fedipod-server 0.26.0 → 0.28.0

package/web/app/signup.mjs

@@ -1,26 +1,26 @@
-// signup.mjs — the setup flow of `fedipod setup`, run in the browser. It does
-// what lib/setup.mjs's runSetup does up to the publish step: create the account
-// and pod (or accept one you bring), mint a credential, make the signing keys
-// and lock them on the pod under the password. Publishing the actor is the
-// agent's first-run job, exactly as `connect()` publishes after `setup` mints —
-// so this module needs nothing from lib.
+// signup.mjs — the setup flow of `fedipod setup`, run in the browser, on the
+// pod session the person already holds. The pod exists before this runs: a
+// new one is made on the provider's own sign-up page, an existing one is
+// signed in to as it is. So there is no account API here, no credential and
+// no password — the session that signed in at the pod is the session that
+// writes to it. Publishing the actor is the agent's first-run job, exactly as
+// `connect()` publishes after `setup` mints — so this module needs nothing
+// from lib beyond the pod helpers.
 //
-// It returns the two things a browser must keep for itself: the credential and
-// the config. Neither is secret to the pod owner, but the credential is a pod
-// write key, so the caller stores it in this browser only, never on the pod.
-// The only thing this writes to the pod is the password-wrapped signing key.
+// What it writes to the pod: an owner-only state container holding the
+// signing key and the account config; and, with a gateway, the attach.
 
-import { createAccountWithPod, mintCredential, makeDpopSession, revokeCredential } from './pod-auth.mjs';
-import { generateKeys, wrapKeys } from './keystore.mjs';
+import { generateKeys, isKeyEnvelope } from './keystore.mjs';
 import { BrowserRemotePod } from './pod-remote.mjs';
 import * as podState from '../../lib/pod/state.mjs';
 import { resourceExists } from '../../lib/pod/root.mjs';
+import { podBaseOfWebId } from '../../lib/pod/urls.mjs';
 import { cacheOpenedKeys } from './keys-browser.mjs';
 
 // The container everything the agent publishes hangs under. New pods made here
 // use `fedipod/`; new installs default to `fedipod/` too, and older ones keep
 // that predate this, so those pods are untouched. The name is stored on the
-// credential and the config, so the agent reads it rather than guessing.
+// config, so the agent reads it rather than guessing.
 export const AP_ROOT = 'fedipod/';
 const actorUrlFor = (pod) => `${pod}${AP_ROOT}ap/actor`;
 const keysDocFor = (pod) => `${pod}${AP_ROOT}ap-state/keys.json`;
@@ -35,29 +35,15 @@ export function handleProblem(handle) {
 }
 
 // Resume across a failed attempt. A run that throws part-way keeps what it
-// already achieved in this page session — the pod it made, the credential it
-// minted, the key it wrote — so a second attempt (the failure screen's Try
-// again) continues from the first unfinished step instead of restarting. The
-// record lives only in memory here: no secret is written to disk, and it is
-// dropped the moment the run completes. Keyed by the identity being built, so
-// changing the handle or pod on the form starts a clean attempt.
+// already achieved in this page session — the gateway it attached, the key it
+// wrote — so a second attempt (the failure screen's Try again) continues from
+// the first unfinished step instead of restarting. The record lives only in
+// memory here and is dropped the moment the run completes. Keyed by the
+// identity being built, so changing the handle on the form starts a clean
+// attempt.
 const PROGRESS = new Map();
-const progressKey = (a) => [a.issuer, a.mode, a.handle, a.mode === 'new' ? (a.podName || a.handle) : a.pod].join('|');
+const progressKey = (webId, a) => [webId, a.handle, a.shape || 'pod'].join('|');
 
-/**
- * Run sign-up. Steps are reported through onStep(key, state, note) so a page can
- * draw the same tick list the CLI setup shows. Resumable: see PROGRESS above.
- *
- * answers: { mode:'new'|'existing', issuer, email, password, handle,
- *            podName?, pod?, gateway?, shape?: 'pod'|'front' }
- *
- * `shape` is where the address lives. On the pod, `@handle@yourpod`, with the
- * gateway as a mail door only — the default. At the gateway, `@handle@front`,
- * a fronted identity whose documents still live on the pod. A pod on a path of
- * a suffix-based host cannot answer WebFinger, so it is fronted whatever was asked.
- *
- * returns: { credential, config, actorUrl, address, keysPublic }
- */
 /** A fronted name is one per gateway; a taken one is refused before anything is made. */
 async function assertFrontNameFree(frontOrigin, handle) {
   const res = await fetch(`${frontOrigin.replace(/\/$/, '')}/api/handle?handle=${encodeURIComponent(handle)}`,
@@ -67,19 +53,35 @@ async function assertFrontNameFree(frontOrigin, handle) {
   if (!d.available) throw new Error(d.reason || `the name @${handle}@${new URL(frontOrigin).host} is taken — choose another handle`);
 }
 
-export async function signUp(answers, { onStep = () => {}, frontOrigin = null } = {}) {
-  const { mode, issuer, email, password, handle } = answers;
+/**
+ * Run sign-up on a pod session. Steps are reported through onStep(key, state,
+ * note) so a page can draw the same tick list the CLI setup shows. Resumable:
+ * see PROGRESS above.
+ *
+ * answers: { handle, shape?: 'pod'|'front', gateway? }
+ * session: { webId, issuer, fetch } — the Solid-OIDC session from the pod's
+ *          own login (oidc-session.mjs). The pod is where the WebID lives.
+ *
+ * `shape` is where the address lives. On the pod, `@handle@yourpod`, with the
+ * gateway as a mail door only — the default. At the gateway, `@handle@front`,
+ * a fronted identity whose documents still live on the pod. A pod on a path of
+ * a suffix-based host cannot answer WebFinger, so it is fronted whatever was asked.
+ *
+ * returns: { config, actorUrl, address, pod, keys, keysPublic }
+ */
+export async function signUp(answers, { session, onStep = () => {}, frontOrigin = null } = {}) {
+  const { handle } = answers;
   const bad = handleProblem(handle);
   if (bad) throw new Error(bad);
-  if (!email) throw new Error('an email is required');           // recovery + account login
-  if (!password) throw new Error('a password is required');
-  if (mode === 'existing' && !answers.pod) throw new Error('a pod address is required');
+  if (!session?.webId || typeof session.fetch !== 'function') throw new Error('sign in at your pod first');
   const wantsFront = answers.shape === 'front';
   if (wantsFront && !frontOrigin) throw new Error('an address at the gateway needs a gateway, and this page has none');
   // A name at the gateway is one per gateway: settle it before making anything.
   if (wantsFront) await assertFrontNameFree(frontOrigin, handle);
 
-  const key = progressKey(answers);
+  const webId = session.webId;
+  const pod = podBaseOfWebId(webId);                 // its own host, or a path on a suffix-based one
+  const key = progressKey(webId, answers);
   const prog = PROGRESS.get(key) || {};
   PROGRESS.set(key, prog);                                       // resume record for this identity
 
@@ -89,28 +91,16 @@ export async function signUp(answers, { onStep = () => {}, frontOrigin = null }
     skip: (note) => onStep(key, 'skipped', note),
   });
 
-  // --- account + pod --- (skipped outright once a prior attempt has made it)
-  let accountToken = null;                                       // valid only within this call
-  const acct = step('account');
+  // --- the pod --- (the session came from it; what is checked is that it has no account yet)
+  const podStep = step('pod');
   if (!prog.pod) {
-    if (mode === 'new') {
-      acct.running('creating the account and pod');
-      const made = await createAccountWithPod({ issuer, email, password, podName: answers.podName || handle });
-      prog.pod = made.pod; prog.webId = made.webId; accountToken = made.accountToken;
-      acct.ok(made.pod);
-    } else {
-      const brought = answers.pod.endsWith('/') ? answers.pod : answers.pod + '/';
-      acct.running('checking your pod');
-      const head = await fetch(brought, { method: 'HEAD' }).catch(() => null);
-      if (!head || head.status >= 400) throw new Error(`the pod at ${brought} did not answer (HTTP ${head?.status || 'no response'})`);
-      if (await resourceExists(fetch, actorUrlFor(brought))) throw new Error('The pod already hosts a FediPod account. If you want a second account, put it on a different pod.');
-      prog.pod = brought;
-      acct.skip('using the pod you brought');
-    }
+    podStep.running('checking your pod');
+    if (await resourceExists(session.fetch, actorUrlFor(pod))) throw new Error('The pod already hosts a FediPod account. If you want a second account, put it on a different pod.');
+    prog.pod = pod;
+    podStep.ok(pod);
   } else {
-    acct.ok(prog.pod);                                          // resumed: the pod is already there
+    podStep.ok(prog.pod);                                        // resumed
   }
-  const pod = prog.pod; const webId = prog.webId || null;
 
   // WebFinger is answered only at a host root. A pod on a path of a shared
   // host therefore takes its address at the gateway, whatever was asked; a
@@ -125,54 +115,13 @@ export async function signUp(answers, { onStep = () => {}, frontOrigin = null }
   const actorUrl = actorUrlFor(pod);                              // where the documents live, always
   const frontActor = fronted ? `${frontOrigin.replace(/\/$/, '')}/u/${handle}/ap/actor` : null;
 
-  // --- credential --- (a fresh attempt re-mints; a resumed one reuses it)
-  const cred = step('credential');
-  let credential;
-  if (!prog.credential) {
-    cred.running('minting a credential for this browser');
-    // accountToken is null when the account step was skipped (a resume), so
-    // mintCredential logs in fresh with email+password rather than reusing a
-    // token that a prior attempt may have let go stale.
-    credential = await mintCredential({ issuer, email, password, webId, podUrl: pod, accountToken });
-    credential.remotePod = pod;
-    credential.root = AP_ROOT;                                   // the agent reads the container name from here
-    prog.credential = credential;
-    cred.ok();
-  } else {
-    credential = prog.credential;
-    cred.ok();
-  }
-
-  // A pod-writing session for the remaining pod writes and the gateway proof.
-  const session = await makeDpopSession(credential);
-
-  // --- keys, encrypted, in an owner-only container on the pod ---
-  //
-  // The durable copy is on the pod, because a browser has no disk you can carry
-  // to the next machine. That copy used to be the bare record, on the argument
-  // that the pod's owner-only ACL is protection enough and the pod host already
-  // holds your data. It is not the same thing: your data is your data, and the
-  // signing key IS you — whoever holds it is you to every server in the
-  // fediverse, for as long as the key lives, and no ACL reaches the host itself.
-  // So it is wrapped under the account password first, and the host stores
-  // ciphertext. (Three documents already said this was happening. Now it is.)
-  //
-  // Two things in that order, deliberately: the ACL BEFORE the key. Writing the
-  // key first leaves a window where a pod whose root is world-readable serves it
-  // to anyone who asks, and a brought pod is exactly the case where that root
-  // may be public.
-  //
-  // The opened copy is kept in this browser (IndexedDB) so the worker can boot
-  // itself after an idle kill with nobody there to type a password. A browser
-  // that has no copy asks for the password once — see boot.mjs.
   // Connect the gateway (fedipod.net) before the key is made, because a
   // fronted identity's key is stamped with the gateway actor. Inbox-only: the
   // actor advertises the door as its inbox and keeps its own ids. Fronted: the
   // gateway answers WebFinger for @handle@front and serves the actor at its own
   // address, rewriting reads onto the pod. Either way the door verifies each
   // delivery and forwards the clean mail to the pod; the agent trusts the
-  // door's receipt. The same DPoP session proves the pod to the gateway — no
-  // password reaches it.
+  // door's receipt. The pod session itself proves the pod to the gateway.
   let gateway = answers.gateway || prog.gateway || null;
   if (frontOrigin && !gateway) {
     const gw = step('gateway');
@@ -199,31 +148,46 @@ export async function signUp(answers, { onStep = () => {}, frontOrigin = null }
     step('gateway').ok();                                        // resumed
   }
 
+  // --- keys, in an owner-only container on the pod ---
+  //
+  // The durable copy is on the pod, because a browser has no disk you can carry
+  // to the next machine. It is stored as it is, behind the container's access
+  // rule: the same rule every private document on the pod lives under, so it
+  // is reachable through the pod's own login and by nobody else.
+  //
+  // Two things in that order, deliberately: the ACL BEFORE the key. Writing the
+  // key first leaves a window where a pod whose root is world-readable serves it
+  // to anyone who asks, and a brought pod is exactly the case where that root
+  // may be public.
+  //
+  // The opened copy is kept in this browser (IndexedDB) so the worker can boot
+  // itself after an idle kill with no read. A browser that has no copy reads
+  // the pod's with its session — see keys-browser.mjs.
+  const remote = new BrowserRemotePod(session, { webId, role: 'signup', log: () => {} });
   const keysStep = step('keys');
   let keys;
   if (!prog.keysStored) {
-    keysStep.running('making your signing key and locking it under your password');
+    keysStep.running('making your signing key and storing it on your pod');
     keys = await generateKeys();
     // One key, one actor (lib/keys.mjs): the actor the world knows, which for
     // a fronted identity is the gateway's address for it.
     keys.mintedFor = gateway?.frontActor || actorUrl;
-    const remote = new BrowserRemotePod(session, { webId: credential.webId, role: 'signup', log: () => {} });
     // Owner-only, and THEN the key — one operation, so the order cannot be got
     // wrong here or anywhere else. A pod that refuses the ACL write is not a
-    // pod this key may sit on, wrapped or not.
+    // pod this key may sit on.
     try {
       await podState.provisionKey(remote, {
         stateUrl: `${pod}${AP_ROOT}ap-state/`,
         keysUrl: keysDocFor(pod),
-        envelope: await wrapKeys(keys, password),
+        keys,
       });
     } catch (e) {
       throw new Error(`could not store the signing key on the pod (${e.message}). `
-        + `The credential is for ${credential.webId} — that WebID must own ${pod} and its ${AP_ROOT} must be writable by it.`);
+        + `You are signed in as ${webId} — that WebID must own ${pod} and its ${AP_ROOT} must be writable by it.`);
     }
-    // This browser's own opened copy, so the boot after the login redirect
-    // needs no password. Best effort: a browser that refuses IndexedDB (private
-    // mode) simply asks for the password on the way back in.
+    // This browser's own opened copy, so the boot that follows needs no read.
+    // Best effort: a browser that refuses IndexedDB (private mode) reads the
+    // pod's copy on the way back in.
     await cacheOpenedKeys(actorUrl, keys);
     prog.keys = keys; prog.keysStored = true;
     keysStep.ok();
@@ -233,46 +197,122 @@ export async function signUp(answers, { onStep = () => {}, frontOrigin = null }
   }
 
   const config = {
-    remotePod: pod, root: AP_ROOT, handle, name: handle, issuer: credential.issuerOrigin,
+    remotePod: pod, root: AP_ROOT, handle, name: handle, issuer: String(session.issuer || '').replace(/\/+$/, ''),
     createdAt: new Date().toISOString(),
     ...(gateway ? { gateway } : {}),
   };
   // Write the config to the pod (owner-only, beside the key) so a returning
   // sign-in — which arrives with only an OIDC session — can read the account's
-  // config and key from the pod and boot with no password.
-  const cfgRemote = new BrowserRemotePod(session, { webId: credential.webId, role: 'signup', log: () => {} });
+  // config and key from the pod and boot.
   try {
-    await podState.writeConfig(cfgRemote, { state: `${pod}${AP_ROOT}ap-state/` }, config);
+    await podState.writeConfig(remote, { state: `${pod}${AP_ROOT}ap-state/` }, config);
   } catch (e) {
     throw new Error(`could not store the config on the pod (${e.message})`);
   }
 
-  // The credential was for sign-up, and sign-up is over. The agent runs on the
-  // Solid-OIDC session from here on and never needs it again, so leaving it
-  // alive would leave permanent full access to the pod in a key nothing holds.
-  // Best effort: a server that will not delete it is a credential the owner can
-  // still revoke from their pod's account page, and not a reason to fail a
-  // sign-up that otherwise worked.
-  const revoked = await revokeCredential({
-    resource: credential.resource, accountToken: credential.accountToken,
-  });
-  delete credential.accountToken;              // never leaves this function
-  if (!revoked && credential.resource) {
-    onStep('credential', 'ok', 'this browser is ready (the setup credential could not be '
-      + 'revoked automatically — you can remove it from your pod\'s account page)');
-  }
-
   PROGRESS.delete(key);                                          // finished — nothing left to resume
 
   const host = gateway?.frontActor ? new URL(gateway.frontActor).host : new URL(pod).host;
   return {
-    credential, config, actorUrl,
+    config, actorUrl, pod,
     address: `@${handle}@${host}`,
     // The opened keys, for booting the agent in THIS browser session right away.
-    // The durable copy on the pod is wrapped under the account password; this
-    // browser also holds an opened one in IndexedDB (above), which is what the
-    // worker reads. A fresh browser asks for the password once and makes its own.
     keys,
     keysPublic: { rsa: keys.rsa.publicPem, ed25519: keys.ed25519?.publicPem || null },
   };
 }
+
+// ---- an account already on the pod ----
+
+/**
+ * What the pod already holds: null when there is no FediPod account on it,
+ * else its config, the pod, and where its address lives — `frontHost` is
+ * the gateway's host for an address at a gateway, null for one on the pod.
+ */
+export async function readAccount(session) {
+  const pod = podBaseOfWebId(session.webId);
+  const remote = new BrowserRemotePod(session, { webId: session.webId, role: 'signup', log: () => {} });
+  const config = await podState.readConfig(remote, { state: `${pod}${AP_ROOT}ap-state/` }).catch(() => null);
+  if (!config) return null;
+  const frontActor = config.gateway?.frontActor || null;
+  let frontHost = null;
+  try { frontHost = frontActor ? new URL(frontActor).host : null; } catch { frontHost = null; }
+  let podHost = '';
+  try { podHost = new URL(config.remotePod || pod).host; } catch { podHost = ''; }
+  return { pod, config, frontActor, frontHost, address: `@${config.handle}@${frontHost || podHost}` };
+}
+
+/**
+ * Move an account whose address lives at another gateway to this one. The
+ * pod, its posts, its followers and its key all stay where they are; what
+ * changes is the gateway that answers for it. This half does the pod's
+ * part: attach here, rewrite the config to name this gateway, restamp the
+ * key. The agent's first boot from that config publishes under the new
+ * ids, and then tells the old gateway and the followers (gateway-move.mjs).
+ *
+ * answers: { handle }  — the name here; the old one is the default.
+ * returns: { config, address, movedFrom }
+ */
+export async function moveIn(answers, { session, onStep = () => {}, frontOrigin = null } = {}) {
+  const { handle } = answers;
+  const bad = handleProblem(handle);
+  if (bad) throw new Error(bad);
+  if (!session?.webId || typeof session.fetch !== 'function') throw new Error('sign in at your pod first');
+  if (!frontOrigin) throw new Error('a move needs a gateway to move to, and this page has none');
+  const origin = frontOrigin.replace(/\/$/, '');
+  const step = (key) => ({ running: (note) => onStep(key, 'running', note), ok: (note) => onStep(key, 'ok', note) });
+
+  // --- the pod: the account that is there, and its key ---
+  const podStep = step('pod');
+  podStep.running('reading your account on your pod');
+  const here = await readAccount(session);
+  if (!here?.frontActor) throw new Error('this pod holds no account at another gateway to move here');
+  if (here.frontHost === new URL(origin).host) throw new Error('this account already lives at this gateway');
+  const { pod, config: old } = here;
+  const remote = new BrowserRemotePod(session, { webId: session.webId, role: 'signup', log: () => {} });
+  const urls = { state: `${pod}${AP_ROOT}ap-state/` };
+  const keys = await podState.readKeys(remote, urls);
+  if (!keys?.rsa) throw new Error('could not read this account\'s signing key on the pod');
+  if (isKeyEnvelope(keys)) throw new Error(`this account's key is still under a password from an earlier version — sign in once at ${here.frontHost} first, then come back`);
+  podStep.ok(here.address);
+
+  // --- this gateway: the name, then the attach, fronted ---
+  const gw = step('gateway');
+  gw.running(`taking your address at ${new URL(origin).host}`);
+  await assertFrontNameFree(origin, handle);
+  const res = await session.fetch(`${origin}/api/attach`, {
+    method: 'POST', headers: { 'content-type': 'application/json' },
+    body: JSON.stringify({ handle, podHome: `${pod}${AP_ROOT}`, actorUrl: actorUrlFor(pod), kind: old.kind || 'person', fronted: true }),
+  });
+  const d = await res.json().catch(() => ({}));
+  if (res.status !== 201 || !d.hmacSecret) throw new Error(`could not attach to this gateway (HTTP ${res.status}): ${d.error || ''}`);
+  const gateway = {
+    url: `${origin}/u/${handle}/ap/inbox/`, frontActor: String(d.frontActor || `${origin}/u/${handle}/ap/actor`),
+    hmacSecret: d.hmacSecret, mode: 'trust',
+  };
+  gw.ok();
+
+  // --- the pod again: the config names this gateway, the key is restamped ---
+  //
+  // The old actor becomes an alias, which is what a server checks on the new
+  // actor before it honours a Move. `movedFrom` is the pending half: the
+  // agent completes it after its first boot under the new ids.
+  const keysStep = step('keys');
+  keysStep.running('moving your key and account record to the new address');
+  const aliases = [...new Set([...(old.aliases || []), here.frontActor])];
+  const config = {
+    ...old, handle, gateway, aliases,
+    movedFrom: { actor: here.frontActor, gateway: new URL(here.frontActor).origin, handle: old.handle, at: new Date().toISOString() },
+  };
+  keys.mintedFor = gateway.frontActor;                          // one key, one actor (lib/keys.mjs)
+  try {
+    await podState.writeKeys(remote, urls, keys);
+    await podState.writeConfig(remote, urls, config);
+  } catch (e) {
+    throw new Error(`could not update your account on the pod (${e.message})`);
+  }
+  await cacheOpenedKeys(actorUrlFor(pod), keys);
+  keysStep.ok();
+
+  return { config, address: `@${handle}@${new URL(origin).host}`, movedFrom: config.movedFrom };
+}

package/web/app/sw-src.mjs

@@ -157,7 +157,7 @@ async function serve(request, url) {
   // Boot on demand from the stored session, so the client works even when the
   // worker was restarted (idle-killed) and nobody posted 'boot' this time.
   if (!agent) { try { await ensureBooting(); } catch { /* no session → 503 below */ } }
-  if (!agent) return json(503, { error: 'the agent is not booted yet — open the app from the sign-in page' });
+  if (!agent) return json(503, { error: 'not signed in on this browser — sign in at the front page' });
   // Bytes, not text. A multipart upload is binary — read as text it comes back
   // through a UTF-8 round trip that replaces every byte that is not valid UTF-8,
   // which is most of a JPEG, so the boundary search found nothing and every

package/web/front/admin.html

@@ -28,7 +28,9 @@
 <body>
 <h1>Accounts on this server</h1>
 <p class="lede">Every name this server answers for: accounts whose identity lives here, and
-accounts that only use it as their gateway. Sign in as the server's admin to see them.</p>
+accounts that only use it as their gateway. Sign in as the server's admin to see them.
+<a href="/notices">Notices</a> — what every account sees behind the bell in its bar — are
+written on their own page.</p>
 
 <form id="roster-form">
   <p class="field">

package/web/front/notices.html

@@ -0,0 +1,69 @@
+<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>FediPod — notices</title>
+<link rel="icon" href="/icons/gateway.svg" type="image/svg+xml">
+<style>
+  :root { color-scheme: light dark; --line:#d9d4c7; --dim:#45443d; --accent:#6a8a5a; --danger:#b00020; }
+  @media (prefers-color-scheme: dark) { :root { --dim:#c2c0b4; --danger:#ff8a9a; } }
+  body { font: 20px/1.6 Arial, Helvetica, sans-serif; max-width: 44rem; margin: 2rem auto; padding: 0 1.1rem; }
+  h1 { font-size: 1.7rem; margin: 0 0 .2rem; }
+  h2 { font-size: 1.25rem; margin: 1.6rem 0 .4rem; }
+  p.lede { color: var(--dim); margin-top: 0; }
+  label { display: block; font-weight: 600; margin: .8rem 0 .2rem; }
+  input[type=url], input[type=text], textarea { width: 100%; padding: .5rem .6rem; font: inherit;
+    border: 1px solid var(--line); border-radius: 8px; box-sizing: border-box; }
+  textarea { min-height: 9rem; resize: vertical; }
+  .hint { color: var(--dim); font-size: .95rem; }
+  .primary { background: var(--accent); color: #fff; border: none; border-radius: 9px;
+    padding: .6rem 1.1rem; font: inherit; cursor: pointer; }
+  .primary[disabled] { opacity: .5; cursor: not-allowed; }
+  button { font: inherit; cursor: pointer; }
+  button.danger { color: var(--danger); background: none; border: 1px solid var(--danger); border-radius: 9px; padding: .4rem .8rem; }
+  [hidden] { display: none !important; }
+  ul.notices { list-style: none; padding: 0; margin: 1rem 0; }
+  ul.notices li { padding: .8rem 0; border-bottom: 1px solid var(--line); }
+  ul.notices .title { font-weight: 600; }
+  ul.notices .when { color: var(--dim); font-size: .95rem; margin-left: .6rem; }
+  ul.notices .body { white-space: pre-wrap; margin: .3rem 0 .6rem; }
+  ul.notices .actions button { margin-right: .6rem; }
+</style>
+</head>
+<body>
+<h1>Notices</h1>
+<p class="lede">What every account on this server sees behind the bell in its bar. Sign in as the
+server's admin to write, change or remove them. <a href="/roster">Back to the roster.</a></p>
+
+<form id="notices-form">
+  <p class="field">
+  <label for="notices-issuer">Your identity provider</label>
+  <input type="url" id="notices-issuer" autocomplete="off" value="https://solidcommunity.net">
+  </p>
+  <p class="actions">
+    <button type="submit" id="notices-signin" class="primary">Sign in &amp; manage notices</button>
+  </p>
+  <p class="hint" id="notices-note" hidden></p>
+</form>
+
+<section id="notices-editor" hidden>
+  <h2 id="editor-title">New notice</h2>
+  <form id="editor-form">
+    <label for="notice-title">Title</label>
+    <input type="text" id="notice-title" maxlength="120" autocomplete="off" required>
+    <label for="notice-body">Text</label>
+    <textarea id="notice-body" maxlength="4000" required></textarea>
+    <p class="hint">Plain text. A blank line starts a new paragraph; a web address becomes a link.</p>
+    <p class="actions">
+      <button type="submit" id="notice-save" class="primary">Publish</button>
+      <button type="button" id="notice-cancel" hidden>Cancel</button>
+    </p>
+  </form>
+  <h2>Published</h2>
+  <ul class="notices" id="notices-list"></ul>
+</section>
+
+<script type="module" src="/notices.js"></script>
+</body>
+</html>

package/web/front/notices.js

@@ -0,0 +1,107 @@
+// notices.js — the notices page's script: the admin signs in, then writes,
+// changes and removes the notices every account here sees behind the bell.
+// Served by the front at /notices.js, like admin.js for the roster.
+const $ = (id) => document.getElementById(id);
+const note = (text) => { const n = $('notices-note'); n.hidden = !text; n.textContent = text || ''; };
+
+let session = null;
+try {
+  const { SessionCore } = await import('/solid-oidc-client.js');
+  session = new SessionCore({ redirect_uris: [location.origin + '/notices'], client_name: 'FediPod admin' });
+} catch { /* leave null — the "did not load" note fires */ }
+
+$('notices-issuer').addEventListener('input', () => {
+  $('notices-signin').disabled = !/^https?:\/\/\S+/.test($('notices-issuer').value.trim());
+});
+
+$('notices-form').addEventListener('submit', (ev) => {
+  ev.preventDefault();
+  if (!session) { note('the sign-in library did not load — reload and try again'); return; }
+  session.login($('notices-issuer').value.trim(), location.origin + '/notices')
+    .catch((e) => note('sign-in failed to start: ' + e.message));
+});
+
+(async () => {
+  if (!session) return;
+  await session.handleRedirectFromLogin().catch(() => {});
+  if (!session.isActive) return;
+  const webId = session.webId;
+  let editing = null;          // the notice being changed, or null for a new one
+
+  const when = (iso) => { try { return new Date(iso).toLocaleString(); } catch { return iso; } };
+
+  const send = async (body) => {
+    let res;
+    try {
+      res = await session.authFetch(location.origin + '/api/notices', {
+        method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(body),
+      });
+    } catch (e) { note('the request failed: ' + e.message); return null; }
+    const d = await res.json().catch(() => ({}));
+    if (res.status === 403) { note('signed in as ' + webId + ', which is not this server’s admin'); return null; }
+    if (res.status === 501) { note('this server keeps no notices'); return null; }
+    if (res.status >= 400) { note('refused: ' + (d.error || 'HTTP ' + res.status)); return null; }
+    return d;
+  };
+
+  const startEdit = (n) => {
+    editing = n;
+    $('editor-title').textContent = n ? 'Change this notice' : 'New notice';
+    $('notice-title').value = n ? n.title : '';
+    $('notice-body').value = n ? n.body : '';
+    $('notice-save').textContent = n ? 'Save changes' : 'Publish';
+    $('notice-cancel').hidden = !n;
+    $('notice-title').focus();
+  };
+
+  const load = async () => {
+    let res;
+    try { res = await fetch(location.origin + '/api/notices', { headers: { accept: 'application/json' }, cache: 'no-store' }); }
+    catch (e) { note('the notices could not be read: ' + e.message); return; }
+    if (res.status === 501) { note('this server keeps no notices'); return; }
+    const d = await res.json().catch(() => ({}));
+    const ul = $('notices-list');
+    ul.textContent = '';
+    for (const n of d.notices || []) {
+      const li = document.createElement('li');
+      const head = document.createElement('div');
+      const t = document.createElement('span'); t.className = 'title'; t.textContent = n.title;
+      const w = document.createElement('span'); w.className = 'when';
+      w.textContent = when(n.at) + (n.updatedAt && n.updatedAt !== n.at ? ' (changed ' + when(n.updatedAt) + ')' : '');
+      head.append(t, w);
+      const b = document.createElement('p'); b.className = 'body'; b.textContent = n.body;
+      const acts = document.createElement('p'); acts.className = 'actions';
+      const edit = document.createElement('button'); edit.type = 'button'; edit.textContent = 'Change';
+      edit.onclick = () => startEdit(n);
+      const rm = document.createElement('button'); rm.type = 'button'; rm.textContent = 'Remove'; rm.className = 'danger';
+      rm.onclick = async () => {
+        if (!confirm('Remove the notice “' + n.title + '”? Everyone stops seeing it.')) return;
+        if (await send({ action: 'delete', id: n.id })) { note('removed “' + n.title + '”'); await load(); }
+      };
+      acts.append(edit, rm);
+      li.append(head, b, acts);
+      ul.append(li);
+    }
+    if (!(d.notices || []).length) { const li = document.createElement('li'); li.textContent = 'No notices yet.'; ul.append(li); }
+    $('notices-editor').hidden = false;
+  };
+
+  $('editor-form').addEventListener('submit', async (ev) => {
+    ev.preventDefault();
+    const title = $('notice-title').value.trim();
+    const body = $('notice-body').value.trim();
+    if (!title || !body) { note('a title and a text are both needed'); return; }
+    $('notice-save').disabled = true;
+    const r = await send(editing ? { action: 'update', id: editing.id, title, body } : { action: 'create', title, body });
+    $('notice-save').disabled = false;
+    if (!r) return;
+    note(editing ? 'changed “' + title + '”' : 'published “' + title + '” — everyone sees it within a minute');
+    startEdit(null);
+    await load();
+  });
+  $('notice-cancel').addEventListener('click', () => startEdit(null));
+
+  note('signed in as ' + webId);
+  $('notices-form').hidden = true;
+  await load();
+})();