fedipod-server 0.26.0 → 0.28.1

package/lib/gateway/front-core.mjs

@@ -21,6 +21,10 @@ import { readCapped, safeFetch, isLoopbackHost } from '../shared/safefetch.mjs';
 import * as podRoot from '../pod/root.mjs';
 import * as podPolicy from '../pod/policy.mjs';
 import { podBaseOfWebId } from '../pod/urls.mjs';
+import { routeQuietApi, noteOpened, noteReceived, closedState, accountState, closedAnswer } from './quiet.mjs';
+import { routeNoticesApi } from './notices.mjs';
+import { withSecurityHeaders } from './headers.mjs';
+import { podTokenVerifier } from './caches.mjs';
 
 // The one WebFinger document, spelled out here rather than imported from
 // wire.mjs: wire drags the agent's whole HTML pipeline (sanitize-html and
@@ -59,7 +63,7 @@ async function verifyPodToken(request, pathname, verifier) {
     // Solid-OIDC binds the token to a key the client proves on every request;
     // a token shown without the proof is one anyone who saw it could show.
     if (!dpop) { console.log(`front: pod token without a DPoP proof refused on ${pathname}`); return null; }
-    const v = verifier || (await import('@solid/access-token-verifier')).createSolidTokenVerifier();
+    const v = verifier || await podTokenVerifier();
     const url = request.url;
     const { webid } = await v(authz, { header: dpop, method: request.method, url });
     return webid || null;
@@ -150,6 +154,19 @@ const RELAY_HEADERS = new Set(['date', 'digest', 'signature', 'content-type', 'a
 
 const keyIdOf = (signature) => (/keyId="([^"]+)"/.exec(signature || '') || [])[1] || null;
 
+// The owner's APIs a browser at ANOTHER origin may call: an address moving
+// to a new gateway is driven from the new gateway's page, and it has to tell
+// this one it moved and send the Move through this one's relay. Both take a
+// pod token as proof, the way the outbox door does, so any origin may ask.
+const API_CORS = {
+  'access-control-allow-origin': '*',
+  'access-control-allow-methods': 'POST, OPTIONS',
+  'access-control-allow-headers': 'Authorization, DPoP, Content-Type',
+  'access-control-max-age': '86400',
+};
+const withApiCors = (out) => ({ ...out, headers: { ...(out.headers || {}), ...API_CORS } });
+const apiPreflight = () => ({ status: 204, headers: { ...API_CORS, allow: 'POST, OPTIONS' }, body: null });
+
 async function relayOne(item, rec, fetchImpl) {
   const url = String(item?.url || '');
   const method = String(item?.method || 'POST').toUpperCase();
@@ -192,7 +209,9 @@ async function relayOne(item, rec, fetchImpl) {
 
 const j = (status, obj, ct = 'application/json') =>
   ({ status, headers: { 'content-type': ct, 'cache-control': 'no-store' }, body: JSON.stringify(obj) });
-const notFound = () => ({ status: 404, headers: { 'content-type': 'text/plain' }, body: 'not found\n' });
+// Held at the edge like any other missing document: a bot's scan, a dead
+// handle, a typo in a WebFinger query each cost one call, not one per asker.
+const notFound = () => ({ status: 404, headers: { 'content-type': 'text/plain', ...publicFor(MISSING_EDGE_SECONDS) }, body: 'not found\n' });
 
 // A user's public base on the front, a 1:1 mirror of their pod home.
 // The directory key is the FULL fediverse address — handle@host — never the
@@ -228,7 +247,9 @@ function parseUserPath(pathname) {
 const BROWSER_MAX_AGE = 60;
 const publicFor = (seconds, stale = seconds * 4) => ({
   'cache-control': `public, max-age=${Math.min(seconds, BROWSER_MAX_AGE)}`,
-  'netlify-cdn-cache-control': `public, s-maxage=${seconds}, stale-while-revalidate=${stale}`,
+  // `durable`: one copy for every region, and one that a deploy does not
+  // empty. Without it each region held its own and every deploy started cold.
+  'netlify-cdn-cache-control': `public, durable, s-maxage=${seconds}, stale-while-revalidate=${stale}`,
 });
 // How long the edge holds a public document, and a handle's WebFinger
 // answer. Every server that has heard of an account asks for its actor and
@@ -237,6 +258,15 @@ const publicFor = (seconds, stale = seconds * 4) => ({
 // can afford.
 const PUBLIC_EDGE_SECONDS = 600;
 const WEBFINGER_EDGE_SECONDS = 3600;
+// A closed or moved address stays gone; a picture's address stays where it is.
+const GONE_EDGE_SECONDS = 3600;
+const MEDIA_EDGE_SECONDS = 86400;
+// A public document the pod would not give (missing, or not public) is asked
+// for again and again by every server that shows the account — a pinned-posts
+// collection an old account never wrote, a forum count nobody published. Held
+// briefly, so the edge absorbs the asking; briefly, so a document published a
+// moment later is not "missing" for long.
+const MISSING_EDGE_SECONDS = 120;
 
 // Where a pod owner opts their identity in. An operator may name it, because
 // the path it takes is one their pod server can no longer serve; the dot says
@@ -263,7 +293,7 @@ const sameOriginRequest = (request, origin) => {
 
 // Top-level paths a handle may not take, so a name never shadows a route.
 const RESERVED = new Set(['u', 'api', 'signup', 'new-account', 'run', 'admin', 'roster', 'gateway',
-  'gw', 'well-known', 'inbox', 'outbox', 'actor', 'install']);
+  'gw', 'well-known', 'inbox', 'outbox', 'actor', 'install', 'notices']);
 
 // Why a handle is unusable, or null when it is fine. Lowercase letters, digits
 // and hyphens; 2–30 chars; not edge-hyphenated; not a reserved route.
@@ -319,6 +349,7 @@ function identFor(rec, policy = null) {
 //   listDirectory() -> { handle: record }  every row, for the admin roster
 //   removeDirectory(handle) -> boolean     drop a row; false when a seeded row remains
 //   podPut(url, body, ct) -> boolean      append to a user's pod (per-user cred inside)
+//   readReceived / writeReceived / dropReceived, pauseItems, closeDays — see quiet.mjs
 //   podGet(url, { podHome }) -> Response   read a user's pod (public reads; plain fetch
 //                                          is fine). `podHome` is the row's own pod, for
 //                                          an adapter that reads a store directly and so
@@ -328,51 +359,6 @@ export async function routeFront(request, ctx) {
   return { ...out, headers: withSecurityHeaders(out.headers, out.body) };
 }
 
-// Every response this file makes, hardened in one place rather than in each of
-// the dozen shapes below.
-//
-// `nosniff` matters most: the front serves user-supplied JSON straight from
-// somebody's pod (the proxied actor and object documents), and without it a
-// browser is free to decide for itself that a document is HTML and run what is
-// inside it. The rest is the same posture the app already has — nothing may be
-// framed, no base tag may be rewritten, no plugin content.
-//
-// A content-security-policy goes on the HTML only: it would mean nothing on a
-// JSON document, and `frame-ancestors` has to be a header rather than a meta
-// tag anyway.
-//
-// `script-src 'self'` is the one that matters, and it is only possible because
-// none of these pages carries inline script any more — each has its own file and
-// its own route above. A policy cannot tell an inline block the author wrote
-// from one an attacker injected, so as long as any inline script has to run,
-// every inline script may.
-//
-// `connect-src` allows https: because the pages sign in against the user's own
-// pod, which is a different origin by definition and not one we can name here.
-function withSecurityHeaders(headers = {}, body = null) {
-  const ct = String(headers['content-type'] || '');
-  const isHtml = ct.startsWith('text/html');
-  return {
-    ...headers,
-    'x-content-type-options': 'nosniff',
-    'referrer-policy': 'same-origin',
-    'x-frame-options': 'SAMEORIGIN',
-    ...(isHtml && body ? {
-      'content-security-policy': [
-        "default-src 'self'",
-        "script-src 'self'",             // no inline script: see above
-        "style-src 'self' 'unsafe-inline'",
-        "img-src 'self' https: data:",
-        "connect-src 'self' https:",     // sign-in goes to the user's own pod
-        "object-src 'none'",             // no plugin content, ever
-        "base-uri 'none'",               // no rewriting where relative URLs resolve
-        "frame-ancestors 'self'",        // nobody else may frame these pages
-        "form-action 'self'",            // a form here submits here
-      ].join('; '),
-    } : {}),
-  };
-}
-
 async function route(request, ctx) {
   const url = new URL(request.url);
   const { pathname } = url;
@@ -396,14 +382,13 @@ async function route(request, ctx) {
     return { status: 200, headers: { 'content-type': 'text/html; charset=utf-8', 'cache-control': 'no-cache' }, body: ctx.runPage };
   }
 
-  // The roster page: the host reading who has accounts here. The page signs in
-  // and calls the roster API below; a deploy with no admin supplies no page.
-  // Off /admin, which is the owner's own record page on every agent.
-  if (pathname === '/roster') {
-    if (request.method !== 'GET' && request.method !== 'HEAD') return { status: 405, headers: {}, body: '' };
-    if (!ctx.adminPage) return notFound();
-    return { status: 200, headers: { 'content-type': 'text/html; charset=utf-8' }, body: ctx.adminPage };
-  }
+  // The roster page (/roster, off /admin, which is the owner's own record
+  // page on every agent) is served with the notices page, in notices.mjs.
+
+  // Notices from the operator to every account here, and the page they are
+  // written on (notices.mjs).
+  const notices = await routeNoticesApi(request, pathname, ctx, { j, verifyPodToken, publicFor, notFound });
+  if (notices) return notices;
 
   // The roster: every directory row, secrets stripped, for the host's own
   // eyes. The reader proves themself the way attach proves a pod — a
@@ -419,6 +404,7 @@ async function route(request, ctx) {
         handle: r.handle, kind: r.kind || 'person', fronted: !r.inboxOnly,
         podHome: r.podHome, webId: r.webId || null, actorUrl: r.actorUrl,
         address: r.address || `@${r.handle}@${ctx.host}`,
+        openedAt: r.openedAt || null, pausedAt: r.pausedAt || null, closedAt: r.closedAt || null,
       }))
       .sort((a, b) => (a.address || a.handle).localeCompare(b.address || b.handle));
     return j(200, { host: ctx.host, accounts });
@@ -593,6 +579,43 @@ async function route(request, ctx) {
       command: `fedipod gateway ${doorInbox} --secret ${hmacSecret} --inbox-only` });
   }
 
+  // An address at this gateway moving to another one. Its owner, proved the
+  // way attach proves a pod, says where it went. From then on this front
+  // answers the old actor as a moved stub — the same key under the old id,
+  // `movedTo` the new one, so the Move the owner sends from the old address
+  // verifies — every other old id redirects to its new address, and the
+  // mail door is shut: deliveries belong at the new one. Repeating it with
+  // the same target changes nothing.
+  if (pathname === '/api/move' && request.method === 'OPTIONS') return apiPreflight();
+  if (pathname === '/api/move' && request.method === 'POST') {
+    if (!ctx.putDirectory) return withApiCors(j(501, { error: 'this front keeps no directory' }));
+    let body;
+    try { body = JSON.parse(await request.clone().text()); } catch { return withApiCors(j(400, { error: 'bad JSON' })); }
+    const handle = String(body.handle || '').toLowerCase();
+    const rec = await ctx.lookup(handle);
+    if (!rec) return withApiCors(j(404, { error: 'no such account' }));
+    if (rec.inboxOnly) return withApiCors(j(400, { error: 'this address lives on its pod; only an address at this gateway can move' }));
+    const movedTo = String(body.movedTo || '');
+    let mu;
+    try { mu = new URL(movedTo); } catch { return withApiCors(j(400, { error: 'movedTo must be the new actor URL' })); }
+    if (!((mu.protocol === 'https:' || (mu.protocol === 'http:' && isLoopbackHost(mu.hostname))) && /\/ap\/actor$/u.test(mu.pathname))) {
+      return withApiCors(j(400, { error: 'movedTo must be an https …/ap/actor URL' }));
+    }
+    if (ctx.frontOrigin && mu.origin === new URL(ctx.frontOrigin).origin) return withApiCors(j(400, { error: 'that address is at this gateway' }));
+    const webid = await verifyPodToken(request, pathname, ctx.verifier);
+    if (!webid) return withApiCors(j(401, { error: 'a Solid-OIDC token proving the pod is required' }));
+    const owner = rec.webId ? webid === rec.webId : webidUnderPod(webid, rec.podHome);
+    if (!owner) return withApiCors(j(403, { error: "the token proves a different pod than this account's" }));
+    const movedAt = rec.movedTo === movedTo && rec.movedAt ? rec.movedAt : new Date().toISOString();
+    await ctx.putDirectory(handle, { ...rec, movedTo, movedAt });
+    console.log(`front @${handle}: moved to ${movedTo}`);
+    return withApiCors(j(200, { ok: true, handle, movedTo, movedAt }));
+  }
+
+  // The owner's say over an account that goes quiet (quiet.mjs).
+  const quiet = await routeQuietApi(request, pathname, ctx, { j, verifyPodToken, webidUnderPod, apiPreflight });
+  if (quiet) return withApiCors(quiet);
+
   // The relay: the front sends requests a browser has already signed. A page
   // may not set the Date or Host header, and both are inside an HTTP
   // signature, so a browser-run agent signs and hands the request here; the
@@ -600,24 +623,27 @@ async function route(request, ctx) {
   // a signature and cannot make one. Only the account's own key may sign,
   // only the account's own pod may call, and nothing unsigned-for reaches
   // the remote server.
+  if (pathname === '/api/relay' && request.method === 'OPTIONS') return apiPreflight();
   if (pathname === '/api/relay' && request.method === 'POST') {
     let body;
-    try { body = JSON.parse(await request.clone().text()); } catch { return j(400, { error: 'bad JSON' }); }
+    try { body = JSON.parse(await request.clone().text()); } catch { return withApiCors(j(400, { error: 'bad JSON' })); }
     const handle = String(body.handle || '').toLowerCase();
     const rec = await ctx.lookup(handle);
-    if (!rec) { console.log(`relay: no account named ${handle}`); return j(404, { error: 'no such account' }); }
+    if (!rec) { console.log(`relay: no account named ${handle}`); return withApiCors(j(404, { error: 'no such account' })); }
     const webid = await verifyPodToken(request, pathname, ctx.verifier);
-    if (!webid) { console.log(`relay @${handle}: no usable pod token`); return j(401, { error: 'a Solid-OIDC token proving the pod is required' }); }
+    if (!webid) { console.log(`relay @${handle}: no usable pod token`); return withApiCors(j(401, { error: 'a Solid-OIDC token proving the pod is required' })); }
     const owner = rec.webId ? webid === rec.webId : webidUnderPod(webid, rec.podHome);
-    if (!owner) { console.log(`relay @${handle}: token is for ${webid}, not this account's pod`); return j(403, { error: "the token proves a different pod than this account's" }); }
+    if (!owner) { console.log(`relay @${handle}: token is for ${webid}, not this account's pod`); return withApiCors(j(403, { error: "the token proves a different pod than this account's" })); }
     const items = Array.isArray(body.requests) ? body.requests : [];
-    if (!items.length) return j(400, { error: 'requests must be a non-empty list' });
-    if (items.length > RELAY_MAX_REQUESTS) return j(400, { error: `at most ${RELAY_MAX_REQUESTS} requests per call` });
+    if (!items.length) return withApiCors(j(400, { error: 'requests must be a non-empty list' }));
+    // Acting through the relay is being here. Hourly at most; see noteOpened.
+    await noteOpened(ctx, handle, rec).catch((e) => console.log(`relay @${handle}: stamp not written: ${e?.message || e}`));
+    if (items.length > RELAY_MAX_REQUESTS) return withApiCors(j(400, { error: `at most ${RELAY_MAX_REQUESTS} requests per call` }));
     const results = await Promise.all(items.map((it) => relayOne(it, rec, ctx.fetchImpl || fetch)));
     // One line per relayed request, so a lookup that fails on the far side is
     // visible here and not only as an empty result in someone's browser.
     for (const r of results) console.log(`relay @${handle}: ${r.method || ''} ${r.url} → ${r.status}${r.error ? ` (${r.error})` : ''}`);
-    return j(200, { results });
+    return withApiCors(j(200, { results }));
   }
 
   // Who is here, and which pod of theirs could opt in. The opt-in page asks
@@ -720,7 +746,7 @@ async function route(request, ctx) {
   //
   // The name is matched against a literal list, so nothing about the request
   // chooses a file.
-  const mPageScript = /^\/(new-account|run|admin)\.js$/u.exec(pathname);
+  const mPageScript = /^\/(new-account|run|admin|notices)\.js$/u.exec(pathname);
   if (mPageScript) {
     const body = ctx.pageScripts?.[`${mPageScript[1]}.js`];
     if (!body) return notFound();
@@ -750,6 +776,9 @@ async function route(request, ctx) {
     if (!m || m[2] !== ctx.host) return notFound();
     const rec = await ctx.lookup(m[1]);
     if (!rec) return notFound();
+    // A closed address is gone, and says so rather than pretending never to
+    // have existed: the name stays taken.
+    if ((await closedState(ctx, m[1], rec)).closed) return closedAnswer({ 'access-control-allow-origin': '*', ...publicFor(GONE_EDGE_SECONDS) });
     // A fronted identity's documents live on its pod; the pod's own actor id
     // is the alias, so a client signing in by the fronted address can find
     // the pod (and its login) without a lookup only the host could answer.
@@ -787,16 +816,28 @@ async function route(request, ctx) {
   const rec = await ctx.lookup(up.handle);
   if (!rec) return notFound();
   const base = userBase(ctx.frontOrigin, up.handle);
+  // An account that moved to another gateway (see /api/move): where its ids
+  // live now. The actor below answers as a stub; everything else redirects.
+  const movedBase = rec.movedTo ? rec.movedTo.replace(/ap\/actor$/u, '') : null;
+  // A closed address (see "accounts that go quiet" above): every id under it
+  // is gone. Asked after moved, which a close does not undo.
+  const closed = movedBase ? false : (await closedState(ctx, up.handle, rec)).closed;
+  const gone = (headers = {}, why = `this account has moved to ${rec.movedTo}`) => closedAnswer(headers, why);
+  const CLOSED = 'this address is closed';
 
   // Inbox: verify at the door, forward to the user's pod inbox. This is the
   // gateway, per user.
   if (up.rest === 'ap/inbox/' || up.rest === 'ap/inbox') {
     if (request.method !== 'POST') return { status: 405, headers: {}, body: '' };
+    if (movedBase) { console.log(`door @${up.handle}: delivery → 410 (moved)`); return gone(); }
+    if (closed) { console.log(`door @${up.handle}: delivery → 410 (closed)`); return gone({}, CLOSED); }
     const policy = await policyFor(rec, ctx.fetchImpl || fetch);
-    const { status, reason } = await handleDelivery(request, identFor(rec, policy),
-      { podPut: (u, b, ct) => ctx.podPut(up.handle, u, b, ct), fetchImpl: ctx.fetchImpl });
+    const standing = await accountState(ctx, up.handle, rec);
+    const { status, reason, content, bytes } = await handleDelivery(request, identFor(rec, policy),
+      { podPut: (u, b, ct) => ctx.podPut(up.handle, u, b, ct), fetchImpl: ctx.fetchImpl, paused: standing.paused });
     // One line per delivery, so "did it arrive at the door" has an answer.
     console.log(`door @${up.handle}: delivery → ${status} (${reason})`);
+    if (status === 202 && content) await noteReceived(ctx, up.handle, rec, bytes);
     return { status, headers: {}, body: '' };
   }
 
@@ -822,6 +863,11 @@ async function route(request, ctx) {
       return { status: 204, headers: { ...cors, allow: 'GET, POST, OPTIONS',
         'accept-post': 'application/ld+json, application/activity+json' }, body: null };
     }
+    if (movedBase && request.method === 'POST') return gone(cors);
+    if (closed && request.method === 'POST') return gone(cors, CLOSED);
+    if (movedBase && (request.method === 'GET' || request.method === 'HEAD')) {
+      return { status: 301, headers: { ...cors, location: movedBase + up.rest, 'cache-control': 'no-store' }, body: '' };
+    }
     if (request.method === 'POST') {
       const json = (status, obj, extra = {}) => ({ status,
         headers: { ...cors, 'content-type': 'application/json', 'cache-control': 'no-store', ...extra },
@@ -833,8 +879,8 @@ async function route(request, ctx) {
       const { status, reason, location } = await handleOwnerPost(request, identFor(rec),
         { podPut: (u, b, ct) => ctx.podPut(up.handle, u, b, ct), ownerWebId: webid });
       console.log(`door @${up.handle}: owner post → ${status} (${reason})`);
-      if (status !== 202) return json(status, { error: reason });
-      return json(202, { accepted: true, ...(location ? { object: location } : {}),
+      if (status !== 201) return json(status, { error: reason });
+      return json(201, { accepted: true, ...(location ? { object: location } : {}),
         note: 'it goes out when your FediPod agent next runs' }, location ? { location } : {});
     }
     if (rec.inboxOnly && (request.method === 'GET' || request.method === 'HEAD')) {
@@ -854,13 +900,19 @@ async function route(request, ctx) {
       'access-control-allow-headers': 'Accept', 'access-control-max-age': '86400', allow: 'GET, HEAD, OPTIONS' }, body: null };
   }
   if (request.method !== 'GET' && request.method !== 'HEAD') return { status: 405, headers: {}, body: '' };
+  // Moved: every old id but the actor's answers with where it is now, so a
+  // reply or a boost another server still holds under the old id resolves.
+  if (movedBase && up.rest !== 'ap/actor') {
+    return { status: 301, headers: { ...open, location: movedBase + up.rest, 'cache-control': 'no-store' }, body: '' };
+  }
+  if (closed) return gone({ ...open, ...publicFor(GONE_EDGE_SECONDS) }, CLOSED);
   const podTarget = rec.podHome + up.rest;
   // Media stays on the pod (lib/pod/urls.mjs keeps `media` off the front), but
   // the id rewrite below turns media links onto the front like every other
   // pod url in a document. Answer those by pointing at the pod: bytes are not
   // a document to cap and relabel, and remotes follow a redirect for a picture.
   if (up.rest.startsWith('ap/media/')) {
-    return { status: 302, headers: { location: podTarget, 'cache-control': 'no-store' }, body: '' };
+    return { status: 302, headers: { location: podTarget, ...publicFor(MEDIA_EDGE_SECONDS) }, body: '' };
   }
   // The pod this read belongs to travels with it: an adapter reading a store
   // directly (the CSS server component) has no access control of its own and
@@ -876,15 +928,35 @@ async function route(request, ctx) {
   const got = await podRoot.readPublicDocument(
     ctx.podGet || ((u) => fetch(u, { headers: { accept } })),
     podTarget, { podHome: rec.podHome, accept });
-  if (got.text === null) return { status: got.status, headers: open, body: '' };
+  if (got.text === null) {
+    const hold = [401, 403, 404, 410].includes(got.status) ? publicFor(MISSING_EDGE_SECONDS) : {};
+    return { status: got.status, headers: { ...open, ...hold }, body: '' };
+  }
   let text = got.text;
   text = swap(text, rec.podHome, base);
+  // The moved stub: the pod's actor now carries the NEW gateway's ids, and a
+  // server verifying the Move fetches the OLD id and needs a document whose
+  // id is that old id — with the same key under it, and `movedTo` saying
+  // where the account went. Swapping the new base back to this one gives
+  // exactly that; alsoKnownAs and movedTo are set below.
+  if (movedBase) text = swap(text, movedBase, base);
   if (up.rest === 'ap/actor') {
     try {
       const doc = JSON.parse(text);
       doc.preferredUsername = up.handle;               // so @handle@front cross-checks
       doc.inbox = base + 'ap/inbox/';                  // deliveries come to the front to be verified
       doc.endpoints = { ...(doc.endpoints || {}), sharedInbox: base + 'ap/inbox/' };
+      if (movedBase) {
+        doc.movedTo = rec.movedTo;
+        const aka = new Set([].concat(doc.alsoKnownAs || []).filter((a) => typeof a === 'string' && a !== doc.id));
+        aka.add(rec.movedTo);
+        doc.alsoKnownAs = [...aka];
+        const ctxs = [].concat(doc['@context'] || []);
+        const declared = (term) => ctxs.some((c) => c && typeof c === 'object' && term in c);
+        if (!declared('alsoKnownAs')) ctxs.push({ alsoKnownAs: { '@id': 'as:alsoKnownAs', '@type': '@id' } });
+        if (!declared('movedTo')) ctxs.push({ movedTo: { '@id': 'as:movedTo', '@type': '@id' } });
+        doc['@context'] = ctxs;
+      }
       text = JSON.stringify(doc);
     } catch { /* leave the rewritten text as-is if it will not parse */ }
   }

package/lib/gateway/gateway-core.mjs

@@ -15,13 +15,16 @@
 import crypto from 'node:crypto';
 import { verifyHttpSignature, makeSafeLoader, makeReceipt, signReceipt } from './httpsig.mjs';
 import * as inbox from '../pod/inbox.mjs';
+import { senderKeys } from './caches.mjs';
 
 const DEFAULT_MAX_BYTES = 512 * 1024;   // mirror intake.mjs MAX_ITEM_BYTES
 
 // Control activities are the message itself and must always pass — you want
-// Follows from strangers. Only CONTENT is subject to the concerns-us drop.
-const CONTROL = new Set(['Follow', 'Undo', 'Accept', 'Reject', 'Delete', 'Move',
+// Follows from strangers. Only CONTENT is subject to the concerns-us drop,
+// and to a pause: an account nobody is reading still takes its follows.
+export const CONTROL = new Set(['Follow', 'Undo', 'Accept', 'Reject', 'Delete', 'Move',
   'Add', 'Remove', 'Block']);
+export const isControl = (type) => CONTROL.has(type);
 
 const idOf = (v) => (typeof v === 'string' ? v : v?.id) || null;
 const sha256hex = (s) => crypto.createHash('sha256').update(s).digest('hex');
@@ -64,8 +67,13 @@ function concernsUsAtEdge(activity, ident) {
 // resolved identity policy: { inboxUrl, actorUrl, followersUrl, notesPrefix,
 // following, blocklist, kind, gatewayWebId, hmacSecret }. `podPut(url, body,
 // contentType) → boolean` appends to the pod with the gateway's credential.
-// Returns { status, reason } — the adapter turns it into an HTTP response.
-export async function handleDelivery(request, ident, { podPut, fetchImpl = fetch, maxBytes = DEFAULT_MAX_BYTES } = {}) {
+// `paused` says nobody is reading this inbox: content is accepted and
+// discarded (the same quiet 202 a blocked sender gets, so nothing retries
+// and nothing counts a failure against this host), control still lands.
+// Returns { status, reason } — the adapter turns it into an HTTP response —
+// and, for a delivery that reached the pod, `content` (whether it was
+// content rather than control) and `bytes`, so the caller can keep count.
+export async function handleDelivery(request, ident, { podPut, fetchImpl = fetch, maxBytes = DEFAULT_MAX_BYTES, paused = false } = {}) {
   // Read the body once from a clone; the original, unconsumed, goes to the
   // verifier (which needs the body for the Digest check).
   let raw;
@@ -80,12 +88,16 @@ export async function handleDelivery(request, ident, { podPut, fetchImpl = fetch
   // Edge drops — silent 202 so a rejected sender does not retry a delivery we
   // will never accept. None of these becomes a pod write.
   if (isBlocked(actor, ident.blocklist)) return { status: 202, reason: 'blocked' };
-  if (!CONTROL.has(activity.type) && !concernsUsAtEdge(activity, ident)) {
+  const content = !CONTROL.has(activity.type);
+  if (content && paused) return { status: 202, reason: 'paused' };
+  if (content && !concernsUsAtEdge(activity, ident)) {
     return { status: 202, reason: 'does not concern us' };
   }
 
+  // The sender's key, kept between deliveries: a server pushing a hundred
+  // items is asked for its key once (caches.mjs).
   const v = await verifyHttpSignature(request, {
-    documentLoader: makeSafeLoader({ fetchImpl }),
+    documentLoader: makeSafeLoader({ fetchImpl }), keyCache: senderKeys,
   });
   // A present-but-invalid signature is a forgery — dropped here, so it never
   // reaches the pod (today it would, drain, and die unapplied). An absent or
@@ -107,7 +119,7 @@ export async function handleDelivery(request, ident, { podPut, fetchImpl = fetch
   // holding any state.
   if (!okA) return { status: 502, reason: 'pod inbox write failed' };
   if (receipt) await inbox.writeReceiptBeside(podPut, ident.inboxUrl, hash, receipt);
-  return { status: 202, reason: v.verified ? 'verified' : 'buffered-unverified' };
+  return { status: 202, reason: v.verified ? 'verified' : 'buffered-unverified', content, bytes: Buffer.byteLength(raw) };
 }
 
 // The outbox door: the owner's own post, taken on their behalf.
@@ -147,7 +159,7 @@ export async function handleOwnerPost(request, ident, { podPut, ownerWebId, maxB
   const okA = await inbox.appendVerifiedDelivery(podPut, ident.inboxUrl, hash, raw);
   if (!okA) return { status: 502, reason: 'pod inbox write failed' };
   await inbox.writeReceiptBeside(podPut, ident.inboxUrl, hash, receipt);
-  return { status: 202, reason: 'accepted', location: slug && ident.notesPrefix ? ident.notesPrefix + slug : null };
+  return { status: 201, reason: 'accepted', location: slug && ident.notesPrefix ? ident.notesPrefix + slug : null };
 }
 
 export const _internal = { isBlocked, concernsUsAtEdge, httpUrl, sha256hex };

package/lib/gateway/headers.mjs

@@ -0,0 +1,49 @@
+// headers.mjs — the hardening every front response carries, in one place.
+// Split out of front-core.mjs, which is at its size gate; nothing here knows
+// about routes.
+
+// Every response this file makes, hardened in one place rather than in each of
+// the dozen shapes below.
+//
+// `nosniff` matters most: the front serves user-supplied JSON straight from
+// somebody's pod (the proxied actor and object documents), and without it a
+// browser is free to decide for itself that a document is HTML and run what is
+// inside it. The rest is the same posture the app already has — nothing may be
+// framed, no base tag may be rewritten, no plugin content.
+//
+// A content-security-policy goes on the HTML only: it would mean nothing on a
+// JSON document, and `frame-ancestors` has to be a header rather than a meta
+// tag anyway.
+//
+// `script-src 'self'` is the one that matters, and it is only possible because
+// none of these pages carries inline script any more — each has its own file and
+// its own route above. A policy cannot tell an inline block the author wrote
+// from one an attacker injected, so as long as any inline script has to run,
+// every inline script may.
+//
+// `connect-src` allows https: because the pages sign in against the user's own
+// pod, which is a different origin by definition and not one we can name here.
+export function withSecurityHeaders(headers = {}, body = null) {
+  const ct = String(headers['content-type'] || '');
+  const isHtml = ct.startsWith('text/html');
+  return {
+    ...headers,
+    'x-content-type-options': 'nosniff',
+    'referrer-policy': 'same-origin',
+    'x-frame-options': 'SAMEORIGIN',
+    ...(isHtml && body ? {
+      'content-security-policy': [
+        "default-src 'self'",
+        "script-src 'self'",             // no inline script: see above
+        "style-src 'self' 'unsafe-inline'",
+        "img-src 'self' https: data:",
+        "connect-src 'self' https:",     // sign-in goes to the user's own pod
+        "object-src 'none'",             // no plugin content, ever
+        "base-uri 'none'",               // no rewriting where relative URLs resolve
+        "frame-ancestors 'self'",        // nobody else may frame these pages
+        "form-action 'self'",            // a form here submits here
+      ].join('; '),
+    } : {}),
+  };
+}
+

package/lib/gateway/notices.mjs

@@ -0,0 +1,84 @@
+// notices.mjs — notices from whoever runs the front, to every account here.
+//
+// The operator writes them on the /notices page, proved as the admin the way
+// the roster is; every page of ours asks GET /api/notices once per load and
+// shows a bell when there are any. A notice is a title, a plain-text body and
+// a time. The body is never markup: the pages render it as text.
+//
+// Kept beside the directory, in a store the adapter supplies:
+//   listNotices() -> { id: notice }     putNotice(id, notice)     deleteNotice(id)
+// A front that supplies none has no notices to offer, and says so.
+
+import crypto from 'node:crypto';
+
+const TITLE_MAX = 120;
+const BODY_MAX = 4000;
+const NOTICES_EDGE_SECONDS = 60;
+
+const clean = (v, max) => String(v ?? '').replace(/\r\n?/gu, '\n').trim().slice(0, max);
+const newest = (a, b) => String(b.at || '').localeCompare(String(a.at || ''));
+
+export async function listNotices(ctx) {
+  const all = ctx.listNotices ? await ctx.listNotices() : {};
+  return Object.values(all || {}).filter(Boolean).sort(newest);
+}
+
+// GET is public: what every account is shown. POST is the admin's alone. The
+// /notices page is where the admin writes them; it signs in like the roster.
+// Returns a response, or null when the path is neither.
+export async function routeNoticesApi(request, pathname, ctx, { j, verifyPodToken, publicFor, notFound }) {
+  // The two admin pages: the roster (who has accounts here) and the notices.
+  // Each signs in and calls its API; a deploy with no admin supplies no page.
+  const page = pathname === '/notices' ? ctx.noticesPage : pathname === '/roster' ? ctx.adminPage : undefined;
+  if (page !== undefined) {
+    if (request.method !== 'GET' && request.method !== 'HEAD') return { status: 405, headers: {}, body: '' };
+    if (!page) return notFound();
+    return { status: 200, headers: { 'content-type': 'text/html; charset=utf-8' }, body: page };
+  }
+  if (pathname !== '/api/notices') return null;
+  const open = { 'access-control-allow-origin': '*' };
+  if (request.method === 'OPTIONS') {
+    return { status: 204, headers: { ...open, 'access-control-allow-methods': 'GET, OPTIONS',
+      'access-control-allow-headers': 'Accept', allow: 'GET, POST, OPTIONS' }, body: null };
+  }
+  if (request.method === 'GET') {
+    if (!ctx.listNotices) return j(501, { error: 'this front keeps no notices' });
+    const out = j(200, { notices: await listNotices(ctx) });
+    Object.assign(out.headers, open, publicFor(NOTICES_EDGE_SECONDS));
+    return out;
+  }
+  if (request.method !== 'POST') return { status: 405, headers: {}, body: '' };
+  if (!ctx.putNotice || !ctx.deleteNotice || !ctx.adminWebId) return j(501, { error: 'this front keeps no notices' });
+  const webid = await verifyPodToken(request, pathname, ctx.verifier);
+  if (!webid) return j(401, { error: 'a Solid-OIDC token is required' });
+  if (webid !== ctx.adminWebId) return j(403, { error: 'that WebID is not the admin of this front' });
+  let body;
+  try { body = JSON.parse(await request.clone().text()); } catch { return j(400, { error: 'bad JSON' }); }
+  const action = String(body.action || '');
+  const all = (ctx.listNotices ? await ctx.listNotices() : {}) || {};
+  if (action === 'delete') {
+    const id = String(body.id || '');
+    if (!all[id]) return j(404, { error: 'no such notice' });
+    await ctx.deleteNotice(id);
+    console.log(`front: notice ${id} deleted by the admin`);
+    return j(200, { ok: true, id, deleted: true });
+  }
+  if (action !== 'create' && action !== 'update') return j(400, { error: 'action must be create, update or delete' });
+  const title = clean(body.title, TITLE_MAX);
+  const text = clean(body.body, BODY_MAX);
+  if (!title) return j(400, { error: 'a title is required' });
+  if (!text) return j(400, { error: 'a body is required' });
+  const now = new Date().toISOString();
+  let notice;
+  if (action === 'create') {
+    const id = `${Date.now().toString(36)}-${crypto.randomBytes(4).toString('hex')}`;
+    notice = { id, title, body: text, at: now, updatedAt: now };
+  } else {
+    const prior = all[String(body.id || '')];
+    if (!prior) return j(404, { error: 'no such notice' });
+    notice = { ...prior, title, body: text, updatedAt: now };
+  }
+  await ctx.putNotice(notice.id, notice);
+  console.log(`front: notice ${notice.id} ${action}d by the admin`);
+  return j(action === 'create' ? 201 : 200, { ok: true, notice });
+}