fedipod-server 0.28.0 → 0.29.0

package/lib/gateway/gateway-core.mjs

@@ -15,6 +15,7 @@
 import crypto from 'node:crypto';
 import { verifyHttpSignature, makeSafeLoader, makeReceipt, signReceipt } from './httpsig.mjs';
 import * as inbox from '../pod/inbox.mjs';
+import { senderKeys } from './caches.mjs';
 
 const DEFAULT_MAX_BYTES = 512 * 1024;   // mirror intake.mjs MAX_ITEM_BYTES
 
@@ -93,8 +94,10 @@ export async function handleDelivery(request, ident, { podPut, fetchImpl = fetch
     return { status: 202, reason: 'does not concern us' };
   }
 
+  // The sender's key, kept between deliveries: a server pushing a hundred
+  // items is asked for its key once (caches.mjs).
   const v = await verifyHttpSignature(request, {
-    documentLoader: makeSafeLoader({ fetchImpl }),
+    documentLoader: makeSafeLoader({ fetchImpl }), keyCache: senderKeys,
   });
   // A present-but-invalid signature is a forgery — dropped here, so it never
   // reaches the pod (today it would, drain, and die unapplied). An absent or
@@ -130,14 +133,15 @@ export async function handleDelivery(request, ident, { podPut, fetchImpl = fetch
 // client-to-server dispatcher, which publishes and delivers it — so the post
 // goes out when the agent next runs, the same way inbound mail is read.
 //
-// `slug` is the name the client asked for its new document. It rides in the
-// receipt so the dispatcher can use it, and it is what lets the door answer a
-// Location before anything exists: the object will live at notesPrefix+slug
-// unless that name is taken, in which case the agent mints another.
+// `slug` is the name of the new document — the client's, or one the door
+// chose — and `serial` and `at` name any other activity. They ride in the
+// receipt so the dispatcher uses them, and they are what let the door answer a
+// Location before anything exists. A name the client chose that is already
+// taken is the one case where the agent picks another.
 export const SLUG_OK = /^[A-Za-z0-9._-]{1,64}$/u;
 export const safeSlug = (s) => (typeof s === 'string' && SLUG_OK.test(s) && !/^\.+$/u.test(s) ? s : null);
 
-export async function handleOwnerPost(request, ident, { podPut, ownerWebId, maxBytes = DEFAULT_MAX_BYTES } = {}) {
+export async function handleOwnerPost(request, ident, { podPut, ownerWebId, maxBytes = DEFAULT_MAX_BYTES, exists = null } = {}) {
   if (!ident.hmacSecret) return { status: 409, reason: 'this account has no door secret — attach it again' };
   let raw;
   try { raw = await request.text(); } catch { return { status: 400, reason: 'unreadable body' }; }
@@ -147,16 +151,94 @@ export async function handleOwnerPost(request, ident, { podPut, ownerWebId, maxB
   if (!doc || typeof doc !== 'object' || Array.isArray(doc) || !doc.type) {
     return { status: 400, reason: 'a typed ActivityStreams object is required' };
   }
-  const slug = safeSlug(request.headers.get('slug'));
+  // A post that makes something new is named HERE, when the client did not
+  // name it, so the answer can give the address of what it made (§6: 201 with
+  // the new activity's id in Location) though nothing has been made yet.
+  // What the account would refuse is refused here, before the app is told
+  // "created" for something that will never exist.
+  const refusal = refusedAtTheDoor(doc, ident);
+  if (refusal) return { status: 422, reason: refusal };
+  const makes = doc.type === 'Create' || !ACTIVITY_TYPES.has(doc.type);
+  // A name the client asks for that is already taken is replaced here, so the
+  // address answered is the one the post gets.
+  let slug = safeSlug(request.headers.get('slug'));
+  if (slug && makes && exists && await exists(containerFor(doc, ident) + slug).catch(() => false)) slug = null;
+  if (!slug && makes) slug = mintSlug();
+  // Anything else is named the way the agent names it, from a serial and a
+  // time chosen here and handed over in the receipt.
+  // Two posts in the same millisecond still get different names.
+  const now = Date.now();
+  const serial = now * 1000 + crypto.randomInt(1000);
+  const at = new Date(now).toISOString();
+  const hash = sha256hex(raw);
+  // The receipt names the body it vouches for, so it vouches for nothing else,
+  // and the agent can tell the same body sent twice.
   const receipt = signReceipt({
     v: 1, verified: true, method: 'c2s', keyId: ownerWebId || null, actor: ident.actorUrl,
     checks: ['owner-token'], reason: 'owner', gateway: ident.gatewayWebId, ...(slug ? { slug } : {}),
+    serial, at, hash,
   }, ident.hmacSecret);
-  const hash = sha256hex(raw);
   const okA = await inbox.appendVerifiedDelivery(podPut, ident.inboxUrl, hash, raw);
   if (!okA) return { status: 502, reason: 'pod inbox write failed' };
   await inbox.writeReceiptBeside(podPut, ident.inboxUrl, hash, receipt);
-  return { status: 202, reason: 'accepted', location: slug && ident.notesPrefix ? ident.notesPrefix + slug : null };
+  if (makes) {
+    const object = slug && ident.notesPrefix ? containerFor(doc, ident) + slug : null;
+    return { status: 201, reason: 'accepted', object, location: object ? object + '-create' : null };
+  }
+  const object = typeof doc.object === 'string' ? doc.object : doc.object?.id || null;
+  return { status: 201, reason: 'accepted', object, location: activityIdFor(doc.type, object, ident, serial, at) };
+}
+
+// The id the agent gives each kind of activity (lib/core/wire.mjs): an edit by
+// its note and time, a deletion by its note, a boost and an undo as documents
+// in the posts folder, the rest by the actor and serial.
+const SERIAL_NAMED = new Set(['Like', 'Follow', 'Block', 'Add', 'Remove', 'Accept', 'Reject']);
+function activityIdFor(type, object, ident, serial, at) {
+  const actor = ident.actorUrl;
+  if ((type === 'Update' || type === 'Delete') && object && object !== actor) {
+    return type === 'Delete' ? object + '-delete' : object + '-update-' + at.replace(/[^0-9TZ]/g, '');
+  }
+  if ((type === 'Announce' || type === 'Undo') && ident.notesPrefix) return `${ident.notesPrefix}${type.toLowerCase()}-${serial}`;
+  return SERIAL_NAMED.has(type) ? `${actor}#${type.toLowerCase()}-${serial}` : null;
+}
+
+// The account's own changes are made on its manage page, and the one
+// collection a client may add to or take from is the pinned posts.
+function refusedAtTheDoor(doc, ident) {
+  const object = typeof doc.object === 'string' ? doc.object : doc.object?.id || null;
+  const target = typeof doc.target === 'string' ? doc.target : doc.target?.id || null;
+  if (doc.type === 'Move') return 'moving the account is done on its manage page';
+  if ((doc.type === 'Update' || doc.type === 'Delete') && object === ident.actorUrl) {
+    return 'the account itself is changed on its manage page';
+  }
+  if ((doc.type === 'Add' || doc.type === 'Remove') && target !== ident.actorUrl.replace(/actor$/u, 'featured')) {
+    return 'the pinned posts are the one collection an app may add to or take from';
+  }
+  return null;
+}
+
+// The activity types §6 names; anything else with a type is an object the
+// agent wraps in a Create. The same list the dispatcher keeps (lib/client/c2s.mjs).
+const ACTIVITY_TYPES = new Set([
+  'Create', 'Update', 'Delete', 'Follow', 'Like', 'Announce', 'Undo',
+  'Block', 'Add', 'Remove', 'Accept', 'Reject', 'Move',
+]);
+
+// The name the agent would have chosen itself: the day and eight hex characters.
+const mintSlug = () => new Date().toISOString().slice(0, 10) + '-' + crypto.randomBytes(4).toString('hex');
+
+// Where the agent will keep it: public and unlisted posts under notes/, posts
+// for followers or named people under private/ — decided by the addressing,
+// read the way the dispatcher reads it (nothing stated is public).
+const PUBLIC_NAMES = new Set(['https://www.w3.org/ns/activitystreams#Public', 'as:Public', 'Public']);
+function containerFor(doc, ident) {
+  const object = doc.type === 'Create' && doc.object && typeof doc.object === 'object' ? doc.object : doc;
+  const list = (v) => (v == null ? [] : Array.isArray(v) ? v : [v]).map(x => (typeof x === 'string' ? x : x?.id));
+  const to = list(doc.to ?? object.to);
+  const cc = list(doc.cc ?? object.cc);
+  const blind = list(doc.bto ?? object.bto).length + list(doc.bcc ?? object.bcc).length;
+  const open = (!to.length && !cc.length && !blind) || [...to, ...cc].some(a => PUBLIC_NAMES.has(a));
+  return open ? ident.notesPrefix : ident.notesPrefix.replace(/ap\/notes\/$/u, 'ap/private/');
 }
 
 export const _internal = { isBlocked, concernsUsAtEdge, httpUrl, sha256hex };

package/lib/gateway/headers.mjs

@@ -0,0 +1,49 @@
+// headers.mjs — the hardening every front response carries, in one place.
+// Split out of front-core.mjs, which is at its size gate; nothing here knows
+// about routes.
+
+// Every response this file makes, hardened in one place rather than in each of
+// the dozen shapes below.
+//
+// `nosniff` matters most: the front serves user-supplied JSON straight from
+// somebody's pod (the proxied actor and object documents), and without it a
+// browser is free to decide for itself that a document is HTML and run what is
+// inside it. The rest is the same posture the app already has — nothing may be
+// framed, no base tag may be rewritten, no plugin content.
+//
+// A content-security-policy goes on the HTML only: it would mean nothing on a
+// JSON document, and `frame-ancestors` has to be a header rather than a meta
+// tag anyway.
+//
+// `script-src 'self'` is the one that matters, and it is only possible because
+// none of these pages carries inline script any more — each has its own file and
+// its own route above. A policy cannot tell an inline block the author wrote
+// from one an attacker injected, so as long as any inline script has to run,
+// every inline script may.
+//
+// `connect-src` allows https: because the pages sign in against the user's own
+// pod, which is a different origin by definition and not one we can name here.
+export function withSecurityHeaders(headers = {}, body = null) {
+  const ct = String(headers['content-type'] || '');
+  const isHtml = ct.startsWith('text/html');
+  return {
+    ...headers,
+    'x-content-type-options': 'nosniff',
+    'referrer-policy': 'same-origin',
+    'x-frame-options': 'SAMEORIGIN',
+    ...(isHtml && body ? {
+      'content-security-policy': [
+        "default-src 'self'",
+        "script-src 'self'",             // no inline script: see above
+        "style-src 'self' 'unsafe-inline'",
+        "img-src 'self' https: data:",
+        "connect-src 'self' https:",     // sign-in goes to the user's own pod
+        "object-src 'none'",             // no plugin content, ever
+        "base-uri 'none'",               // no rewriting where relative URLs resolve
+        "frame-ancestors 'self'",        // nobody else may frame these pages
+        "form-action 'self'",            // a form here submits here
+      ].join('; '),
+    } : {}),
+  };
+}
+

package/lib/gateway/quiet.mjs

@@ -101,7 +101,7 @@ export async function accountState(ctx, key, rec) {
 
 // A 410 with a reason, the shape every closed or moved id answers with.
 export const closedAnswer = (headers = {}, why = 'this address is closed') => ({
-  status: 410, headers: { ...headers, 'content-type': 'application/json', 'cache-control': 'no-store' },
+  status: 410, headers: { 'cache-control': 'no-store', ...headers, 'content-type': 'application/json' },
   body: JSON.stringify({ error: why }) });
 
 // The owner of a row, proved the way the relay proves them: a pod token whose
@@ -120,7 +120,12 @@ async function provedOwner(request, pathname, ctx, rec, { j, verifyPodToken, web
 // Returns a response, or null when the path is not one of these.
 export async function routeQuietApi(request, pathname, ctx, deps) {
   const { j } = deps;
-  if (request.method !== 'POST' || !['/api/open', '/api/pause', '/api/close'].includes(pathname)) return null;
+  if (!['/api/open', '/api/pause', '/api/close'].includes(pathname)) return null;
+  // A page at another origin asks first whether it may call, and is answered
+  // as the relay answers it. Unanswered, the browser never sends the call and
+  // some pages asked again every minute.
+  if (request.method === 'OPTIONS') return deps.apiPreflight();
+  if (request.method !== 'POST') return null;
   // The owner is here: their browser says so as it opens the account. The
   // answer is the account's standing at this gateway, which the manage page
   // shows. A closed address is told so and nothing is written.

package/lib/gateway/relay-extras.mjs

@@ -0,0 +1,89 @@
+// relay-extras.mjs — the relay's single request, and what the relay notices
+// about the requests it carries.
+//
+// relayOne(): sends one request a browser-run agent has already signed, with
+// exactly the headers that were signed. It forwards a signature and cannot
+// make one: a POST must carry one, by this account's own key, over the body
+// its Digest names.
+//
+// withdrawn(): a relayed delivery that withdraws something of the account's —
+// a Delete, or an Undo — means the copies the edge holds of that account's
+// documents are out of date; the front purges them rather than serving a
+// deleted post for the rest of its hold.
+//
+// overLimit(): how many requests one account may have the relay carry. Counted
+// per running instance, which bounds a runaway agent or a stolen token without
+// any shared state; a real account sends nowhere near it.
+
+import crypto from 'node:crypto';
+import { readCapped, safeFetch } from '../shared/safefetch.mjs';
+
+const RELAY_MAX_BODY = 1024 * 1024;
+const RELAY_TIMEOUT_MS = 8_000;
+// The only headers a relayed request may carry to the remote server. Host
+// comes from the URL; the user agent from safeFetch.
+const RELAY_HEADERS = new Set(['date', 'digest', 'signature', 'content-type', 'accept']);
+const keyIdOf = (signature) => (/keyId="([^"]+)"/.exec(signature || '') || [])[1] || null;
+
+export async function relayOne(item, rec, fetchImpl) {
+  const url = String(item?.url || '');
+  const method = String(item?.method || 'POST').toUpperCase();
+  if (method !== 'GET' && method !== 'POST') return { url, status: 0, error: 'method must be GET or POST' };
+  let u;
+  try { u = new URL(url); } catch { return { url, status: 0, error: 'not a URL' }; }
+  if (u.protocol !== 'https:' && !(u.protocol === 'http:' && process.env.AP_ALLOW_PRIVATE_TARGETS === '1')) {
+    return { url, status: 0, error: 'https only' };
+  }
+  const headers = {};
+  for (const [k, v] of Object.entries(item?.headers || {})) {
+    const name = k.toLowerCase();
+    if (RELAY_HEADERS.has(name) && typeof v === 'string') headers[name] = v;
+  }
+  const body = method === 'POST' ? String(item?.body ?? '') : undefined;
+  if (body !== undefined && Buffer.byteLength(body) > RELAY_MAX_BODY) return { url, status: 0, error: 'body too large' };
+  const keyId = keyIdOf(headers.signature);
+  if (method === 'POST' && !keyId) return { url, status: 0, error: 'a delivery must be signed' };
+  if (keyId && !keyId.startsWith(rec.actorUrl + '#')) return { url, status: 0, error: "signed with a key that is not this account's" };
+  if (headers.digest) {
+    const want = 'SHA-256=' + crypto.createHash('sha256').update(body || '').digest('base64');
+    if (headers.digest !== want) return { url, status: 0, error: 'digest does not match the body' };
+  }
+  try {
+    const res = await safeFetch(url, { method, headers, body, signal: AbortSignal.timeout(RELAY_TIMEOUT_MS) }, fetchImpl);
+    const out = { url, method, status: res.status };
+    // The far server asking to be left alone has to reach the agent that will
+    // do the asking again. Without this the browser build could not honour a
+    // Retry-After at all — every delivery it makes goes through here — and fell
+    // back to its own ladder against a server that had already said how long.
+    const retryAfter = res.headers.get('retry-after');
+    if (retryAfter) out.retryAfter = retryAfter;
+    if (method === 'GET') {
+      out.contentType = res.headers.get('content-type') || null;
+      out.body = await readCapped(res, RELAY_MAX_BODY);
+    }
+    return out;
+  } catch (e) { return { url, method, status: 0, error: e.message }; }
+}
+
+const WINDOW_MS = 10 * 60 * 1000;
+const PER_WINDOW = 600;
+const counts = new Map();   // handle → { since, n }
+
+export function withdrawn(items, actorUrl) {
+  return items.some((it) => {
+    if (String(it?.method || 'POST').toUpperCase() !== 'POST') return false;
+    try {
+      const a = JSON.parse(String(it?.body ?? ''));
+      return a?.actor === actorUrl && (a.type === 'Delete' || a.type === 'Undo');
+    } catch { return false; }
+  });
+}
+
+export function overLimit(handle, n, now = Date.now()) {
+  const c = counts.get(handle);
+  const fresh = !c || now - c.since > WINDOW_MS ? { since: now, n: 0 } : c;
+  fresh.n += n;
+  counts.set(handle, fresh);
+  if (counts.size > 10_000) counts.clear();
+  return fresh.n > PER_WINDOW;
+}

package/lib/gateway/token-claims.mjs

@@ -0,0 +1,16 @@
+// token-claims.mjs — who a Solid access token says it is for, unchecked.
+//
+// Only for choosing where to send a read that the pod checks anyway: the
+// owner's full outbox lives on the pod under the owner's own rule, so reading
+// the claim decides nothing but the address. Verifying it here would let
+// anyone make the front fetch signing keys from a server they name, on every
+// read.
+
+export function claimedWebId(request) {
+  const token = /^(?:DPoP|Bearer)\s+([\w-]+)\.([\w-]+)\./u.exec(request.headers.get('authorization') || '');
+  if (!token) return null;
+  try {
+    const claims = JSON.parse(Buffer.from(token[2], 'base64url').toString('utf8'));
+    return typeof claims?.webid === 'string' ? claims.webid : null;
+  } catch { return null; }
+}

package/lib/pod/containers.mjs

@@ -51,12 +51,16 @@ export async function provisionPublic(pod, base) {
  * The private half: the home itself and the state container.
  *
  * Idempotent, so two devices doing it at once is harmless — which is what
- * makes it safe to run on every boot rather than only at setup.
+ * makes it safe to run on every boot rather than only at setup. Asked before
+ * written: a browser's worker boots whenever the browser likes, and each boot
+ * used to write the canary and both rules again. Returns whether it wrote.
  */
 export async function provisionPrivate(pod, urls) {
+  if (await exists(pod, urls.state)) return false;
   await pod.putJson(keepUrl(urls.state), KEEP, KEEP_CT);
   await pod.setAcl(urls.state, []);
   await pod.setAcl(urls.home, []);
+  return true;
 }
 
 /**

package/lib/pod/inbox.mjs

@@ -85,13 +85,15 @@ export async function writeKeep(pod, urls) {
  * those and not the others is an inbox that is open when it should be shut.
  */
 export async function setPosture(pod, urls, posture) {
-  if (posture === 'open') return pod.setAcl(urls.inbox, ['Append']);
-  if (posture === 'closed') return pod.setAcl(urls.inbox, []);
+  // Restated at every start, and most starts find it already so: the rule is
+  // read first and written only when it differs (transport.setAcl ifChanged).
+  if (posture === 'open') return pod.setAcl(urls.inbox, ['Append'], { ifChanged: true });
+  if (posture === 'closed') return pod.setAcl(urls.inbox, [], { ifChanged: true });
   const webId = posture?.gatewayWebId;
   if (!webId) throw new Error(`inbox.setPosture: unknown posture ${JSON.stringify(posture)}`);
   // Public loses Append; the door keeps it. Both halves in one write, because
   // between two writes the inbox is either open to everyone or shut to the door.
-  return pod.setAcl(urls.inbox, [], { appendAgents: [webId] });
+  return pod.setAcl(urls.inbox, [], { appendAgents: [webId], ifChanged: true });
 }
 
 /**
@@ -145,3 +147,20 @@ export async function readDeliveryReceipt(pod, itemUrl, { maxBytes, readCapped }
  * @returns {Promise<boolean>} whether the pod removed it
  */
 export const dropHandledItem = (pod, url) => pod.delete(url);
+
+/**
+ * Remove the receipt a gateway wrote beside an item, once the item is gone.
+ * Best-effort: a receipt that stays is a stray document, never a lost
+ * delivery. Left behind, they were one stray per delivery, forever.
+ */
+export const dropReceiptBeside = (pod, url) => pod.delete(url + '.receipt.json').catch(() => false);
+
+/**
+ * Receipts whose item is no longer in the inbox, from the last listing: what
+ * earlier drains left behind. The drain removes a few of these each sweep
+ * until none are left.
+ */
+export const orphanReceipts = (pod, urls) => pod.orphanReceipts?.(urls.inbox) ?? [];
+
+/** Remove one such stray. @returns {Promise<boolean>} whether the pod removed it */
+export const dropStrayReceipt = (pod, url) => pod.delete(url).catch(() => false);

package/lib/pod/location.mjs

@@ -0,0 +1,52 @@
+// location.mjs — where in a pod an application's container goes.
+//
+// The container's own name is the caller's. The person says which container of
+// their pod holds it, as a path on the pod's own origin: `/` for a subdomained
+// pod, `/jeff/` for a suffixed one, or any container below either. Everything then lives under `<that><name>`, and the root kept is that
+// place relative to the pod.
+
+// The pod's own furniture: its profile, its settings, its well-known documents.
+const RESERVED = new Set(['profile', 'settings', '.well-known']);
+const SEGMENT = /^[A-Za-z0-9._-]+$/u;
+
+/** The prefilled answer: the pod's own root, as a path. */
+export function podRootPath(podBase) {
+  return new URL(podBase).pathname;
+}
+
+/**
+ * The container path someone typed, checked against their pod. Returns
+ * `{ root }` — the root relative to the pod, ending in `name` — or
+ * `{ problem }` saying what is wrong, in words for them.
+ */
+export function rootFromContainer(podBase, typed, name) {
+  const base = new URL(podBase);
+  let path = String(typed ?? '').trim() || base.pathname;
+  if (!path.startsWith('/')) path = '/' + path;
+  if (!path.endsWith('/')) path += '/';
+  if (!path.startsWith(base.pathname)) {
+    return { problem: `that is not in your pod — your pod starts at ${base.pathname}` };
+  }
+  const inside = path.slice(base.pathname.length);
+  const segments = inside.split('/').filter(Boolean);
+  if (segments.some(s => s === '.' || s === '..')) return { problem: 'a container path cannot go up with ..' };
+  if (segments.some(s => !SEGMENT.test(s))) {
+    return { problem: 'container names are letters, digits, dots, dashes and underscores' };
+  }
+  if (segments.length && RESERVED.has(segments[0])) {
+    return { problem: `${base.pathname}${segments[0]}/ belongs to your pod itself — choose another container` };
+  }
+  if (segments.length > 8) return { problem: 'that is nested too deep — eight containers at most' };
+  return { root: (segments.length ? segments.join('/') + '/' : '') + name };
+}
+
+/** Where the account lives, in full: the pod plus its root. */
+export const homeOf = (podBase, root) => podBase + root;
+
+/** The root back from a pod actor's address: `<pod><root>ap/actor`. */
+export function rootOfActor(podBase, actorUrl) {
+  const a = String(actorUrl || '');
+  if (!a.startsWith(podBase) || !a.endsWith('ap/actor')) return null;
+  const root = a.slice(podBase.length, -'ap/actor'.length);
+  return root.endsWith('/') ? root : null;
+}

package/lib/pod/notes.mjs

@@ -57,9 +57,6 @@ export async function writeTombstone(pod, noteId, doc) {
   await pod.setAcl(noteId, PUBLIC_READ);
 }
 
-/** Withdraw the Create. Returns whether the pod actually removed it. */
-export const dropCreate = (pod, createId) => pod.delete(createId).catch(() => false);
-
 /** The replies collection, once the note it belonged to is gone. */
 export const dropReplies = (pod, repliesId) => pod.delete(repliesId).catch(() => {});
 
@@ -73,7 +70,8 @@ export const dropReplies = (pod, repliesId) => pod.delete(repliesId).catch(() =>
 export async function list(pod, urls) {
   const children = await pod.listContainer(urls.notes);
   return children
-    .filter((c) => !/(-create|-replies)$/.test(c.url) && !c.url.endsWith('.keep'))
+    .filter((c) => !/(-create|-replies|-delete|-update-[^/]+)$/.test(c.url) && !/\/(announce|undo)-\d+$/.test(c.url)
+      && !c.url.endsWith('.keep'))
     // A defensive copy: the transport hands back the same array on a 304, so a
     // caller that sorts in place would corrupt it for every later reader.
     .map((c) => ({ ...c }));