fedipod-server 0.26.0 → 0.28.1

package/web/app/gateway-move.mjs

@@ -0,0 +1,60 @@
+// gateway-move.mjs — the second half of moving an address from one gateway
+// to another (signup.mjs moveIn is the first). It runs on the agent's first
+// active boot under the new ids, once the new actor is published with the
+// old one as an alias, and it is safe to run again: nothing here is done
+// twice with the same result changed.
+//
+//   1. The old gateway is told the address moved (POST /api/move, proved
+//      with the pod session as attach was). It serves the old actor as a
+//      moved stub from then on — same key, old id, `movedTo` the new one.
+//   2. A Move goes to every follower, FROM the old actor, signed under the
+//      old key id, through the old gateway's relay: that is the only
+//      signature a follower's server can verify against the old actor.
+//
+// The followers' servers fetch the old actor, find `movedTo`, fetch the new
+// one, find the old among its `alsoKnownAs`, and move the follow.
+import { RelayDeliverer } from './deliver-relay.mjs';
+import { moveActivity } from '../../lib/core/wire.mjs';
+
+export async function completeGatewayMove(agent) {
+  const cfg = agent.store.getConfig();
+  const mv = cfg?.movedFrom;
+  if (!mv || mv.completedAt) return null;
+  const log = agent.log;
+  const newActor = agent.urls.actor;
+
+  // 1. the old gateway
+  let told;
+  try {
+    told = await agent.sessionFetch(`${mv.gateway}/api/move`, {
+      method: 'POST', headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ handle: mv.handle, movedTo: newActor }),
+    });
+  } catch (e) { told = { status: 0, statusText: e.message }; }
+  if (told.status !== 200) {
+    // Left pending: the next active boot tries again. Followers are not told
+    // until the old actor can vouch for the Move.
+    log(`gateway move: ${mv.gateway} did not mark @${mv.handle} as moved (${told.status || told.statusText}) — will retry`);
+    return { told: false };
+  }
+
+  // 2. the Move, from the old address
+  const contacts = agent.store.getContacts();
+  const inboxes = [...new Set(contacts.followers.map((f) => f.sharedInbox || f.inbox).filter(Boolean))];
+  const activity = moveActivity({ actor: mv.actor }, newActor, Date.now());
+  const sender = new RelayDeliverer({
+    passive: true, store: agent.store, rsaPrivate: agent.deliverer.rsaPrivate,
+    keyId: `${mv.actor}#main-key`, actorId: mv.actor, log,
+    relayUrl: `${mv.gateway}/api/relay`, handle: mv.handle, sessionFetch: agent.sessionFetch,
+  });
+  let sent = 0; let failed = 0;
+  for (const inbox of inboxes) {
+    try { await sender.deliverNow(inbox, activity); sent++; }
+    catch (e) { failed++; log(`gateway move: Move to ${inbox} failed: ${e.message}`); }
+  }
+  const done = { ...mv, completedAt: new Date().toISOString(), moveSent: sent, moveFailed: failed };
+  agent.store.setConfig({ ...agent.store.getConfig(), movedFrom: done });
+  await agent.store.flush?.();
+  log(`moved from ${mv.actor} to ${newActor}: Move sent to ${sent} inbox(es)${failed ? `, ${failed} failed` : ''}`);
+  return done;
+}

package/web/app/index.html

@@ -104,36 +104,35 @@ a { color: var(--accent); }
   <p><button type="button" class="primary" id="create">create an account</button></p>
   <p>Fedipod.net is a FediPod Gateway operated by Jeff Zucker. You can detach from the gateway at any
   time and transfer your account either to your own FediPod Gateway (easy to set up on a free tier Netlify) 
-  or to any Fediverse server. All of your data lives on your pod and your Fediverse identity is yours
-  forever independent of which gateway you attach to.</p>
+  or to any Fediverse server. All of your data lives on your pod and is yours regardless of which
+  gateway you are attached to.</p>
   <p>For more information, see
     <a href="https://github.com/jeff-zucker/FediPod">github.com/jeff-zucker/FediPod</a></p>
 </section>
 
-<!-- Shown only on a browser that has signed in but has never opened the signing
-     key. The key is kept on the pod encrypted under the sign-up password, so
-     the pod's host cannot sign as you; a browser opens it once and remembers.
-     The second block is for someone who no longer has that password: a new
-     key, locked under the password they use now. -->
+<!-- Shown only for an account made before 2026-09-22, whose signing key on
+     the pod is still under the password given at sign-up. It is opened once
+     and stored as it is from then on. The second block is for someone who no
+     longer has that password: a new key. -->
 <section id="unlock" hidden>
-  <h2>Unlock your signing key</h2>
-  <p>Your signing key is stored on your pod, locked under the password you gave
-  when you signed up, so nobody who can read your pod — your pod's host included
-  — can post as you. This browser has not opened it yet.</p>
+  <h2>Open your signing key</h2>
+  <p>Your account was made when this site kept your signing key under the
+  password you gave at sign-up. Enter that password once. Your key is then
+  stored on your pod as it is, behind your pod's own login, and no browser
+  asks again.</p>
   <p class="row">
     <input type="password" id="unlock-password" autocomplete="current-password"
-      placeholder="Your password" aria-label="Your password">
-    <button type="button" class="primary" id="unlock-go">unlock</button>
+      placeholder="The password you gave at sign-up" aria-label="The password you gave at sign-up">
+    <button type="button" class="primary" id="unlock-go">open</button>
   </p>
   <p class="err" id="unlock-error" role="alert"></p>
   <p class="hint">This browser only — it is not sent anywhere.</p>
-  <h2>Changed your pod password, or lost the old one?</h2>
-  <p>Make a new signing key, locked under the password you use now. Your account,
-  address, posts and followers stay as they are; other servers learn the new key
-  the next time they hear from you.</p>
+  <h2>Lost that password?</h2>
+  <p>Make a new signing key instead. Your account, address, posts and followers
+  stay as they are; other servers learn the new key the next time they hear
+  from you.</p>
   <p><button type="button" id="unlock-newkey">make a new signing key</button></p>
-  <p id="unlock-newkey-confirm" hidden>This replaces the key on your pod. Type the
-  password you use now in the field above, then
+  <p id="unlock-newkey-confirm" hidden>This replaces the key on your pod.
   <button type="button" id="unlock-newkey-go">make the new key</button></p>
 </section>
 
@@ -154,7 +153,7 @@ a { color: var(--accent); }
 
         <label for="provider">Pod provider</label>
         <!-- The providers listed at https://solidproject.org/get_a_pod that run Community
-             Solid Server, whose account API is what "A new pod" uses. Checked 2026-09-14. -->
+             Solid Server, whose sign-up page "Create your pod" links to. Checked 2026-09-14. -->
         <select id="provider" name="provider">
           <option value="https://solidcommunity.net">solidcommunity.net</option>
           <option value="https://privatedatapod.com">privatedatapod.com</option>
@@ -169,44 +168,35 @@ a { color: var(--accent); }
           <input type="url" id="providerOther" name="providerOther" autocomplete="url" placeholder="https://pods.example.org">
         </div>
 
-        <div id="podname-field">
-          <label for="podName">Pod username</label>
-          <input type="text" id="podName" name="podName" autocomplete="off" aria-describedby="podname-hint">
-          <p class="hint" id="podname-hint">Depending on your provider's setup, your pod will be at
-            either https://USERNAME.podprovider or https://podprovider/USERNAME.</p>
+        <div id="newpod-field">
+          <p>Make your pod on your provider's own page, then come back here.</p>
+          <p><a id="register-link" href="#" target="_blank" rel="noopener">Create your pod at your provider</a></p>
         </div>
 
-        <div id="pod-field" hidden>
-          <label for="pod">Pod address</label>
-          <input type="url" id="pod" name="pod" autocomplete="url" aria-describedby="pod-hint"
-            placeholder="https://alice.solidcommunity.net/ or https://server.example/alice/">
-          <p class="hint" id="pod-hint">The address of your pod: its own host, or a path on a
-            suffix-based host.</p>
-        </div>
-
-        <label for="email">Email (used as pod id)</label>
-        <input type="email" id="email" name="email" autocomplete="email" placeholder="you@example.org">
-
-        <label for="password">Pod password</label>
-        <input type="password" id="password" name="password" autocomplete="new-password"
-          aria-describedby="password-hint">
-        <p class="hint" id="password-hint">Your password is sent once, to make your account and to
-          lock your signing key. It is never stored. The credential used to set things up is
-          deleted when setup finishes — from then on this browser signs in through your pod,
-          the way any other Solid app does.</p>
+        <p class="hint" id="signin-hint">Your password is typed at your pod only. This site
+          never sees it: you sign in at your pod, and it sends you back here.</p>
       </fieldset>
       <p class="err" id="err-1" role="alert"></p>
       <p>
         <button type="button" id="cancel">Cancel</button>
-        <button type="button" class="primary" id="to-2">Continue</button>
+        <button type="button" class="primary" id="to-2">Sign in at your pod</button>
       </p>
     </div>
 
-    <!-- Screen 2: Your Fediverse Identity -->
+    <!-- Screen 2: Your Fediverse Identity — shown on return from the pod's login -->
     <div class="step" id="step-2" hidden>
       <fieldset>
         <legend>Your Fediverse Identity</legend>
 
+        <span id="signed-pod-label" class="grouplabel">Your pod</span>
+        <p id="signed-pod" role="status" aria-labelledby="signed-pod-label"></p>
+
+        <!-- Shown when the pod's account lives at another gateway: this is a
+             move, not a new account. -->
+        <p id="movein-note" hidden>Moving <strong id="movein-from"></strong> to this site.
+          Your posts, followers and key come with you, and your followers are told the
+          new address. Keep the same handle, or choose a new one here.</p>
+
         <label for="handle">Fediverse handle</label>
         <input type="text" id="handle" name="handle" autocomplete="off"
           placeholder="the handle part of your address: @HANDLE@server" aria-describedby="handle-hint">
@@ -229,7 +219,7 @@ a { color: var(--accent); }
       <p class="err" id="form-error" role="alert"></p>
       <p>
         <button type="button" id="back-1">Back</button>
-        <button type="submit" class="primary" id="submit">Create Pod and Fediverse accounts</button>
+        <button type="submit" class="primary" id="submit">Create your Fediverse account</button>
       </p>
     </div>
 

package/web/app/keys-browser.mjs

@@ -29,7 +29,7 @@ const isOpenedKey = (c) => c?.rsaPrivate?.type === 'private' && typeof c.rsaPubl
 /**
  * Keep this browser's opened copy: import the record and store the CryptoKey.
  * Best effort on the store — a browser that refuses IndexedDB (private mode)
- * asks for the password on the way back in. Returns the imported keys.
+ * reads the pod's copy again on the way back in. Returns the imported keys.
  */
 export async function cacheOpenedKeys(actorUrl, keysRecord) {
   const keys = await importSigningKey(keysRecord);
@@ -38,24 +38,22 @@ export async function cacheOpenedKeys(actorUrl, keysRecord) {
   return keys;
 }
 
-// Where this browser keeps its own opened copy of the signing key. The pod's
-// copy is wrapped under the account password; this one is not, because it never
-// leaves the origin — the same protection the OIDC session in the next IDB row
-// already relies on. It is what lets the worker boot itself after an idle kill
-// without a soul around to type anything.
+// Where this browser keeps its own opened copy of the signing key: a
+// non-extractable CryptoKey that never leaves the origin — the same protection
+// the OIDC session in the next IDB row already relies on. It is what lets the
+// worker boot itself after an idle kill without a network read.
 export const keyCacheKey = (actorUrl) => `signing-keys:${actorUrl}`;
 // The cache is keyed by the POD actor, whatever the identity advertises: a
 // fronted identity's advertised actor is the gateway's, and keying by that
-// would hide the opened copy sign-up stored and ask for the password again.
+// would hide the opened copy sign-up stored and read the pod again.
 export const podActorOf = (urls) => (urls.toPod ? urls.toPod(urls.actor) : urls.actor);
 
 // Read the signing key for this actor and import it for signing.
 //
-// Two places hold one: this browser (opened, in IndexedDB) and the pod (wrapped).
-// The browser's is tried first — it is the only one that can be read with no
-// password, and a service worker has nobody to ask. Falling through to the pod
-// covers the browser that has just signed in and has no copy yet: a bare record
-// there is from before wrapping and is used as it stands, while an envelope
+// Two places hold one: this browser (opened, in IndexedDB) and the pod. The
+// browser's is tried first — no network read. Falling through to the pod covers
+// the browser that has just signed in and has no copy yet: the record is read
+// with the pod session and used as it stands. An envelope from before 1.28.0
 // needs the password and so has to go back to the page.
 export async function loadKeysFromPod(remote, urls) {
   const podActor = podActorOf(urls);
@@ -65,10 +63,9 @@ export async function loadKeysFromPod(remote, urls) {
   // in its place, so the PEM is gone from storage after one boot.
   if (cached?.rsa?.privatePem) return cacheOpenedKeys(podActor, cached);
 
-  const doc = await podState.readWrappedKeys(remote, urls);
+  const doc = await podState.readKeys(remote, urls);
   if (isKeyEnvelope(doc)) throw new KeyPasswordNeeded();
   if (!doc || !doc.rsa) throw new Error('no signing key on the pod — sign up did not finish');
-  // A pre-wrapping install. Cache it so the next boot is one read, and leave
-  // the pod's copy alone: re-wrapping it would need the password we do not have.
+  // Cache it so the next boot is no read at all.
   return cacheOpenedKeys(podActor, doc);
 }

package/web/app/keystore.mjs

@@ -1,22 +1,19 @@
-// keystore.mjs — the signing keys, made in the browser and locked under the
-// account password, so the copy that lives on the pod is ciphertext.
+// keystore.mjs — the signing keys, made in the browser and stored on the pod.
 //
 // The Node agent keeps keys.json (RSA + Ed25519 PEMs) on disk, 0600. A browser
 // has no disk it can carry to the next machine, so the durable copy lives on
-// the pod, wrapped here first: the pod's owner-only ACL keeps strangers out,
-// and the password keeps the pod's HOST out — which the ACL cannot do, and
-// which matters more for a key than for any other document, because whoever
-// holds it is you to every server in the fediverse. The shape inside is exactly
-// the agent's keys.json, so once unwrapped it is used unchanged.
+// the pod, in an owner-only container: the same access rule every private
+// document on the pod lives under, reachable through the pod's own login and
+// by nobody else. The shape is exactly the agent's keys.json, so it is used
+// unchanged. A new browser reads it with its pod session and asks for nothing.
 //
-// Each browser opens it once and keeps the opened copy in its own IndexedDB
-// (see keys-browser.mjs). That is what lets the service worker boot itself
-// after an idle kill with nobody present to type anything, and it is why a NEW
-// browser asks for the password and a returning one does not.
-//
-// Until 2026-09-09 the wrap existed here but nothing called it: signup PUT the
-// bare record and the loader read it plain, while this header, web/app/README.md
-// and claude/plans/browser-agent.md all said otherwise. Now they agree.
+// Until 2026-09-22 the pod's copy was encrypted under the pod password, so a
+// new browser had to ask for the password once. That sealed the key against
+// the pod's host, which the access rule cannot do, at the price of fedipod.net
+// asking for a pod password. Jeff decided the host is trusted the way it is
+// for every other document, and the password went. `unwrapKeys`,
+// `isKeyEnvelope` and `KeyPasswordNeeded` remain for accounts made before
+// then: their key is opened once with the password and stored as it is.
 
 const PEM = (der, label) => {
   const b64 = btoa(String.fromCharCode(...new Uint8Array(der)));
@@ -56,38 +53,24 @@ async function deriveAesKey(password, salt, iterations) {
     base, { name: 'AES-GCM', length: 256 }, false, ['encrypt', 'decrypt']);
 }
 
-const toB64 = (buf) => btoa(String.fromCharCode(...new Uint8Array(buf)));
 const fromB64 = (s) => Uint8Array.from(atob(s), (c) => c.charCodeAt(0));
 
-/** Whether a document read off the pod is a wrapped envelope rather than a bare
- *  keys record. Installs made before wrapping have the bare record there, and
- *  those still have to boot — the shape is what tells them apart. */
+/** Whether a document read off the pod is an envelope from before 1.28.0
+ *  rather than the keys record. The shape is what tells them apart. */
 export function isKeyEnvelope(doc) {
   return !!doc && doc.v === 1 && typeof doc.ct === 'string' && typeof doc.salt === 'string';
 }
 
-/** Thrown when the pod holds a wrapped key and nothing in this browser can open
- *  it. The page catches it by `code` and asks for the account password; the
- *  worker cannot ask anyone anything. */
+/** Thrown when the pod holds a key from before 1.28.0, under a password, and
+ *  nothing in this browser can open it. The page catches it by `code` and asks
+ *  for the password once; the worker cannot ask anyone anything. */
 export class KeyPasswordNeeded extends Error {
   constructor() { super('this browser needs your account password to unlock the signing key'); }
   code = 'key-password-needed';
 }
 
-/** Wrap the keys record under the password. The envelope names its own KDF and
- *  parameters, so unwrap needs only the password and this document. */
-export async function wrapKeys(keysRecord, password) {
-  const salt = crypto.getRandomValues(new Uint8Array(16));
-  const iv = crypto.getRandomValues(new Uint8Array(12));
-  const aes = await deriveAesKey(password, salt, PBKDF2_ITERATIONS);
-  const plaintext = new TextEncoder().encode(JSON.stringify(keysRecord));
-  const ct = await crypto.subtle.encrypt({ name: 'AES-GCM', iv }, aes, plaintext);
-  return { v: 1, kdf: 'PBKDF2-SHA256', iterations: PBKDF2_ITERATIONS,
-    salt: toB64(salt), iv: toB64(iv), ct: toB64(ct) };
-}
-
-/** Unwrap an envelope wrapKeys made. Throws on a wrong password (AES-GCM auth
- *  failure) — which is how a new browser tells a typo from a real key. */
+/** Open an envelope from before 1.28.0. Throws on a wrong password (AES-GCM
+ *  auth failure) — which is how the page tells a typo from a real problem. */
 export async function unwrapKeys(envelope, password) {
   if (!envelope || envelope.v !== 1) throw new Error('not a key envelope');
   const aes = await deriveAesKey(password, fromB64(envelope.salt), envelope.iterations);