fedipod-server 0.28.1 → 0.29.0

package/lib/pod/transport.mjs

@@ -15,6 +15,7 @@
 import * as $rdf from 'rdflib';
 import { readCapped, retryAfterMs } from './http.mjs';
 import { linkTargets, REL } from './links.mjs';
+import { podBaseOfWebId } from './urls.mjs';
 
 const LDP = $rdf.Namespace('http://www.w3.org/ns/ldp#');
 const DC = $rdf.Namespace('http://purl.org/dc/terms/');
@@ -23,6 +24,17 @@ const RDF = $rdf.Namespace('http://www.w3.org/1999/02/22-rdf-syntax-ns#');
 const ACL = $rdf.Namespace('http://www.w3.org/ns/auth/acl#');
 const FOAF = $rdf.Namespace('http://xmlns.com/foaf/0.1/');
 const AS = $rdf.Namespace('https://www.w3.org/ns/activitystreams#');
+const RDFS = $rdf.Namespace('http://www.w3.org/2000/01/rdf-schema#');
+
+// An inserted term must be something a reader can take for what it says it
+// is: an absolute http(s) IRI, or a literal.
+function termProblem(t) {
+  if (t?.termType === 'Literal') return null;
+  if (t?.termType !== 'NamedNode') return `${t?.value ?? t} is not an IRI or a literal`;
+  try {
+    return /^https?:$/.test(new URL(t.value).protocol) ? null : `${t.value} is not an http(s) IRI`;
+  } catch { return `${t.value} is not an absolute IRI`; }
+}
 
 // A pod whose access rules are ACP policies, not WAC authorizations. This
 // library writes WAC; over an ACP resource that would be noise where the pod's
@@ -445,16 +457,11 @@ export class PodTransport {
    * written back — an empty or foreign body must never become the new profile.
    */
   async linkAccountInProfile({ actorUrl, accountName, kind = 'person', outbox = null }) {
-    const docUrl = this.webId.split('#')[0];
-    const res = await this.fetch(docUrl, { headers: { accept: 'text/turtle' } });
-    if (res.status >= 400) throw new Error(`[${this.label}] GET ${docUrl} → ${res.status}`);
-    const g = $rdf.graph();
-    $rdf.parse(await res.text(), g, docUrl, 'text/turtle');
-    const doc = $rdf.sym(docUrl);
     const me = $rdf.sym(this.webId);
-    if (!g.statementsMatching(me, null, null, doc).length) {
-      throw new Error(`profile at ${docUrl} does not mention ${this.webId} — not rewriting it`);
-    }
+    const podBase = podBaseOfWebId(this.webId);
+    // The profile and what its seeAlso names: what either says is said.
+    const docs = await this.profileDocs(podBase);
+    const says = (s, p, o) => docs.some(({ g }) => g?.holds(s, p, o));
     const actor = $rdf.sym(actorUrl);
     const wanted = [
       [me, FOAF('account'), actor],
@@ -465,22 +472,24 @@ export class PodTransport {
       // WebID is what dokieli reads); only where a door exists to take it.
       ...(outbox ? [[me, AS('outbox'), $rdf.sym(outbox)]] : []),
     ];
-    const missing = wanted.filter(([s, p, o]) => !g.holds(s, p, o, doc));
+    const missing = wanted.filter(([s, p, o]) => !says(s, p, o));
     // A handle change leaves the old accountName behind; ours is replaced.
     // Likewise an outbox that moved.
-    const stale = [
-      ...g.statementsMatching(actor, FOAF('accountName'), null, doc).filter(st => st.object.value !== accountName),
-      ...(outbox ? g.statementsMatching(me, AS('outbox'), null, doc).filter(st => st.object.value !== outbox) : []),
-    ];
+    const stale = [];
+    for (const { g } of docs) {
+      for (const st of g?.statementsMatching(actor, FOAF('accountName'), null) || []) {
+        if (st.object.value !== accountName) stale.push([st.subject, st.predicate, st.object]);
+      }
+      if (outbox) {
+        for (const st of g?.statementsMatching(me, AS('outbox'), null) || []) {
+          if (st.object.value !== outbox) stale.push([st.subject, st.predicate, st.object]);
+        }
+      }
+    }
     if (!missing.length && !stale.length) return false;
-    // A patch touches these statements and nothing else. Rewriting the whole
-    // profile re-serialises statements that are not ours — the OIDC issuer
-    // among them — and a server is entitled to refuse a write that would.
-    const deletes = stale.map(st => [st.subject, st.predicate, st.object]);
-    if (await this.patchDocument(docUrl, missing, deletes)) return true;
-    for (const st of stale) g.remove(st);
-    for (const [s, p, o] of missing) g.add(s, p, o, doc);
-    await this.put(docUrl, $rdf.serialize(doc, g, docUrl, 'text/turtle'), 'text/turtle');
+    // Checked before it is written, to the profile or else to a document its
+    // seeAlso names (writeAboutWebId); a patch carries only these statements.
+    await this.writeAboutWebId(podBase, { inserts: missing, deletes: stale });
     return true;
   }
 
@@ -522,4 +531,144 @@ export class PodTransport {
     if (res.status === 405 || res.status === 415 || res.status === 501) return false;
     throw new Error(`[${this.label}] PATCH ${docUrl} → ${res.status}`);
   }
+
+  // ---- writing a profile or a type index: valid RDF, or nothing ----
+  //
+  // Two rules. A change is written only if the document it leaves behind is
+  // valid RDF: the graph as it would be afterwards is serialised and parsed
+  // back, and the subject that must stay described still is. And a profile
+  // that will not take a write is not the end: the statements go to the first
+  // document its rdfs:seeAlso names, inside the same pod, that takes them —
+  // under the same check. A profile is what every Solid app signs in through;
+  // one left broken breaks them all. Reading follows the same links.
+
+  /** An IRI or a literal as a term, for the operations that pass plain values. */
+  sym(iri) {
+    try { return $rdf.sym(iri); } catch { throw new Error(`not written: ${iri} is not an absolute IRI`); }
+  }
+  literal(value) { return $rdf.literal(value); }
+
+  /** A document as a graph, or null when it is not there. */
+  async readRdf(docUrl) {
+    const res = await this.fetch(docUrl, { headers: { accept: 'text/turtle' } });
+    if (res.status === 404 || res.status === 410) return null;
+    if (res.status >= 400) throw new Error(`[${this.label}] GET ${docUrl} → ${res.status}`);
+    const g = $rdf.graph();
+    $rdf.parse(await res.text(), g, docUrl, 'text/turtle');
+    return g;
+  }
+
+  /**
+   * The document as it would be after the change, checked. Returns the Turtle
+   * to write, or throws saying why nothing may be written.
+   */
+  checkedRdf(g, docUrl, { inserts = [], deletes = [], mustDescribe = null }) {
+    const doc = $rdf.sym(docUrl);
+    for (const [s, p, o] of inserts) {
+      const bad = termProblem(s) || termProblem(p) || termProblem(o)
+        || (s?.termType === 'Literal' || p?.termType !== 'NamedNode' ? 'a literal subject or predicate' : null);
+      if (bad) throw new Error(`not written: ${bad}`);
+    }
+    const after = $rdf.graph();
+    for (const st of g.statementsMatching(null, null, null, doc)) after.add(st.subject, st.predicate, st.object, doc);
+    for (const [s, p, o] of deletes) for (const st of after.statementsMatching(s, p, o, doc)) after.remove(st);
+    for (const [s, p, o] of inserts) if (!after.holds(s, p, o, doc)) after.add(s, p, o, doc);
+    let text;
+    try { text = $rdf.serialize(doc, after, docUrl, 'text/turtle'); } catch (e) {
+      throw new Error(`not written: ${docUrl} would not serialise (${e.message})`);
+    }
+    const back = $rdf.graph();
+    try { $rdf.parse(text, back, docUrl, 'text/turtle'); } catch (e) {
+      throw new Error(`not written: ${docUrl} would not parse back (${e.message})`);
+    }
+    if (back.statementsMatching(null, null, null, doc).length !== after.statementsMatching(null, null, null, doc).length) {
+      throw new Error(`not written: ${docUrl} would not read back as written`);
+    }
+    if (mustDescribe && !back.statementsMatching($rdf.sym(mustDescribe), null, null, doc).length) {
+      throw new Error(`not written: ${docUrl} would no longer describe ${mustDescribe}`);
+    }
+    return text;
+  }
+
+  /**
+   * Change one document, or refuse. `g` is the document as read (null for a
+   * new one). A PATCH carries only these statements; where the pod cannot
+   * patch, the whole checked document is written. Returns the write's status.
+   */
+  async writeRdfChecked(docUrl, g, { inserts = [], deletes = [], mustDescribe = null }) {
+    const current = g || $rdf.graph();
+    const doc = $rdf.sym(docUrl);
+    const todo = inserts.filter(([s, p, o]) => !current.holds(s, p, o, doc));
+    const gone = deletes.filter(([s, p, o]) => current.holds(s, p, o, doc));
+    if (!todo.length && !gone.length) return 200;
+    const text = this.checkedRdf(current, docUrl, { inserts: todo, deletes: gone, mustDescribe });
+    if (g) {
+      let res = null;
+      try {
+        res = await this.fetch(docUrl, { method: 'PATCH', headers: { 'content-type': 'text/n3' },
+          body: this.n3Patch(docUrl, todo, gone) });
+      } catch { res = null; }
+      if (res && res.status < 300) return res.status;
+      // A pod that cannot patch gets the whole checked document; any other
+      // answer — a refusal, a conflict — is the answer.
+      if (res && ![405, 415, 501].includes(res.status)) return res.status;
+    }
+    const put = await this.fetch(docUrl, { method: 'PUT', headers: { 'content-type': 'text/turtle' }, body: text });
+    return put.status;
+  }
+
+  /**
+   * The profile and the documents its rdfs:seeAlso names inside this pod,
+   * each with its graph, the profile first. What any of them says about the
+   * WebID is what the profile says.
+   */
+  async profileDocs(podBase) {
+    const profileUrl = this.webId.split('#')[0];
+    const g = await this.readRdf(profileUrl);
+    if (!g) throw new Error(`no profile at ${profileUrl}`);
+    const out = [{ url: profileUrl, g, profile: true }];
+    const seen = new Set([profileUrl]);
+    for (const st of g.statementsMatching(null, RDFS('seeAlso'), null)) {
+      const url = st.object.value.split('#')[0];
+      if (seen.has(url) || !url.startsWith(podBase)) continue;       // inside this pod only
+      seen.add(url);
+      out.push({ url, g: await this.readRdf(url).catch(() => null), profile: false });
+    }
+    return out;
+  }
+
+  /** Every value the WebID has for `predicate`, across the profile and its seeAlso documents. */
+  webIdValues(docs, predicate) {
+    const me = $rdf.sym(this.webId);
+    const p = $rdf.sym(predicate);
+    const out = [];
+    for (const { g } of docs) for (const st of g?.statementsMatching(me, p, null) || []) out.push(st.object.value);
+    return [...new Set(out)];
+  }
+
+  /**
+   * Write statements about the WebID: to the profile, or — if the profile will
+   * not take them — to the first of its seeAlso documents that will. Every
+   * write checked. Returns the document written to, or null when nothing
+   * needed writing; throws when none would take it.
+   */
+  async writeAboutWebId(podBase, { inserts = [], deletes = [] }) {
+    const docs = await this.profileDocs(podBase);
+    const holds = ([s, p, o]) => docs.some(({ g }) => g?.holds(s, p, o));
+    const todo = inserts.filter(t => !holds(t));
+    const gone = deletes.filter(holds);
+    if (!todo.length && !gone.length) return null;
+    const refusals = [];
+    for (const d of docs) {
+      const here = gone.filter(([s, p, o]) => d.g?.holds(s, p, o));
+      const status = await this.writeRdfChecked(d.url, d.g, {
+        inserts: todo, deletes: here, mustDescribe: d.profile ? this.webId : null,
+      });
+      if (status < 300) return d.url;
+      refusals.push(`${d.url} → ${status}`);
+      if (status !== 401 && status !== 403) break;                    // a real answer, not "not yours to write"
+    }
+    throw new Error(`not written: neither the profile nor a document it names would take it (${refusals.join('; ')})`);
+  }
+
 }

package/lib/pod/type-index.mjs

@@ -0,0 +1,101 @@
+// type-index.mjs — an account's place, recorded in the person's public type
+// index: the list Solid apps read to find what kind of thing lives where.
+//
+// The record is a registration saying there is an instance of `as:Actor` at the
+// account's actor on the pod:
+//
+//   <#actor-…> a solid:TypeRegistration;
+//     solid:forClass as:Actor;
+//     solid:instance <…/ap/actor>.
+//
+// The instance is the actor at the pod, not a gateway's address for it, so the
+// place can be read off it. It is also how the account is found again.
+//
+// Every write goes through the transport's checked writers: valid RDF, to the
+// profile or a document its seeAlso names, or nothing.
+
+const SOLID = 'http://www.w3.org/ns/solid/terms#';
+const RDF_TYPE = 'http://www.w3.org/1999/02/22-rdf-syntax-ns#type';
+const AS_ACTOR = 'https://www.w3.org/ns/activitystreams#Actor';
+const PUBLIC_READ = ['Read'];
+
+/** Where a new public type index goes when a person has none. */
+export const newIndexUrl = (podBase) => `${podBase}settings/publicTypeIndex.ttl`;
+
+/** The person's public type index, or null when their profile names none. */
+export async function findPublicIndex(pod, podBase) {
+  const docs = await pod.profileDocs(podBase);
+  return pod.webIdValues(docs, SOLID + 'publicTypeIndex')[0] || null;
+}
+
+/** Every actor the index registers, as the instances it names. */
+export async function actorsIn(pod, indexUrl) {
+  const g = await pod.readRdf(indexUrl).catch(() => null);
+  if (!g) return [];
+  const out = [];
+  for (const reg of g.each(null, pod.sym(SOLID + 'forClass'), pod.sym(AS_ACTOR))) {
+    for (const inst of g.each(reg, pod.sym(SOLID + 'instance'), null)) out.push(inst.value);
+  }
+  return [...new Set(out)];
+}
+
+// One registration per actor, named by the actor, so registering again finds
+// the same one.
+function regFor(indexUrl, actorUrl) {
+  let h = 0;
+  for (const c of actorUrl) h = (h * 31 + c.charCodeAt(0)) >>> 0;
+  return `${indexUrl}#actor-${h.toString(36)}`;
+}
+
+/** Add the account's registration, unless the index already has one for it. */
+export async function register(pod, indexUrl, actorUrl) {
+  const g = await pod.readRdf(indexUrl);
+  if (!g) throw new Error(`no type index at ${indexUrl}`);
+  if ((await actorsIn(pod, indexUrl)).includes(actorUrl)) return false;
+  const reg = pod.sym(regFor(indexUrl, actorUrl));
+  const status = await pod.writeRdfChecked(indexUrl, g, {
+    inserts: [
+      [reg, pod.sym(RDF_TYPE), pod.sym(SOLID + 'TypeRegistration')],
+      [reg, pod.sym(SOLID + 'forClass'), pod.sym(AS_ACTOR)],
+      [reg, pod.sym(SOLID + 'instance'), pod.sym(actorUrl)],
+    ],
+    mustDescribe: indexUrl,
+  });
+  if (status >= 300) throw new Error(`the type index at ${indexUrl} did not take the registration (${status})`);
+  return true;
+}
+
+/**
+ * Make a public type index and name it from the profile. Only ever called
+ * after the person has said yes. An index already at the usual place is kept,
+ * not overwritten; it is only named.
+ */
+export async function createPublicIndex(pod, podBase) {
+  const url = newIndexUrl(podBase);
+  const doc = pod.sym(url);
+  const existing = await pod.readRdf(url).catch(() => null);
+  if (!existing) {
+    const status = await pod.writeRdfChecked(url, null, {
+      inserts: [[doc, pod.sym(RDF_TYPE), pod.sym(SOLID + 'TypeIndex')],
+        [doc, pod.sym(RDF_TYPE), pod.sym(SOLID + 'ListedDocument')]],
+      mustDescribe: url,
+    });
+    if (status >= 300) throw new Error(`could not make a type index at ${url} (${status})`);
+  }
+  // Public, as the profile is: an app finds your things by reading it.
+  await pod.setAcl(url, PUBLIC_READ);
+  await pod.writeAboutWebId(podBase, {
+    inserts: [[pod.sym(pod.webId), pod.sym(SOLID + 'publicTypeIndex'), doc]],
+  });
+  return url;
+}
+
+/**
+ * The actors this person's index says live in this pod. Empty when there is no
+ * index or nothing registered.
+ */
+export async function registeredActors(pod, podBase) {
+  const index = await findPublicIndex(pod, podBase).catch(() => null);
+  if (!index) return [];
+  return (await actorsIn(pod, index)).filter(a => a.startsWith(podBase) && a.endsWith('ap/actor'));
+}

package/lib/pod/urls.mjs

@@ -46,6 +46,12 @@ export function apUrls(remotePod, root, { publicBase = null } = {}) {
     pendingFollowers: face + 'ap/private/pending-followers',
     pendingFollowing: face + 'ap/private/pending-following',
     blocked: face + 'ap/private/blocked',
+    // The outbox as its owner reads it (every message, §5.1) and what the
+    // owner has liked (§5.5): the owner's alone, so they sit here too — and
+    // at the pod's own address even for a fronted identity, because the owner
+    // reads them there, with a credential the pod checks.
+    ownOutbox: home + 'ap/private/outbox',
+    liked: home + 'ap/private/liked',
     profileHtml: face + 'ap/profile.html',
     // Media stays on the pod even when fronted: attachment urls are not
     // identity-checked by remotes, and proxying blobs would be pure cost.

package/lib/server/embed.mjs

@@ -45,10 +45,10 @@ const mintSecret = () => crypto.randomBytes(32).toString('base64');
  * secret is moved into the pod and the host's copy removed, so the owner's
  * existing door link goes on working.
  */
-export async function ensureDoorSecret(session, podBase, { rotate = false, dataDir = null, handle = null, log = () => {} } = {}) {
+export async function ensureDoorSecret(session, podBase, { rotate = false, dataDir = null, handle = null, root = 'fedipod/', log = () => {} } = {}) {
   const base = podBase.endsWith('/') ? podBase : podBase + '/';
-  // Under the identity's own tree (fedipod/), where the gate reads it back.
-  const url = apUrls(base, 'fedipod/').state + 'door-secret.json';
+  // Under the identity's own tree, where the gate reads it back.
+  const url = apUrls(base, root).state + 'door-secret.json';
   const onHost = dataDir && handle ? path.join(dataDir, handle, 'door-secret.json') : null;
 
   if (!rotate) {
@@ -125,7 +125,7 @@ export function handleFor(podBase) {
  * pod does not travel to, so handing the pod over hands over an identity that
  * cannot sign. An identity set up before this gets the mode added.
  */
-function ensureCredential(home, { podBase, webId }) {
+function ensureCredential(home, { podBase, webId, root = 'fedipod/' }) {
   const file = path.join(home, 'credential.json');
   try {
     const rec = JSON.parse(fs.readFileSync(file, 'utf8'));
@@ -138,7 +138,7 @@ function ensureCredential(home, { podBase, webId }) {
     webId,
     remotePod: podBase.endsWith('/') ? podBase : podBase + '/',
     createdAt: new Date().toISOString(),
-    root: 'fedipod/',
+    root,
     keysMode: 'pod',
   };
   writeJsonAtomic(file, rec, { mode: 0o600 });
@@ -269,6 +269,7 @@ export async function deliverToInbox(agent, request, { podPut, gatewayWebId = nu
  */
 export async function startEmbeddedAgent({
   podBase,
+  root = 'fedipod/',
   dataDir,
   session,
   resourceStore = null,
@@ -285,7 +286,7 @@ export async function startEmbeddedAgent({
   fs.mkdirSync(home, { recursive: true, mode: 0o700 });
 
   const webId = base + webIdSuffix.replace(/^\//u, '');
-  const cred = ensureCredential(home, { podBase: base, webId });
+  const cred = ensureCredential(home, { podBase: base, webId, root });
 
   const agent = new Agent({ home, log });
   agent.log = log;

package/lib/session/fedi-account.mjs

@@ -60,6 +60,14 @@ export function fediAccount({
     return body;
   };
 
+  // A collection, or a page of one, may be named by its address or given
+  // whole in place (ActivityPub allows either); the whole one is used as it
+  // is, an address is fetched.
+  const idOf = (v) => (typeof v === 'string' ? v : v?.id || null);
+  const asDoc = async (v) => (v && typeof v === 'object'
+    ? (v.type ? v : await asDoc(v.id))
+    : (typeof v === 'string' ? await json(v, { headers: { accept: 'application/activity+json' } }) : null));
+
   // Only loaded when `outbox({ rdf: true })` is actually called, so nobody
   // pays for a JSON-LD parser just by importing this file. Not in
   // `dependencies` — the app supplies "jsonld" if it wants this flag to work.
@@ -76,15 +84,16 @@ export function fediAccount({
     if (!actorUrl) return null;
     const jsonld = await loadJsonLd();
     const actorDoc = await json(actorUrl, { headers: { accept: 'application/activity+json' } });
-    let pageUrl = actorDoc?.outbox ? (await json(actorDoc.outbox, { headers: { accept: 'application/activity+json' } }))?.first : null;
+    const head = await asDoc(actorDoc?.outbox);
+    let page = head?.first ?? null;
     const quads = []; const seen = new Set(); let collected = 0;
-    while (pageUrl && collected < limit && !seen.has(pageUrl)) {
-      seen.add(pageUrl);
-      const page = await json(pageUrl, { headers: { accept: 'application/activity+json' } });
-      if (!page) break;
-      quads.push(...(await jsonld.toRDF(page)));
-      collected += (page.orderedItems || []).length;
-      pageUrl = page.next || null;
+    while (page && collected < limit && !seen.has(idOf(page) || page)) {
+      seen.add(idOf(page) || page);
+      const doc = await asDoc(page);
+      if (!doc) break;
+      quads.push(...(await jsonld.toRDF(doc)));
+      collected += (doc.orderedItems || []).length;
+      page = doc.next ?? null;
     }
     return quads;
   };
@@ -226,7 +235,7 @@ export function fediAccount({
     let actor = p.actor || pick(me, FOAF_ACCOUNT);
     let door = pick(me, AS_OUTBOX);
     const doc = actor ? await json(actor, { headers: { accept: 'application/activity+json' } }) : null;
-    if (!door && doc?.outbox) door = doc.outbox;
+    if (!door && doc?.outbox) door = idOf(doc.outbox);
     let root = p.root || null;
     if (!root && doc?.preferredUsername && actor) {
       const { aliases } = await webfinger(doc.preferredUsername, new URL(actor).host).catch(() => ({ aliases: [] }));
@@ -340,7 +349,7 @@ export function fediAccount({
       fetch: session.fetch,
       async profile() {
         const doc = facts.actor ? await json(facts.actor, { headers: { accept: 'application/activity+json' } }) : null;
-        const count = async (url) => (url ? (await json(url, { headers: { accept: 'application/activity+json' } }))?.totalItems ?? null : null);
+        const count = async (v) => (await asDoc(v))?.totalItems ?? null;
         return { handle: facts.handle, name: doc?.name || null, url: doc?.url || null, avatar: doc?.icon?.url || (typeof doc?.icon === 'string' ? doc.icon : null), bio: doc?.summary || '',
           followers: await count(doc?.followers), following: await count(doc?.following), posts: await count(doc?.outbox), actor: facts.actor, webId: facts.webId };
       },

package/lib/session/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fediverse-account",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Type a Fediverse handle or a WebID and get back an account you can act with: post, read its timeline, follow, reply, favourite, boost. Works out whether the account lives on a Mastodon-family server or on a Solid pod through FediPod, sends the person to sign in there, brings them back to where they were, and speaks to whichever it is.",
   "type": "module",
   "license": "MIT",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fedipod-server",
-  "version": "0.28.1",
+  "version": "0.29.0",
   "description": "The FediPod Server: a full ActivityPub server as a Community Solid Server component.",
   "license": "MIT",
   "main": "dist/index.js",

package/run-agent.mjs

@@ -552,6 +552,8 @@ export class Agent {
     // Own posts the outbox names and the timeline index lacks come back here,
     // before anything acts on the index.
     await this.publisher.healStatuses().catch(e => this.log(`healing the timeline index: ${e.message}`));
+    // Likes made before the liked list existed become its first entries.
+    try { this.publisher.backfillLiked(); } catch (e) { this.log(`liked list: ${e.message}`); }
     this.lease.onLost = () => this.demote();
     this.lease.startRenewal();
     this.deliverer.startQueue();

package/web/admin/actors.js

@@ -136,6 +136,8 @@ $('new-actor-form').addEventListener('submit', async (ev) => {
   };
   if (answers.mode === 'new') answers.podName = $('new-podname').value.trim() || handle;
   else answers.pod = $('new-pod').value.trim();
+  answers.container = $('new-container').value.trim();
+  answers.createIndex = $('new-createIndex').checked;
   $('new-actor-go').disabled = true;
   say(`setting up ${handle || 'the new actor'} — this takes a while`);
   const r = await write('/new-actor', answers, `setting up ${handle}`);

package/web/admin/index.html

@@ -272,6 +272,15 @@ pre { overflow-x: auto; background: #0001; padding: .6rem; border-radius: .3rem;
         <label for="new-pod">Pod address</label>
         <input type="url" id="new-pod" autocomplete="url" placeholder="https://you.solidcommunity.net/">
       </div>
+      <label for="new-container">Store your data in a container named fedipod, inside this container</label>
+      <input type="text" id="new-container" autocomplete="off" spellcheck="false" placeholder="/"
+        aria-describedby="new-container-hint">
+      <p class="hint" id="new-container-hint">Leave it empty for your pod's root. This is permanent.</p>
+      <p id="new-typeindex-text">FediPod records where the account lives in your pod's public type index,
+        the list Solid apps use to find your things. A new pod has none; setup stops if yours has none
+        and you have not said yes here. It will be readable by anyone, like your profile.</p>
+      <label class="choice"><input type="checkbox" id="new-createIndex" aria-describedby="new-typeindex-text">
+        If my pod has no public type index, create one</label>
     </fieldset>
 
     <p>

package/web/admin/record.js

@@ -269,6 +269,9 @@ function render() {
     ['Fediverse identity', config.address || `@${config.handle} — no resolvable address`,
       config.accountId && config.address ? { href: `/admin/client/#/a/${config.accountId}` } : null],
     ['Solid identity', config.webId, config.remotePod ? { href: config.remotePod, blank: true } : null],
+    // Where on the pod the account's data lives: the container its owner chose.
+    ['stored at', config.remotePod && config.root ? config.remotePod + config.root : null,
+      config.remotePod && config.root ? { href: config.remotePod + config.root, blank: true } : null],
     ['Other identities', 'ctl'],
     ['local store', config.home],
     // The address you actually open, not the bare number — the named origin when
@@ -362,7 +365,7 @@ function render() {
   if (!config.address) {
     const p = document.createElement('p');
     p.className = 'warn';
-    p.textContent = `${config.remotePod} is not the root of its own host, so this actor cannot be `
+    p.textContent = `${config.remotePod} is a suffixed pod, so this actor cannot be `
       + 'discovered as a handle by other servers. Posting and reading still work.';
     $('pane-identity').appendChild(p);
   }

package/web/admin/setup/index.html

@@ -151,7 +151,7 @@ button:disabled { opacity: .5; cursor: default; }
           <input type="url" id="issuerOther" name="issuerOther" autocomplete="url" placeholder="https://pods.example.org">
         </div>
         <p class="hint" id="issuer-new-hint">The Community Solid Server providers from
-          solidproject.org. A provider that puts pods on paths gives your address at a
+          solidproject.org. A provider that makes suffixed pods gives your address at a
           gateway instead.</p>
       </div>
 
@@ -184,6 +184,22 @@ button:disabled { opacity: .5; cursor: default; }
         <label for="pod">Pod address</label>
         <input type="url" id="pod" name="pod" autocomplete="url" placeholder="https://you.solidcommunity.net/">
       </div>
+
+      <div id="row-container">
+        <label for="container">Store your data in a container named fedipod, inside this container</label>
+        <input type="text" id="container" name="container" autocomplete="off" spellcheck="false"
+          placeholder="/" aria-describedby="container-hint">
+        <p class="hint" id="container-hint">Leave it empty for your pod's root. This is permanent.
+          <span id="place"></span></p>
+      </div>
+
+      <div id="row-typeindex" hidden>
+        <p id="typeindex-text">Your pod has no public type index, the list Solid apps use to find your
+          things. FediPod needs one to record where your account lives. It will be readable by anyone,
+          like your profile.</p>
+        <label class="choice"><input type="checkbox" id="createIndex" name="createIndex"
+          aria-describedby="typeindex-text"> Create a public type index on my pod</label>
+      </div>
     </fieldset>
 
     <p id="row-reenter" class="warn" hidden>Finishing a setup that already has an account credential.

package/web/admin/setup/setup.js

@@ -108,6 +108,9 @@ function answers() {
   };
   if (mode === 'new') a.podName = f.podName.value.trim() || a.handle;
   else a.pod = f.pod.value.trim();
+  // The container that holds fedipod/, and the yes to a new public type index.
+  a.container = f.container.value.trim();
+  a.createIndex = f.createIndex.checked;
   if (!state.resumable && !state.passwordSupplied) a.password = f.password.value;
   return a;
 }
@@ -116,13 +119,13 @@ function answers() {
 // account?", in the same words, as you type.
 const NOTES = {
   'pod-is-a-path': (a) =>
-    `This pod is a path on ${host(a.pod)}, not the root of its own host. WebFinger is `
-    + 'answered only at a host root, which this pod cannot write to, so other servers '
+    `This pod is suffixed (on ${host(a.pod)}), not subdomained. WebFinger is `
+    + 'answered only for a subdomained pod, so other servers '
     + 'will not find this address. Posting and reading still work; being discovered does not.',
 };
 const REFUSALS = {
   'group-needs-host-root': () =>
-    'A group needs a pod at the root of its own host, or nobody could ever find it. '
+    'A group needs a subdomained pod, or nobody could ever find it. '
     + 'Give the group a pod of its own, or set this up as a person.',
 };
 const host = (u) => { try { return new URL(u).host; } catch { return u; } };
@@ -149,6 +152,11 @@ async function preview() {
   const { json } = await postJson('/setup/check', a);
   if (!json) return;
   $('preview').textContent = json.address || '…';
+  // Where the data will go, and the type index question when the pod has
+  // none (a new pod never does).
+  $('place').textContent = json.placeProblem ? json.placeProblem : (json.place ? `Your data will be at ${json.place}.` : '');
+  $('row-typeindex').hidden = json.typeIndex === true;
+  try { $('container').placeholder = a.mode === 'existing' && a.pod ? new URL(a.pod).pathname : '/'; } catch { /* not a URL yet */ }
   // The address-shape choice: hidden for a group (a group cannot front yet),
   // locked to the gateway for a pod on a suffix-based host, an open choice
   // for a pod at its own host.
@@ -165,7 +173,7 @@ async function preview() {
     if (note) {
       note.hidden = !forced;
       note.textContent = forced
-        ? 'Your pod is on a suffix-based host, so its address lives at the gateway. Your posts, key and data stay on your pod.'
+        ? 'Your pod is suffixed, so its address lives at the gateway. Your posts, key and data stay on your pod.'
         : '';
     }
   }
@@ -188,6 +196,11 @@ async function preview() {
 async function onSubmit(ev) {
   ev.preventDefault();
   $('form-error').textContent = '';
+  // No type index and no yes: stop here, before anything is sent.
+  if (!$('row-typeindex').hidden && !$('createIndex').checked) {
+    $('form-error').textContent = 'Setup stopped. Nothing was written to your pod. FediPod needs a public type index to record where your account lives.';
+    return;
+  }
   $('submit').disabled = true;
   const { status, json } = await postJson('/setup', answers());
   if (status !== 202) {
@@ -300,7 +313,7 @@ function paneDone(result) {
   $('done-address').textContent = result?.address || `@${result?.handle} — no resolvable address`;
   const notes = [];
   if (!result?.resolvable) {
-    notes.push(`${result?.pod} is not the root of its own host, so this address cannot be `
+    notes.push(`${result?.pod} is a suffixed pod, so this address cannot be `
       + 'discovered by other servers. Posting and reading still work.');
   }
   if (result?.unreachable?.length) {

package/web/app/README.md

@@ -77,5 +77,5 @@ See the `MastoApi` options in `agent.mjs`.
 | **Web push** | `shims/web-push.mjs` is a no-op. `vapid` is omitted, and a client that subscribes anyway gets a 422 rather than a subscription nothing will push to. |
 | **Scheduled posts** | nothing runs between now and the scheduled time. A `scheduled_at` is refused with a 422 that says so — accepting one was silent loss. |
 | **Groups** | sign-up makes personal identities only (`signup.mjs`), and the moderation surface is not here. Joining a group works; hosting one needs the DeviceAgent. See `groups.md`. |
-| **Changing where the address lives** | the shape is chosen at sign-up (`signup.mjs`): on the pod, `@you@yourpod` with the gateway as a mail door, or at the gateway, `@you@front` — and a pod on a suffix-based host is always fronted. `admin-facade.mjs` refuses changing it afterwards, because a rename needs a restart a browser does not have. |
+| **Changing where the address lives** | the shape is chosen at sign-up (`signup.mjs`): on the pod, `@you@yourpod` with the gateway as a mail door, or at the gateway, `@you@front` — and a suffixed pod is always fronted. `admin-facade.mjs` refuses changing it afterwards, because a rename needs a restart a browser does not have. |
 | **Moving the private half** | `/state-move` is about filesystem paths and `credential.json`. A browser has neither; its private half is always on the pod. |

package/web/app/admin-facade.mjs

@@ -356,7 +356,7 @@ export class AdminFacade {
         const aliases = [...(cfg.aliases || [])];
         if (body.add) {
           if (!webfingerHost(urls.base) && !cfg.gateway?.frontActor) {
-            return json(400, { error: 'this pod is a suffix-based host, so other servers could never resolve it as a Move target' });
+            return json(400, { error: 'this pod is suffixed, so other servers could never resolve it as a Move target' });
           }
           const id = await this.resolveActor(body.add);
           if (!id) return json(400, { error: `could not fetch the old account (${body.add}) — enter its URL or @user@host, and it must answer` });