
     if (!body) return notFound();
-    return { status: 200, headers: { 'content-type': 'text/javascript; charset=utf-8' }, body };
+    // Revalidated on every load: a page served fresh with a script the
+    // browser kept from last time is the mismatch nobody can see.
+    return { status: 200, headers: { 'content-type': 'text/javascript; charset=utf-8', 'cache-control': 'no-cache' }, body };
   }
 
-  // The vendored Solid-OIDC browser library the /run and /admin pages load —
+  // The vendored Solid-OIDC browser library the opt-in and admin pages load —
   // served here because this function owns every path on the domain.
   if (pathname === '/solid-oidc-client.js') {
     if (!ctx.authBundle) return notFound();
@@ -602,14 +806,22 @@ async function route(request, ctx) {
     if (!m || m[2] !== ctx.host) return notFound();
     const rec = await ctx.lookup(m[1]);
     if (!rec) return notFound();
+    // A closed address is gone, and says so rather than pretending never to
+    // have existed: the name stays taken.
+    if ((await closedState(ctx, m[1], rec)).closed) return closedAnswer({ 'access-control-allow-origin': '*' });
     // A fronted identity's documents live on its pod; the pod's own actor id
     // is the alias, so a client signing in by the fronted address can find
     // the pod (and its login) without a lookup only the host could answer.
     const podActor = rec.inboxOnly ? [] : [rec.podHome + 'ap/actor'];
-    const out = j(200, jrd({ handle: m[1], host: ctx.host, actor: rec.actorUrl, aliases: podActor, page: profilePageOf(rec) }),
-      'application/jrd+json');
+    const out = j(200, jrd({ handle: m[1], host: ctx.host, actor: rec.actorUrl, aliases: podActor,
+      page: profilePageOf(rec), subscribe: subscribeTemplate(ctx.frontOrigin) }),
+    'application/jrd+json');
     // RFC 7033: a JRD is read from any origin.
     out.headers['access-control-allow-origin'] = '*';
+    // A handle answers the same for everybody, and changes only when a row
+    // does. Every server that has heard of this account asks for it; the edge
+    // can answer most of them.
+    Object.assign(out.headers, publicFor(WEBFINGER_EDGE_SECONDS));
     return out;
   }
 
@@ -634,16 +846,28 @@ async function route(request, ctx) {
   const rec = await ctx.lookup(up.handle);
   if (!rec) return notFound();
   const base = userBase(ctx.frontOrigin, up.handle);
+  // An account that moved to another gateway (see /api/move): where its ids
+  // live now. The actor below answers as a stub; everything else redirects.
+  const movedBase = rec.movedTo ? rec.movedTo.replace(/ap\/actor$/u, '') : null;
+  // A closed address (see "accounts that go quiet" above): every id under it
+  // is gone. Asked after moved, which a close does not undo.
+  const closed = movedBase ? false : (await closedState(ctx, up.handle, rec)).closed;
+  const gone = (headers = {}, why = `this account has moved to ${rec.movedTo}`) => closedAnswer(headers, why);
+  const CLOSED = 'this address is closed';
 
   // Inbox: verify at the door, forward to the user's pod inbox. This is the
   // gateway, per user.
   if (up.rest === 'ap/inbox/' || up.rest === 'ap/inbox') {
     if (request.method !== 'POST') return { status: 405, headers: {}, body: '' };
+    if (movedBase) { console.log(`door @${up.handle}: delivery → 410 (moved)`); return gone(); }
+    if (closed) { console.log(`door @${up.handle}: delivery → 410 (closed)`); return gone({}, CLOSED); }
     const policy = await policyFor(rec, ctx.fetchImpl || fetch);
-    const { status, reason } = await handleDelivery(request, identFor(rec, policy),
-      { podPut: (u, b, ct) => ctx.podPut(up.handle, u, b, ct), fetchImpl: ctx.fetchImpl });
+    const standing = await accountState(ctx, up.handle, rec);
+    const { status, reason, content, bytes } = await handleDelivery(request, identFor(rec, policy),
+      { podPut: (u, b, ct) => ctx.podPut(up.handle, u, b, ct), fetchImpl: ctx.fetchImpl, paused: standing.paused });
     // One line per delivery, so "did it arrive at the door" has an answer.
     console.log(`door @${up.handle}: delivery → ${status} (${reason})`);
+    if (status === 202 && content) await noteReceived(ctx, up.handle, rec, bytes);
     return { status, headers: {}, body: '' };
   }
 
@@ -669,6 +893,11 @@ async function route(request, ctx) {
       return { status: 204, headers: { ...cors, allow: 'GET, POST, OPTIONS',
         'accept-post': 'application/ld+json, application/activity+json' }, body: null };
     }
+    if (movedBase && request.method === 'POST') return gone(cors);
+    if (closed && request.method === 'POST') return gone(cors, CLOSED);
+    if (movedBase && (request.method === 'GET' || request.method === 'HEAD')) {
+      return { status: 301, headers: { ...cors, location: movedBase + up.rest, 'cache-control': 'no-store' }, body: '' };
+    }
     if (request.method === 'POST') {
       const json = (status, obj, extra = {}) => ({ status,
         headers: { ...cors, 'content-type': 'application/json', 'cache-control': 'no-store', ...extra },
@@ -692,7 +921,21 @@ async function route(request, ctx) {
   // Everything else is a public GET, served by reading the user's pod and
   // rewriting pod ids to the front. The actor also gets its handle and inbox
   // fixed to the front so a consumer cross-checks it consistently.
+  // Public documents are read from any origin — a page on another site, the
+  // forum's own host among them — the way a pod serves them, so the read
+  // carries the open origin and a preflight is answered.
+  const open = { 'access-control-allow-origin': '*' };
+  if (request.method === 'OPTIONS') {
+    return { status: 204, headers: { ...open, 'access-control-allow-methods': 'GET, HEAD, OPTIONS',
+      'access-control-allow-headers': 'Accept', 'access-control-max-age': '86400', allow: 'GET, HEAD, OPTIONS' }, body: null };
+  }
   if (request.method !== 'GET' && request.method !== 'HEAD') return { status: 405, headers: {}, body: '' };
+  // Moved: every old id but the actor's answers with where it is now, so a
+  // reply or a boost another server still holds under the old id resolves.
+  if (movedBase && up.rest !== 'ap/actor') {
+    return { status: 301, headers: { ...open, location: movedBase + up.rest, 'cache-control': 'no-store' }, body: '' };
+  }
+  if (closed) return gone(open, CLOSED);
   const podTarget = rec.podHome + up.rest;
   // Media stays on the pod (lib/pod/urls.mjs keeps `media` off the front), but
   // the id rewrite below turns media links onto the front like every other
@@ -705,22 +948,50 @@ async function route(request, ctx) {
   // directly (the CSS server component) has no access control of its own and
   // needs to be told what it may reach. See podHomeProblem above for the other
   // half — a row that names something which is not a pod.
+  // A container is Turtle, a profile page is HTML, everything else here is
+  // ActivityPub. Ask for what the thing can be, not for what most of them are.
+  const container = podTarget.endsWith('/');
+  const page = /\.html?$/u.test(podTarget);
+  const accept = container ? 'text/turtle, */*;q=0.8'
+    : page ? 'text/html, */*;q=0.8'
+      : AP_CT;
   const got = await podRoot.readPublicDocument(
-    ctx.podGet || ((u) => fetch(u, { headers: { accept: AP_CT } })),
-    podTarget, { podHome: rec.podHome });
-  if (got.text === null) return { status: got.status, headers: {}, body: '' };
+    ctx.podGet || ((u) => fetch(u, { headers: { accept } })),
+    podTarget, { podHome: rec.podHome, accept });
+  if (got.text === null) return { status: got.status, headers: open, body: '' };
   let text = got.text;
   text = swap(text, rec.podHome, base);
+  // The moved stub: the pod's actor now carries the NEW gateway's ids, and a
+  // server verifying the Move fetches the OLD id and needs a document whose
+  // id is that old id — with the same key under it, and `movedTo` saying
+  // where the account went. Swapping the new base back to this one gives
+  // exactly that; alsoKnownAs and movedTo are set below.
+  if (movedBase) text = swap(text, movedBase, base);
   if (up.rest === 'ap/actor') {
     try {
       const doc = JSON.parse(text);
       doc.preferredUsername = up.handle;               // so @handle@front cross-checks
       doc.inbox = base + 'ap/inbox/';                  // deliveries come to the front to be verified
       doc.endpoints = { ...(doc.endpoints || {}), sharedInbox: base + 'ap/inbox/' };
+      if (movedBase) {
+        doc.movedTo = rec.movedTo;
+        const aka = new Set([].concat(doc.alsoKnownAs || []).filter((a) => typeof a === 'string' && a !== doc.id));
+        aka.add(rec.movedTo);
+        doc.alsoKnownAs = [...aka];
+        const ctxs = [].concat(doc['@context'] || []);
+        const declared = (term) => ctxs.some((c) => c && typeof c === 'object' && term in c);
+        if (!declared('alsoKnownAs')) ctxs.push({ alsoKnownAs: { '@id': 'as:alsoKnownAs', '@type': '@id' } });
+        if (!declared('movedTo')) ctxs.push({ movedTo: { '@id': 'as:movedTo', '@type': '@id' } });
+        doc['@context'] = ctxs;
+      }
       text = JSON.stringify(doc);
     } catch { /* leave the rewritten text as-is if it will not parse */ }
   }
-  return { status: 200, headers: { 'content-type': AP_CT, 'cache-control': 'no-store' }, body: text };
+  // `readPublicDocument` asked for it with no credential, so a document that
+  // came back is one anybody can read — which is what makes it cacheable.
+  return { status: 200,
+    headers: { ...open, 'content-type': got.type || (container ? 'text/turtle' : page ? 'text/html' : AP_CT), ...publicFor(PUBLIC_EDGE_SECONDS) },
+    body: text };
 }
 
 export const _internal = { parseUserPath, identFor, swap, handleProblem, policyFor, policyCache };

package/lib/gateway/gateway-core.mjs

@@ -19,9 +19,11 @@ import * as inbox from '../pod/inbox.mjs';
 const DEFAULT_MAX_BYTES = 512 * 1024;   // mirror intake.mjs MAX_ITEM_BYTES
 
 // Control activities are the message itself and must always pass — you want
-// Follows from strangers. Only CONTENT is subject to the concerns-us drop.
-const CONTROL = new Set(['Follow', 'Undo', 'Accept', 'Reject', 'Delete', 'Move',
+// Follows from strangers. Only CONTENT is subject to the concerns-us drop,
+// and to a pause: an account nobody is reading still takes its follows.
+export const CONTROL = new Set(['Follow', 'Undo', 'Accept', 'Reject', 'Delete', 'Move',
   'Add', 'Remove', 'Block']);
+export const isControl = (type) => CONTROL.has(type);
 
 const idOf = (v) => (typeof v === 'string' ? v : v?.id) || null;
 const sha256hex = (s) => crypto.createHash('sha256').update(s).digest('hex');
@@ -64,8 +66,13 @@ function concernsUsAtEdge(activity, ident) {
 // resolved identity policy: { inboxUrl, actorUrl, followersUrl, notesPrefix,
 // following, blocklist, kind, gatewayWebId, hmacSecret }. `podPut(url, body,
 // contentType) → boolean` appends to the pod with the gateway's credential.
-// Returns { status, reason } — the adapter turns it into an HTTP response.
-export async function handleDelivery(request, ident, { podPut, fetchImpl = fetch, maxBytes = DEFAULT_MAX_BYTES } = {}) {
+// `paused` says nobody is reading this inbox: content is accepted and
+// discarded (the same quiet 202 a blocked sender gets, so nothing retries
+// and nothing counts a failure against this host), control still lands.
+// Returns { status, reason } — the adapter turns it into an HTTP response —
+// and, for a delivery that reached the pod, `content` (whether it was
+// content rather than control) and `bytes`, so the caller can keep count.
+export async function handleDelivery(request, ident, { podPut, fetchImpl = fetch, maxBytes = DEFAULT_MAX_BYTES, paused = false } = {}) {
   // Read the body once from a clone; the original, unconsumed, goes to the
   // verifier (which needs the body for the Digest check).
   let raw;
@@ -80,7 +87,9 @@ export async function handleDelivery(request, ident, { podPut, fetchImpl = fetch
   // Edge drops — silent 202 so a rejected sender does not retry a delivery we
   // will never accept. None of these becomes a pod write.
   if (isBlocked(actor, ident.blocklist)) return { status: 202, reason: 'blocked' };
-  if (!CONTROL.has(activity.type) && !concernsUsAtEdge(activity, ident)) {
+  const content = !CONTROL.has(activity.type);
+  if (content && paused) return { status: 202, reason: 'paused' };
+  if (content && !concernsUsAtEdge(activity, ident)) {
     return { status: 202, reason: 'does not concern us' };
   }
 
@@ -107,7 +116,7 @@ export async function handleDelivery(request, ident, { podPut, fetchImpl = fetch
   // holding any state.
   if (!okA) return { status: 502, reason: 'pod inbox write failed' };
   if (receipt) await inbox.writeReceiptBeside(podPut, ident.inboxUrl, hash, receipt);
-  return { status: 202, reason: v.verified ? 'verified' : 'buffered-unverified' };
+  return { status: 202, reason: v.verified ? 'verified' : 'buffered-unverified', content, bytes: Buffer.byteLength(raw) };
 }
 
 // The outbox door: the owner's own post, taken on their behalf.