fedipod-server 0.26.0 → 0.28.0

package/web/app/dist/sw.js

@@ -9700,6 +9700,7 @@ __export(wire_exports, {
   DEFAULT_ROOT: () => DEFAULT_ROOT,
   FOLLOWERS_PAGE_SIZE: () => FOLLOWERS_PAGE_SIZE,
   HASHTAG_RE: () => HASHTAG_RE,
+  LEMMY_CTX: () => LEMMY_CTX,
   MENTION_RE: () => MENTION_RE,
   OUTBOX_PAGE_SIZE: () => OUTBOX_PAGE_SIZE,
   POLICY_CTX: () => POLICY_CTX,
@@ -9812,7 +9813,8 @@ function actorDoc({
   inbox = null,
   outbox = null,
   oauthAuthorize = null,
-  oauthToken = null
+  oauthToken = null,
+  postingRestrictedToMods = null
 }) {
   const context = [AS_CTX, SEC_CTX];
   context.push({ toot: "http://joinmastodon.org/ns#", featured: { "@id": "toot:featured", "@type": "@id" } });
@@ -9835,6 +9837,7 @@ function actorDoc({
     });
   }
   if (webId || aliases.length) context.push({ alsoKnownAs: { "@id": "as:alsoKnownAs", "@type": "@id" } });
+  if (kind === "group" && postingRestrictedToMods !== null) context.push(LEMMY_CTX);
   if (fields.length) {
     context.push({ schema: "http://schema.org#", PropertyValue: "schema:PropertyValue", value: "schema:value" });
   }
@@ -9853,6 +9856,7 @@ function actorDoc({
     }] } : {},
     ...movedTo ? { movedTo } : {},
     ...webId || aliases.length ? { alsoKnownAs: [...webId ? [webId] : [], ...aliases] } : {},
+    ...kind === "group" && postingRestrictedToMods !== null ? { postingRestrictedToMods: !!postingRestrictedToMods } : {},
     preferredUsername: handle7,
     name: name || handle7,
     // The bio, and the avatar. For a group, `summary` is where what the group
@@ -10375,7 +10379,7 @@ function addRemoveActivity({ urls, type, object, target, serial }) {
     target
   };
 }
-var import_sanitize_html, AS_CTX, SEC_CTX, PUBLIC, DEFAULT_ROOT, assertionKeyId, OUTBOX_PAGE_SIZE, outboxPageId, outboxPageCount, outboxItemId, outboxWireItem, outboxLocalItem, FOLLOWERS_PAGE_SIZE, followersPageId, followersPageCount, ALLOWED_TAGS, ALLOWED_ATTRS, MAX_ATTACHMENTS, MAX_ATTACHMENT_URL, attachmentUrl, HTML_ESCAPES2, MENTION_RE, HASHTAG_RE, QUOTE_CTX, POLICY_CTX;
+var import_sanitize_html, AS_CTX, LEMMY_CTX, SEC_CTX, PUBLIC, DEFAULT_ROOT, assertionKeyId, OUTBOX_PAGE_SIZE, outboxPageId, outboxPageCount, outboxItemId, outboxWireItem, outboxLocalItem, FOLLOWERS_PAGE_SIZE, followersPageId, followersPageCount, ALLOWED_TAGS, ALLOWED_ATTRS, MAX_ATTACHMENTS, MAX_ATTACHMENT_URL, attachmentUrl, HTML_ESCAPES2, MENTION_RE, HASHTAG_RE, QUOTE_CTX, POLICY_CTX;
 var init_wire = __esm({
   "lib/core/wire.mjs"() {
     init_urls();
@@ -10383,6 +10387,7 @@ var init_wire = __esm({
     init_profile_page();
     import_sanitize_html = __toESM(require_sanitize_html(), 1);
     AS_CTX = "https://www.w3.org/ns/activitystreams";
+    LEMMY_CTX = "https://join-lemmy.org/context.json";
     SEC_CTX = "https://w3id.org/security/v1";
     PUBLIC = "https://www.w3.org/ns/activitystreams#Public";
     DEFAULT_ROOT = "fedipod/";
@@ -34320,8 +34325,8 @@ async function probePrivateEnforcement(probe, podKeepUrl) {
 }
 
 // lib/pod/state.mjs
-var readWrappedKeys = (pod, urls) => pod.getJson(urls.state + "keys.json");
-var writeWrappedKeys = (pod, urls, envelope) => pod.putJson(urls.state + "keys.json", envelope, "application/json");
+var readKeys = (pod, urls) => pod.getJson(urls.state + "keys.json");
+var writeKeys = (pod, urls, keys) => pod.putJson(urls.state + "keys.json", keys, "application/json");
 
 // lib/core/store.mjs
 init_node_crypto();
@@ -57180,6 +57185,9 @@ var Publisher = class {
       fields: this.config.fields || [],
       webId: this.remote.webId || null,
       aliases: this.config.aliases || [],
+      // A group says whether only its moderators may open posts (Lemmy's
+      // term); a person's actor carries nothing of the kind.
+      postingRestrictedToMods: this.config.kind === "group" ? !!this.config.postingRestrictedToMods : null,
       moderators,
       pendingFollowers: priv ? urls.pendingFollowers : null,
       pendingFollowing: priv ? urls.pendingFollowing : null,
@@ -69040,18 +69048,6 @@ async function generateKeys() {
   }
   return rec;
 }
-var PBKDF2_ITERATIONS = 31e4;
-async function deriveAesKey(password, salt, iterations) {
-  const base = await crypto.subtle.importKey("raw", new TextEncoder().encode(password), "PBKDF2", false, ["deriveKey"]);
-  return crypto.subtle.deriveKey(
-    { name: "PBKDF2", salt, iterations, hash: "SHA-256" },
-    base,
-    { name: "AES-GCM", length: 256 },
-    false,
-    ["encrypt", "decrypt"]
-  );
-}
-var toB64 = (buf) => btoa(String.fromCharCode(...new Uint8Array(buf)));
 function isKeyEnvelope(doc) {
   return !!doc && doc.v === 1 && typeof doc.ct === "string" && typeof doc.salt === "string";
 }
@@ -69061,21 +69057,6 @@ var KeyPasswordNeeded = class extends Error {
   }
   code = "key-password-needed";
 };
-async function wrapKeys(keysRecord, password) {
-  const salt = crypto.getRandomValues(new Uint8Array(16));
-  const iv = crypto.getRandomValues(new Uint8Array(12));
-  const aes = await deriveAesKey(password, salt, PBKDF2_ITERATIONS);
-  const plaintext = new TextEncoder().encode(JSON.stringify(keysRecord));
-  const ct = await crypto.subtle.encrypt({ name: "AES-GCM", iv }, aes, plaintext);
-  return {
-    v: 1,
-    kdf: "PBKDF2-SHA256",
-    iterations: PBKDF2_ITERATIONS,
-    salt: toB64(salt),
-    iv: toB64(iv),
-    ct: toB64(ct)
-  };
-}
 
 // web/app/keys-browser.mjs
 var pemToDer = (pem) => Uint8Array.from(
@@ -69107,7 +69088,7 @@ async function loadKeysFromPod(remote, urls) {
   const cached = await kvGet(keyCacheKey(podActor)).catch(() => null);
   if (isOpenedKey(cached)) return fromCache(cached);
   if (cached?.rsa?.privatePem) return cacheOpenedKeys(podActor, cached);
-  const doc = await readWrappedKeys(remote, urls);
+  const doc = await readKeys(remote, urls);
   if (isKeyEnvelope(doc)) throw new KeyPasswordNeeded();
   if (!doc || !doc.rsa) throw new Error("no signing key on the pod \u2014 sign up did not finish");
   return cacheOpenedKeys(podActor, doc);
@@ -69938,6 +69919,8 @@ var ADMIN_PATHS = /* @__PURE__ */ new Set([
   "/park",
   "/revive",
   "/takeover",
+  "/gateway/pause",
+  "/gateway/close",
   "/fediacct/connect",
   "/fediacct/disconnect",
   "/fediacct/callback"
@@ -70042,7 +70025,11 @@ var AdminFacade = class {
             frontActor: g?.frontActor || null,
             mode: g?.mode || "off",
             hasSecret: !!g?.hmacSecret,
-            stats: a.store.read("gateway-stats.json", { verified: 0, unverified: 0, lastAt: null })
+            stats: a.store.read("gateway-stats.json", { verified: 0, unverified: 0, lastAt: null }),
+            // The account's standing at the gateway — paused, closed — as the
+            // gateway last said it (agent.mjs tellGateway). The record page
+            // shows its pause and close controls only when this is here.
+            standing: a.gatewayStanding || null
           });
         }
         case "/deadletter":
@@ -70186,6 +70173,24 @@ var AdminFacade = class {
         if (!await a.requestTakeover?.()) return json2(503, { error: "the lease could not be taken \u2014 the pod refused the write" });
         return json2(200, { ok: true, mode: a.status().mode });
       }
+      // The account's standing at its gateway: paused by its owner, or closed
+      // for good (front-core: accounts that go quiet). Both go to the gateway
+      // with the pod session as proof, and its answer is the new standing.
+      case "/gateway/pause": {
+        if (typeof body.paused !== "boolean") return json2(400, { error: "paused must be true or false" });
+        if (!a.pauseAtGateway || !a.gatewayApi) return json2(501, { error: "this account is not at a gateway" });
+        const r = await a.pauseAtGateway(body.paused);
+        if (!r) return json2(502, { error: "the gateway could not be reached" });
+        return json2(r.status === 200 ? 200 : r.status, r);
+      }
+      case "/gateway/close": {
+        const handle7 = String(a.store.getConfig()?.handle || "").toLowerCase();
+        if (!handle7 || String(body.confirm || "").toLowerCase() !== handle7) return json2(400, { error: "type the handle to confirm" });
+        if (!a.closeAtGateway || !a.gatewayApi) return json2(501, { error: "this account is not at a gateway" });
+        const r = await a.closeAtGateway();
+        if (!r) return json2(502, { error: "the gateway could not be reached" });
+        return json2(r.status === 200 ? 200 : r.status, r);
+      }
       // Going quiet, and coming back. The record page's active/parked select.
       case "/park": {
         if (!await a.requestTakeover?.()) return json2(503, { error: "another device is active for this pod \u2014 park from there" });
@@ -70197,13 +70202,8 @@ var AdminFacade = class {
       }
       case "/rotate-key": {
         await a.requestTakeover?.();
-        try {
-          const r = await a.rotateKey({ password: body.password });
-          return json2(200, { ok: true, changed: !!r?.changed });
-        } catch (e) {
-          if (e.code !== "key-password-needed") throw e;
-          return json2(428, { error: e.message, needsPassword: true });
-        }
+        const r = await a.rotateKey();
+        return json2(200, { ok: true, changed: !!r?.changed });
       }
       // Recover posts this browser lost, from what the pod still holds.
       case "/rebuild": {
@@ -70502,6 +70502,60 @@ var AdminFacade = class {
   }
 };
 
+// web/app/gateway-move.mjs
+init_wire();
+async function completeGatewayMove(agent2) {
+  const cfg = agent2.store.getConfig();
+  const mv = cfg?.movedFrom;
+  if (!mv || mv.completedAt) return null;
+  const log2 = agent2.log;
+  const newActor = agent2.urls.actor;
+  let told;
+  try {
+    told = await agent2.sessionFetch(`${mv.gateway}/api/move`, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ handle: mv.handle, movedTo: newActor })
+    });
+  } catch (e) {
+    told = { status: 0, statusText: e.message };
+  }
+  if (told.status !== 200) {
+    log2(`gateway move: ${mv.gateway} did not mark @${mv.handle} as moved (${told.status || told.statusText}) \u2014 will retry`);
+    return { told: false };
+  }
+  const contacts = agent2.store.getContacts();
+  const inboxes = [...new Set(contacts.followers.map((f) => f.sharedInbox || f.inbox).filter(Boolean))];
+  const activity = moveActivity({ actor: mv.actor }, newActor, Date.now());
+  const sender = new RelayDeliverer({
+    passive: true,
+    store: agent2.store,
+    rsaPrivate: agent2.deliverer.rsaPrivate,
+    keyId: `${mv.actor}#main-key`,
+    actorId: mv.actor,
+    log: log2,
+    relayUrl: `${mv.gateway}/api/relay`,
+    handle: mv.handle,
+    sessionFetch: agent2.sessionFetch
+  });
+  let sent = 0;
+  let failed = 0;
+  for (const inbox of inboxes) {
+    try {
+      await sender.deliverNow(inbox, activity);
+      sent++;
+    } catch (e) {
+      failed++;
+      log2(`gateway move: Move to ${inbox} failed: ${e.message}`);
+    }
+  }
+  const done = { ...mv, completedAt: (/* @__PURE__ */ new Date()).toISOString(), moveSent: sent, moveFailed: failed };
+  agent2.store.setConfig({ ...agent2.store.getConfig(), movedFrom: done });
+  await agent2.store.flush?.();
+  log2(`moved from ${mv.actor} to ${newActor}: Move sent to ${sent} inbox(es)${failed ? `, ${failed} failed` : ""}`);
+  return done;
+}
+
 // stub:node:os
 var fail2 = () => {
   throw new Error("node:os is not available in the browser agent");
@@ -71678,10 +71732,46 @@ var BrowserAgent = class _BrowserAgent {
     this.log("took over from the other device (action here)");
     return true;
   }
+  // One call to the gateway's owner API, proved with the pod session. What
+  // comes back on 200 or 410 is the account's standing there, kept for the
+  // manage page; anything else is logged and forgotten.
+  async tellGateway(what, body) {
+    if (!this.gatewayApi) return null;
+    let res;
+    try {
+      res = await this.sessionFetch(`${this.gatewayApi}/${what}`, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify(body)
+      });
+    } catch (e) {
+      this.log(`gateway ${what}: ${e.message}`);
+      return null;
+    }
+    const json2 = await res.json().catch(() => ({}));
+    const out = { status: res.status, ...json2 };
+    if (res.status === 200 || res.status === 410) this.gatewayStanding = out;
+    else this.log(`gateway ${what}: ${res.status} ${json2.error || ""}`);
+    return out;
+  }
+  openAtGateway() {
+    return this.tellGateway("open", { handle: this.doorKey });
+  }
+  pauseAtGateway(paused) {
+    return this.tellGateway("pause", { handle: this.doorKey, paused: !!paused });
+  }
+  closeAtGateway() {
+    return this.tellGateway("close", { handle: this.doorKey, confirm: true });
+  }
+  static OPEN_EVERY_MS = 60 * 6e4;
   // Become the active agent: renew the lease, then start what a viewer skips —
   // publish the face, drain the inbox, run the mirrors.
   async goActive() {
     this.viewer = false;
+    clearInterval(this._openTimer);
+    this._openTimer = setInterval(() => {
+      this.openAtGateway();
+    }, _BrowserAgent.OPEN_EVERY_MS);
     this.lease.onLost = () => this.demote();
     this.lease.startRenewal();
     try {
@@ -71691,6 +71781,7 @@ var BrowserAgent = class _BrowserAgent {
       this.deliverer?.startQueue?.();
       await this.publisher.publishProfile();
       await this.store.flush?.();
+      await completeGatewayMove(this).catch((e) => this.log(`gateway move: ${e.message}`));
       await this.intake.start();
       this.startBsky();
       this.startAccts();
@@ -71707,6 +71798,8 @@ var BrowserAgent = class _BrowserAgent {
     this.viewer = true;
     this.log("another device took over \u2014 read-only here");
     this.lease.stopRenewal();
+    clearInterval(this._openTimer);
+    this._openTimer = null;
     this.intake?.stop?.();
     this.deliverer?.stop?.();
     this.importer?.stop?.();
@@ -71788,6 +71881,7 @@ var BrowserAgent = class _BrowserAgent {
       remotePod = credential.remotePod;
     }
     this.webId = webId;
+    this.sessionFetch = session.fetch;
     const root = config && config.root || "fedipod/";
     this.remote = new BrowserRemotePod(session, { webId, log: this.log });
     this.urls = apUrls2(remotePod, root);
@@ -71819,6 +71913,29 @@ var BrowserAgent = class _BrowserAgent {
       sessionFetch: session.fetch,
       onGone: () => this.publisher.publishCollections({ followers: true })
     });
+    this.gatewayApi = null;
+    try {
+      if (config.gateway?.url) this.gatewayApi = `${new URL(config.gateway.url).origin}/api`;
+    } catch {
+      this.gatewayApi = null;
+    }
+    this.doorKey = doorKeyOf(config.gateway?.url) || config.handle;
+    this.gatewayStanding = null;
+    const standing = await this.openAtGateway();
+    if (standing?.status === 410) {
+      const host = (() => {
+        try {
+          return new URL(this.gatewayApi).host;
+        } catch {
+          return "the gateway";
+        }
+      })();
+      const address = this.doorKey.includes("@") ? `@${this.doorKey}` : `@${this.doorKey}@${host}`;
+      const why = standing.closedBy === "owner" ? "you closed it" : "nothing opened it for six months";
+      const e = new Error(`${address} is closed at ${host}: ${why}, and a closed address does not come back. Everything on your pod is untouched. The sign-in used here was ${webId}.`);
+      e.code = "address-closed";
+      throw e;
+    }
     this.publisher = new Publisher({
       config: this.store.getConfig(),
       remote: this.remote,
@@ -71927,23 +72044,11 @@ var BrowserAgent = class _BrowserAgent {
   // actor so the new public key is on the wire. The old key stops signing the
   // moment this returns — same one-way change as the Node agent's rotateKey
   // (run-agent.mjs).
-  //
-  // The pod's copy is wrapped, so this needs the account password. There is
-  // nowhere to get it from without asking: the worker boots from a stored
-  // session and holds no password, and caching one to save a prompt on a
-  // once-in-a-while action would put the account password in storage to avoid
-  // typing it. So the caller supplies it, and rotating without one is refused
-  // rather than quietly writing a bare key back where a wrapped one was.
-  async rotateKey({ password } = {}) {
-    if (!password) {
-      const e = new Error("rotating the signing key needs your account password \u2014 it is what the new key is locked under on the pod");
-      e.code = "key-password-needed";
-      throw e;
-    }
+  async rotateKey() {
     const before = this.publisher.publicKeyPem;
     const rec = await generateKeys();
     rec.mintedFor = this.urls.actor;
-    await writeWrappedKeys(this.remote, this.urls, await wrapKeys(rec, password));
+    await writeKeys(this.remote, this.urls, rec);
     const keys = await cacheOpenedKeys(podActorOf(this.urls), rec);
     this.publisher.publicKeyPem = keys.rsaPublicPem;
     this.deliverer.rsaPrivate = keys.rsaPrivate;
@@ -72396,7 +72501,7 @@ async function serve(request, url) {
     } catch {
     }
   }
-  if (!agent) return json(503, { error: "the agent is not booted yet \u2014 open the app from the sign-in page" });
+  if (!agent) return json(503, { error: "not signed in on this browser \u2014 sign in at the front page" });
   const bodyBytes = request.method === "GET" || request.method === "HEAD" ? null : Buffer.from(new Uint8Array(await request.arrayBuffer()));
   const bodyText = bodyBytes ? new TextDecoder().decode(bodyBytes) : "";
   const reqHeaders = {};