fedipod-server 0.28.1 → 0.29.0

package/web/app/index.html

@@ -191,6 +191,13 @@ a { color: var(--accent); }
         <span id="signed-pod-label" class="grouplabel">Your pod</span>
         <p id="signed-pod" role="status" aria-labelledby="signed-pod-label"></p>
 
+        <div id="container-field">
+          <label for="container">Store your data in a container named fedipod, inside this container</label>
+          <input type="text" id="container" name="container" autocomplete="off" spellcheck="false"
+            aria-describedby="container-hint">
+          <p class="hint" id="container-hint">Your data will be at <span id="place">…</span>. This is permanent.</p>
+        </div>
+
         <!-- Shown when the pod's account lives at another gateway: this is a
              move, not a new account. -->
         <p id="movein-note" hidden>Moving <strong id="movein-from"></strong> to this site.
@@ -217,6 +224,15 @@ a { color: var(--accent); }
       <p class="hint">The handle and the pod cannot be changed afterwards. Everything else — display
         name, bio, pictures — you set later in the client.</p>
       <p class="err" id="form-error" role="alert"></p>
+      <div id="index-ask" role="alertdialog" aria-labelledby="index-ask-text" hidden>
+        <p id="index-ask-text">Your pod has no public type index, the list Solid apps use to find your
+          things. FediPod needs one to record where your account lives. Create it? It will be readable
+          by anyone, like your profile.</p>
+        <p>
+          <button type="button" id="index-no">No, stop</button>
+          <button type="button" class="primary" id="index-yes">Create it and continue</button>
+        </p>
+      </div>
       <p>
         <button type="button" id="back-1">Back</button>
         <button type="submit" class="primary" id="submit">Create your Fediverse account</button>

package/web/app/signup.mjs

@@ -16,14 +16,18 @@ import * as podState from '../../lib/pod/state.mjs';
 import { resourceExists } from '../../lib/pod/root.mjs';
 import { podBaseOfWebId } from '../../lib/pod/urls.mjs';
 import { cacheOpenedKeys } from './keys-browser.mjs';
+import { chosenRoot, findAccount, recordPlace, hasPublicIndex } from '../../lib/core/place.mjs';
 
-// The container everything the agent publishes hangs under. New pods made here
-// use `fedipod/`; new installs default to `fedipod/` too, and older ones keep
-// that predate this, so those pods are untouched. The name is stored on the
-// config, so the agent reads it rather than guessing.
-export const AP_ROOT = 'fedipod/';
-const actorUrlFor = (pod) => `${pod}${AP_ROOT}ap/actor`;
-const keysDocFor = (pod) => `${pod}${AP_ROOT}ap-state/keys.json`;
+// Everything the agent publishes hangs under a container named `fedipod`, in
+// the container its owner chose (lib/core/place.mjs). The root is stored on the
+// config, so the agent reads it rather than guessing, and the place is recorded
+// in the owner's public type index, which is how the account is found again.
+const actorUrlFor = (pod, root) => `${pod}${root}ap/actor`;
+const keysDocFor = (pod, root) => `${pod}${root}ap-state/keys.json`;
+const stateOf = (pod, root) => `${pod}${root}ap-state/`;
+
+/** The account's config as it sits under `root`, read as its owner. */
+const readConfigAt = (remote, pod) => (root) => podState.readConfig(remote, { state: stateOf(pod, root) });
 
 const HANDLE_RE = /^[a-z0-9-]{2,30}$/;
 
@@ -42,7 +46,7 @@ export function handleProblem(handle) {
 // identity being built, so changing the handle on the form starts a clean
 // attempt.
 const PROGRESS = new Map();
-const progressKey = (webId, a) => [webId, a.handle, a.shape || 'pod'].join('|');
+const progressKey = (webId, a) => [webId, a.handle, a.shape || 'pod', a.container || ''].join('|');
 
 /** A fronted name is one per gateway; a taken one is refused before anything is made. */
 async function assertFrontNameFree(frontOrigin, handle) {
@@ -58,7 +62,12 @@ async function assertFrontNameFree(frontOrigin, handle) {
  * note) so a page can draw the same tick list the CLI setup shows. Resumable:
  * see PROGRESS above.
  *
- * answers: { handle, shape?: 'pod'|'front', gateway? }
+ * answers: { handle, shape?: 'pod'|'front', gateway?, container?, createIndex? }
+ *   container    the path of the container that holds `fedipod/` (the pod root
+ *                when empty)
+ *   createIndex  the person's yes to making a public type index when their
+ *                profile names none; without it, sign-up stops before writing
+ *                anything and says so (error code 'needs-index')
  * session: { webId, issuer, fetch } — the Solid-OIDC session from the pod's
  *          own login (oidc-session.mjs). The pod is where the WebID lives.
  *
@@ -91,11 +100,27 @@ export async function signUp(answers, { session, onStep = () => {}, frontOrigin
     skip: (note) => onStep(key, 'skipped', note),
   });
 
+  const place = chosenRoot(pod, answers.container);
+  if (place.problem) throw new Error(`Where to store it: ${place.problem}.`);
+  const root = place.root;
+  const remote = new BrowserRemotePod(session, { webId, role: 'signup', log: () => {} });
+
   // --- the pod --- (the session came from it; what is checked is that it has no account yet)
   const podStep = step('pod');
   if (!prog.pod) {
     podStep.running('checking your pod');
-    if (await resourceExists(session.fetch, actorUrlFor(pod))) throw new Error('The pod already hosts a FediPod account. If you want a second account, put it on a different pod.');
+    if (await findAccount(remote, pod, readConfigAt(remote, pod))
+      || await resourceExists(session.fetch, actorUrlFor(pod, root))) {
+      throw new Error('The pod already hosts a FediPod account. If you want a second account, put it on a different pod.');
+    }
+    if (await resourceExists(session.fetch, `${pod}${root}`)) {
+      throw new Error(`${new URL(pod + root).pathname} is already there and is not a FediPod account — choose another container.`);
+    }
+    // Where the account lives is recorded in the public type index. With none,
+    // the person is asked first; nothing is written before they have said yes.
+    if (!answers.createIndex && !await hasPublicIndex(remote, pod)) {
+      throw Object.assign(new Error('Your profile names no public type index.'), { code: 'needs-index' });
+    }
     prog.pod = pod;
     podStep.ok(pod);
   } else {
@@ -108,11 +133,11 @@ export async function signUp(answers, { session, onStep = () => {}, frontOrigin
   const pathPod = new URL(pod).pathname !== '/';
   const fronted = pathPod || wantsFront;
   if (fronted && !frontOrigin) {
-    throw new Error(`${pod} is a suffix-based host, so its address must live at a gateway, and this page has none.`);
+    throw new Error(`${pod} is a suffixed pod, so its address must live at a gateway, and this page has none.`);
   }
   if (pathPod && !wantsFront) await assertFrontNameFree(frontOrigin, handle);
 
-  const actorUrl = actorUrlFor(pod);                              // where the documents live, always
+  const actorUrl = actorUrlFor(pod, root);                        // where the documents live, always
   const frontActor = fronted ? `${frontOrigin.replace(/\/$/, '')}/u/${handle}/ap/actor` : null;
 
   // Connect the gateway (fedipod.net) before the key is made, because a
@@ -133,7 +158,7 @@ export async function signUp(answers, { session, onStep = () => {}, frontOrigin
       // bare pod root sends this identity's mail to <pod>/ap/inbox/ — outside
       // the container the agent drains, where nothing would ever read it. The
       // manage surface has always sent `urls.home`; this is the same value.
-      body: JSON.stringify({ handle, podHome: `${pod}${AP_ROOT}`, actorUrl, kind: 'person', fronted }),
+      body: JSON.stringify({ handle, podHome: `${pod}${root}`, actorUrl, kind: 'person', fronted }),
     });
     const d = await res.json().catch(() => ({}));
     if (res.status !== 201 || !d.hmacSecret) {
@@ -163,7 +188,6 @@ export async function signUp(answers, { session, onStep = () => {}, frontOrigin
   // The opened copy is kept in this browser (IndexedDB) so the worker can boot
   // itself after an idle kill with no read. A browser that has no copy reads
   // the pod's with its session — see keys-browser.mjs.
-  const remote = new BrowserRemotePod(session, { webId, role: 'signup', log: () => {} });
   const keysStep = step('keys');
   let keys;
   if (!prog.keysStored) {
@@ -177,13 +201,13 @@ export async function signUp(answers, { session, onStep = () => {}, frontOrigin
     // pod this key may sit on.
     try {
       await podState.provisionKey(remote, {
-        stateUrl: `${pod}${AP_ROOT}ap-state/`,
-        keysUrl: keysDocFor(pod),
+        stateUrl: stateOf(pod, root),
+        keysUrl: keysDocFor(pod, root),
         keys,
       });
     } catch (e) {
       throw new Error(`could not store the signing key on the pod (${e.message}). `
-        + `You are signed in as ${webId} — that WebID must own ${pod} and its ${AP_ROOT} must be writable by it.`);
+        + `You are signed in as ${webId} — that WebID must own ${pod} and ${root} in it must be writable by it.`);
     }
     // This browser's own opened copy, so the boot that follows needs no read.
     // Best effort: a browser that refuses IndexedDB (private mode) reads the
@@ -197,7 +221,7 @@ export async function signUp(answers, { session, onStep = () => {}, frontOrigin
   }
 
   const config = {
-    remotePod: pod, root: AP_ROOT, handle, name: handle, issuer: String(session.issuer || '').replace(/\/+$/, ''),
+    remotePod: pod, root, handle, name: handle, issuer: String(session.issuer || '').replace(/\/+$/, ''),
     createdAt: new Date().toISOString(),
     ...(gateway ? { gateway } : {}),
   };
@@ -205,11 +229,24 @@ export async function signUp(answers, { session, onStep = () => {}, frontOrigin
   // sign-in — which arrives with only an OIDC session — can read the account's
   // config and key from the pod and boot.
   try {
-    await podState.writeConfig(remote, { state: `${pod}${AP_ROOT}ap-state/` }, config);
+    await podState.writeConfig(remote, { state: stateOf(pod, root) }, config);
   } catch (e) {
     throw new Error(`could not store the config on the pod (${e.message})`);
   }
 
+  // --- where it lives, in the public type index ---
+  if (!prog.placed) {
+    const placeStep = step('place');
+    placeStep.running('recording where your account lives');
+    try {
+      await recordPlace(remote, pod, actorUrl, { create: !!answers.createIndex });
+    } catch (e) {
+      throw new Error(`could not record where your account lives in your type index (${e.message})`);
+    }
+    prog.placed = true;
+    placeStep.ok();
+  }
+
   PROGRESS.delete(key);                                          // finished — nothing left to resume
 
   const host = gateway?.frontActor ? new URL(gateway.frontActor).host : new URL(pod).host;
@@ -232,14 +269,16 @@ export async function signUp(answers, { session, onStep = () => {}, frontOrigin
 export async function readAccount(session) {
   const pod = podBaseOfWebId(session.webId);
   const remote = new BrowserRemotePod(session, { webId: session.webId, role: 'signup', log: () => {} });
-  const config = await podState.readConfig(remote, { state: `${pod}${AP_ROOT}ap-state/` }).catch(() => null);
-  if (!config) return null;
+  // A person account: the browser build is persons only.
+  const found = await findAccount(remote, pod, readConfigAt(remote, pod), (c) => (c.kind || 'person') === 'person');
+  if (!found) return null;
+  const { root, config } = found;
   const frontActor = config.gateway?.frontActor || null;
   let frontHost = null;
   try { frontHost = frontActor ? new URL(frontActor).host : null; } catch { frontHost = null; }
   let podHost = '';
   try { podHost = new URL(config.remotePod || pod).host; } catch { podHost = ''; }
-  return { pod, config, frontActor, frontHost, address: `@${config.handle}@${frontHost || podHost}` };
+  return { pod, root, config, frontActor, frontHost, address: `@${config.handle}@${frontHost || podHost}` };
 }
 
 /**
@@ -268,9 +307,9 @@ export async function moveIn(answers, { session, onStep = () => {}, frontOrigin
   const here = await readAccount(session);
   if (!here?.frontActor) throw new Error('this pod holds no account at another gateway to move here');
   if (here.frontHost === new URL(origin).host) throw new Error('this account already lives at this gateway');
-  const { pod, config: old } = here;
+  const { pod, root, config: old } = here;
   const remote = new BrowserRemotePod(session, { webId: session.webId, role: 'signup', log: () => {} });
-  const urls = { state: `${pod}${AP_ROOT}ap-state/` };
+  const urls = { state: stateOf(pod, root) };
   const keys = await podState.readKeys(remote, urls);
   if (!keys?.rsa) throw new Error('could not read this account\'s signing key on the pod');
   if (isKeyEnvelope(keys)) throw new Error(`this account's key is still under a password from an earlier version — sign in once at ${here.frontHost} first, then come back`);
@@ -282,7 +321,7 @@ export async function moveIn(answers, { session, onStep = () => {}, frontOrigin
   await assertFrontNameFree(origin, handle);
   const res = await session.fetch(`${origin}/api/attach`, {
     method: 'POST', headers: { 'content-type': 'application/json' },
-    body: JSON.stringify({ handle, podHome: `${pod}${AP_ROOT}`, actorUrl: actorUrlFor(pod), kind: old.kind || 'person', fronted: true }),
+    body: JSON.stringify({ handle, podHome: `${pod}${root}`, actorUrl: actorUrlFor(pod, root), kind: old.kind || 'person', fronted: true }),
   });
   const d = await res.json().catch(() => ({}));
   if (res.status !== 201 || !d.hmacSecret) throw new Error(`could not attach to this gateway (HTTP ${res.status}): ${d.error || ''}`);
@@ -311,7 +350,7 @@ export async function moveIn(answers, { session, onStep = () => {}, frontOrigin
   } catch (e) {
     throw new Error(`could not update your account on the pod (${e.message})`);
   }
-  await cacheOpenedKeys(actorUrlFor(pod), keys);
+  await cacheOpenedKeys(actorUrlFor(pod, root), keys);
   keysStep.ok();
 
   return { config, address: `@${handle}@${new URL(origin).host}`, movedFrom: config.movedFrom };

package/web/front/run.html

@@ -46,12 +46,18 @@ Fediverse services straight from your pod.</p>
   <label for="run-issuer">Your identity provider</label>
   <input type="url" id="run-issuer" autocomplete="off" placeholder="https://this.server">
   </p>
+  <p class="field">
+  <label for="run-container">Store your data in a container named fedipod, inside this container</label>
+  <input type="text" id="run-container" autocomplete="off" spellcheck="false" placeholder="/"
+    aria-describedby="run-container-hint">
+  </p>
+  <p class="hint" id="run-container-hint">Leave it empty for your pod's root. This is permanent.</p>
   <p class="actions">
     <button type="button" id="run-continue" class="primary" disabled>Sign in with your pod &amp; opt in</button>
     <button type="button" id="run-leave">Stop running it here</button>
   </p>
 </form>
-<p class="hint" id="run-note" hidden></p>
+<div class="hint" id="run-note" hidden></div>
 
 <script type="module" src="/run.js"></script>
 </body>

package/web/front/run.js

@@ -88,8 +88,19 @@ function showPods(pods) {
       stop.onclick = () => runStart('opt-out', pod.podBase);
       actions.append(stop);
     } else {
+      // Where on the pod the account goes: a container named fedipod, inside
+      // the one named here (empty: the pod's own root).
+      const field = document.createElement('p'); field.className = 'field';
+      const id = `container-${k.children.length}`;
+      const label = say('label', 'Store your data in a container named fedipod, inside this container');
+      label.htmlFor = id;
+      const input = document.createElement('input');
+      input.type = 'text'; input.id = id; input.autocomplete = 'off'; input.spellcheck = false;
+      try { input.placeholder = new URL(pod.podBase).pathname; } catch { input.placeholder = '/'; }
+      field.append(label, input);
+      box.append(field);
       const go = say('button', 'Create a Fediverse account'); go.type = 'button'; go.className = 'primary';
-      go.onclick = () => runStart('opt-in', pod.podBase);
+      go.onclick = () => runStart('opt-in', pod.podBase, input.value.trim());
       actions.append(go);
     }
     box.append(actions);
@@ -121,13 +132,15 @@ $('run-issuer').addEventListener('input', runFormCheck);
 // a filled-in form, with nothing to say why.
 runFormCheck();
 
-const runStart = async (action, podBase = null) => {
+const runStart = async (action, podBase = null, container = null, createIndex = false) => {
   const n = $('run-note');
   const u = new URL(podBase || $('run-pod-url').value.trim());
   if (u.pathname === '') u.pathname = '/';
   if (!u.pathname.endsWith('/')) u.pathname += '/';
   u.search = ''; u.hash = '';
-  const p = { podBase: u.href, action };
+  const p = { podBase: u.href, action,
+    container: container ?? ($('run-container') ? $('run-container').value.trim() : ''),
+    ...(createIndex ? { createIndex: true } : {}) };
 
   // A pod server issued the session this page is being read with, so ask it
   // first: where it knows who you are, there is nothing to sign in to again.
@@ -156,6 +169,18 @@ async function showReply(res, p) {
   const n = $('run-note');
   n.hidden = false;
   const d = res ? await res.json().catch(() => ({})) : {};
+  // No public type index: nothing has been written. Ask.
+  if (res && res.status === 409 && d.code === 'needs-index') {
+    n.replaceChildren(say('p', `${d.error} Create it? It will be readable by anyone, like your profile.`));
+    const yes = say('button', 'Create it and continue'); yes.type = 'button'; yes.className = 'primary';
+    const no = say('button', 'No, stop'); no.type = 'button';
+    yes.onclick = () => runStart(p.action, p.podBase, p.container || '', true);
+    no.onclick = () => { n.textContent = 'Stopped. Nothing was written to your pod.'; };
+    const row = document.createElement('p'); row.className = 'actions'; row.append(no, yes);
+    n.append(row);
+    yes.focus();
+    return;
+  }
   if (res && res.status === 201 && d.doorSecret) {
     // Built as nodes, not as a string of HTML. Three of the pieces below come
     // back from the server and one comes from sessionStorage, and pasting any
@@ -189,7 +214,8 @@ async function showReply(res, p) {
   // The signed fetch builds a DPoP proof from the URL, so it must be absolute.
   const res = await session.authFetch(location.origin + '/api/agent', {
     method: 'POST', headers: { 'content-type': 'application/json' },
-    body: JSON.stringify({ action: p.action, podBase: p.podBase }),
+    body: JSON.stringify({ action: p.action, podBase: p.podBase, container: p.container || '',
+      ...(p.createIndex ? { createIndex: true } : {}) }),
   }).catch(() => null);
   await showReply(res, p);
 })();