fedipod-server 0.28.1 → 0.30.0

package/lib/device/cli/commands/setup.mjs

@@ -1,447 +0,0 @@
-// setup.mjs — making an identity and its secrets: setup, rotate-key,
-// revoke-credential, tokens, passwd, keys.
-
-import fs from 'node:fs';
-import path from 'node:path';
-import { pathToFileURL } from 'node:url';
-import { tildify, rootOf, recordLastUsed, writeJsonAtomic } from '../../home.mjs';
-import { insecureUrlReason } from '../../../shared/safefetch.mjs';
-import { localFetch } from '../../../client/localapi.mjs';
-import { args, flag, has, PROFILE, AP_ROOT, HOME, PORT, recordAgent, useProfile, requireHandle, requireIdentity, askHidden, ask, endAsking, openBrowser, finish, IDENTITY_FLAGS, refuseExistingIdentity, runBrowserSetup } from '../context.mjs';
-
-export async function setup() {
-  // --profile names the home before anything is asked, so a collision is
-  // knowable now; refuseExistingIdentity exits when it finds one.
-  if (PROFILE) { useProfile(PROFILE); refuseExistingIdentity(); }
-  // At a terminal with no identity flag, setup asks two things and hands the
-  // rest to the page.
-  if (process.stdin.isTTY && !has('cli') && !IDENTITY_FLAGS.some(f => args.includes('--' + f))) {
-    return runBrowserSetup();
-  }
-const root = flag('root') || 'fedipod/';   // new installs default to the fedipod/ container
-const kind = has('group') ? 'group' : 'person';
-const approveJoins = has('group') && has('approve-joins');
-const summary = flag('summary');
-const icon = flag('icon');
-let pod = flag('pod');
-const interactive = process.stdin.isTTY;
-
-// Everything that shapes your identity is asked for here, with defaults,
-// because these are decisions — the pod name becomes half of your
-// permanent address, and nobody should discover that after the fact.
-// Flags skip the matching question, so scripted setup is unchanged.
-let newAccount = has('new-account');
-if (!newAccount && !pod) {
-  if (!interactive) {
-    console.error('need --email and --handle, plus either --pod <url> or --new-account');
-    process.exit(2);
-  }
-  const have = await ask('do you already have a Solid pod? (y/n)', 'n');
-  if (/^y/i.test(have)) {
-    // Either tuck the fediverse account into the pod they already have,
-    // or make a fresh pod on the same Solid account for it.
-    const where = await ask('store your Fediverse account in that pod, or in a new pod? (existing/new)', 'existing');
-    if (/^n/i.test(where)) newAccount = true;
-    else pod = await ask('your pod address (e.g. https://you.solidcommunity.net/)');
-  } else {
-    newAccount = true;
-  }
-}
-if (!newAccount && !pod) { console.error('no pod given'); process.exit(2); }
-if (!newAccount) {
-  const { resourceExists } = await import(new URL('../../../../lib/pod/root.mjs', import.meta.url));
-  const { apUrls, DEFAULT_ROOT: DR } = await import(new URL('../../../../lib/core/wire.mjs', import.meta.url));
-  if (await resourceExists(fetch, apUrls(pod, DR).actor)) {
-    if (String(flag('address') || 'pod').toLowerCase() !== 'front') {
-      console.error('The pod already hosts a FediPod account. If you want a second account, put it on a different pod.');
-      console.error('To move an account whose address is at another gateway to this one, add --address front.');
-      process.exit(2);
-    }
-    console.log('The pod already holds an account; if its address is at another gateway, setup moves it here.');
-  }
-}
-
-const issuer = flag('issuer') || await ask('Solid identity provider', 'https://solidcommunity.net');
-// Before the password is asked for, let alone sent. The issuer is where it
-// goes and the pod is where the credential it buys is used, so an http:
-// address off this machine puts both in clear. Loopback is exempt: it never
-// reaches a network interface, and a pod on this machine is an ordinary way
-// to run this.
-for (const [url, what] of [[issuer, 'identity provider address'], [pod, 'pod address']]) {
-  const bad = insecureUrlReason(url, what);
-  if (bad) { console.error(bad); process.exit(2); }
-}
-const email = flag('email') || await ask(`account email at ${new URL(issuer).host}`);
-const handle = flag('handle') || await ask('handle (the name in your address; permanent)');
-if (!email || !handle) {
-  console.error('an email and a handle are required');
-  process.exit(2);
-}
-// Before anything irreversible: the account creation and the mint are both
-// one-way, and a credential is shown once. A home that cannot be decided has
-// to be refused here, not after there is something to lose.
-requireHandle(handle);
-useProfile(PROFILE || handle);
-refuseExistingIdentity();
-const podName = newAccount
-  ? (flag('pod-name') || await ask('pod name (this becomes the domain of your address)', handle))
-  : null;
-const name = flag('name') || await ask('display name (shown above your address)', handle);
-
-// A handle resolves through <host>/.well-known/webfinger, so it only works
-// when the pod owns the root of its host. Whether a NEW pod gets its own
-// subdomain is the server's call, so promise nothing here we cannot keep.
-const { webfingerHost, apUrls, DEFAULT_ROOT } = await import(new URL('../../../../lib/core/wire.mjs', import.meta.url));
-const issuerHost = new URL(issuer).host;
-const wfHost = newAccount ? null : webfingerHost(pod);
-
-// Where the address lives: on the pod (default), or at a gateway. A pod on a
-// suffix-based host cannot answer WebFinger for a handle, so its address
-// is at the gateway whatever was asked. `--address front` takes a gateway
-// address for a host-root pod too; `--gateway <origin>` names the gateway.
-const addressShape = String(flag('address') || 'pod').toLowerCase();
-if (addressShape !== 'pod' && addressShape !== 'front') { console.error('--address must be pod or front'); process.exit(2); }
-const gatewayOrigin = flag('gateway') || 'https://fedipod.net';
-{ const badGw = insecureUrlReason(gatewayOrigin, 'gateway address'); if (badGw) { console.error(badGw); process.exit(2); } }
-const gatewayHost = new URL(gatewayOrigin).host;
-// For an EXISTING pod the shape is known now; for a NEW pod the path case is
-// decided after the pod is made, below.
-let fronted = (!newAccount && !wfHost) || addressShape === 'front';
-if (fronted && kind === 'group') {
-  console.error('a group needs a pod at its own host — a gateway address for a group is not supported yet.');
-  process.exit(2);
-}
-// A person warned about an unresolvable handle is the one who suffers, so a
-// warning is their call to accept. Nobody could ever find this group, and the
-// people it would fail are not the operator reading the warning.
-if (kind === 'group' && !newAccount && !wfHost) {
-  console.error(`${pod} is a path on ${new URL(pod).host}, not the root of its own host.`);
-  console.error('WebFinger is answered only at a host root, so nobody could find this group.');
-  console.error('Give the group a pod of its own:  fedipod setup --group --new-account');
-  process.exit(2);
-}
-console.log(kind === 'group' ? '\nThe group will be:\n' : '\nYou will be:\n');
-console.log(`  ${name}`);
-if (fronted) {
-  console.log(`  @${handle}@${gatewayHost}\n`);
-  console.log(`— your address lives at ${gatewayHost}; your posts, key and data stay on your pod.\n`);
-} else if (wfHost) {
-  console.log(`  @${handle}@${wfHost}\n`);
-} else if (newAccount) {
-  console.log(`  @${handle}@${podName}.${issuerHost}\n`);
-  console.log(`— provided ${issuerHost} gives each pod its own subdomain. A server that puts`);
-  console.log(`pods at ${issuerHost}/${podName}/ instead cannot answer WebFinger for an address,`);
-  console.log(`so setup takes an address at ${gatewayHost} for you and says so.\n`);
-}
-console.log('The display name can be changed later; the handle and pod cannot.');
-const go = await ask(newAccount
-  ? (kind === 'group' ? 'create pod and group? (y/n)' : 'create pod and Fediverse account? (y/n)')
-  : (kind === 'group' ? 'create group on this pod? (y/n)' : 'create Fediverse account on this pod? (y/n)'), 'y');
-if (!/^y/i.test(go)) { console.log('nothing was created'); process.exit(0); }
-endAsking();                           // hand the tty to the password prompt
-
-const password = process.env.AP_PASSWORD || await askHidden(`password for ${email} at ${issuer}: `);
-
-if (newAccount) {
-  const { createAccountWithPod } = await import(new URL('../../../../lib/device/account.mjs', import.meta.url));
-  const made = await createAccountWithPod({ issuer, email, password, podName });
-  pod = made.pod;
-  console.log(`account + pod created: ${pod}`);
-  if (!webfingerHost(pod)) {
-    if (kind === 'group') {
-      console.log(`\n${issuerHost} created the pod at ${pod} — a suffix-based host.`);
-      console.log('WebFinger is answered only at a host root, so nobody could find this group.');
-      console.log('The pod exists; no actor was published.');
-      process.exit(0);
-    }
-    // A path pod's address lives at the gateway; nothing to warn about.
-    fronted = true;
-    console.log(`${issuerHost} puts pods on paths, so your address will be @${handle}@${gatewayHost}.`);
-  }
-}
-
-const { mintCredential } = await import(new URL('../../../../lib/device/remote.mjs', import.meta.url));
-// New credentials only: one already registered keeps the name it was minted
-// under, so existing pods stay as they are unless they are set up again.
-const credential = await mintCredential({ origin: issuer, email, password, name: 'fedipod' });
-const rec = {
-  ...credential,
-  remotePod: pod.endsWith('/') ? pod : pod + '/',
-  createdAt: new Date().toISOString(),
-  // The private half goes on THIS machine, exactly as the browser setup does
-  // (lib/setup.mjs). Omitting it here meant the two paths produced different
-  // installs from the same answers: the CLI put the timeline, contacts,
-  // blocklist and notifications on the pod — the layout the relay design
-  // exists to avoid, and the one that makes receiving a post cost pod writes.
-  // It also made provisioning write a tree it did not need, which is where a
-  // slow server showed it up.
-  privateRoot: flag('private-root')
-    || pathToFileURL(path.join(HOME, 'private')).href + '/',
-  ...(root ? { root } : {}),
-  ...(flag('keys') === 'pod' ? { keysMode: 'pod' } : {}),
-  ...(has('rotate-key') ? { rotateKeyOnce: true } : {}),
-  // What shape this install is. Both setup paths stamp it, so `upgrade` can
-  // tell an old install from a new one rather than inferring it.
-  layout: (await import(new URL('../../../../lib/device/migrate.mjs', import.meta.url))).CURRENT_LAYOUT,
-};
-fs.mkdirSync(HOME, { recursive: true, mode: 0o700 });
-writeJsonAtomic(path.join(HOME, 'credential.json'), rec);
-// The one you just made is the one you are using.
-if (rootOf(HOME) === AP_ROOT) recordLastUsed(AP_ROOT, path.basename(HOME));
-recordAgent({ port: PORT, handle });   // later commands need no --port
-console.log(`credential minted and saved to ${path.join(HOME, 'credential.json')}`);
-
-let gatewayCfg = null;
-if (fronted) {
-  const { takeGatewayAddress } = await import(new URL('../../../../lib/device/setup.mjs', import.meta.url));
-  const urls = apUrls(pod, root || DEFAULT_ROOT);
-  console.log(`taking a gateway address at ${gatewayHost}`);
-  gatewayCfg = await takeGatewayAddress({
-    home: HOME, credential: rec, gatewayOrigin, handle,
-    podHome: urls.home, actorUrl: urls.actor, kind, log: (...a) => console.log('[setup]', ...a),
-  });
-}
-const { Agent } = await import(new URL('../../../../run-agent.mjs', import.meta.url));
-const agent = new Agent({ home: HOME, log: (...a) => console.log('[setup]', ...a) });
-await agent.bootstrap({ handle, name, root, kind, approveJoins, summary, icon, gateway: gatewayCfg });
-await agent.connect({ repair: false });   // publishProfile below is the publish
-await agent.publisher.publishProfile();
-await agent.store.flush();
-const finalHost = gatewayCfg ? gatewayHost : webfingerHost(rec.remotePod);
-const what = kind === 'group' ? 'group' : 'actor';
-console.log(finalHost
-  ? `${what} published: @${handle}@${finalHost}`
-  : `${what} published, but not reachable as a handle \u2014 ${rec.remotePod} is not a host root`);
-
-// Straight into serving — setup ends with a working client in the browser.
-const { startAdmin } = await import(new URL('../../../../lib/device/admin/index.mjs', import.meta.url));
-const { hostLabel } = await import(new URL('../../../../lib/shared/guard.mjs', import.meta.url));
-startAdmin({ port: PORT, handle, gateToken: process.env.AP_GATE_TOKEN || '', agent, log: (...a) => console.log('[ap]', ...a) });
-const shutdown = () => {
-  setTimeout(() => process.exit(0), 1500).unref();   // never hang a stop on a slow pod
-  try { fs.rmSync(path.join(HOME, 'agent.pid'), { force: true }); } catch {}
-  Promise.allSettled([agent.store.flush(), agent.lease?.release()]).finally(() => process.exit(0));
-};
-process.on('SIGINT', shutdown);
-process.on('SIGTERM', shutdown);
-// The named origin, and the instance to log the client into is that same
-// origin. Opening the shared one and then telling you to log in there is how
-// two identities end up sharing a browser storage bucket, and a client on the
-// shared origin shows whichever account it happens to hold.
-const label = hostLabel(handle);
-const authority = `${label ? label + '.' : ''}localhost:${PORT}`;
-const url = `http://${authority}/`;
-if (kind === 'group') {
-  console.log(`group running on ${url} — see \`fedipod members\``);
-} else {
-  console.log(`agent running — opening ${url} (log in with instance ${authority})`);
-  openBrowser(url);
-}
-}
-
-export async function rotateKey() {
-requireIdentity();
-const { Agent } = await import(new URL('../../../../run-agent.mjs', import.meta.url));
-const agent = new Agent({ home: HOME, log: (...a) => console.log('[rotate-key]', ...a) });
-// A home whose keys.json is gone or truncated cannot connect() at all:
-// resolveKeys refuses to mint over a key the actor already publishes, which
-// is the right default — minting silently would invalidate every signature
-// the other device can still make. It did leave the advice that refusal
-// prints ("run fedipod rotate-key") a dead end, though, because this
-// command connects first and meets the same refusal. --force arms the
-// one-shot rotation in the credential so the connect can get past it.
-const forced = has('force');
-const rotateCredPath = path.join(HOME, 'credential.json');
-if (forced) {
-  const cred = JSON.parse(fs.readFileSync(rotateCredPath, 'utf8'));
-  writeJsonAtomic(rotateCredPath, { ...cred, rotateKeyOnce: true });
-  console.log('--force: the replacement key is minted as the agent connects\n');
-}
-// Read-only until you say yes: connecting for real acquires the lease and
-// starts the whole active agent — a destructive inbox drain, a channel
-// subscription, ACL probes and a tag-feed sweep — before the prompt.
-if (!await agent.connect({ act: false })) {
-  console.error('nothing to rotate — no configured agent in this AP_HOME');
-  process.exit(2);
-}
-const cfg = agent.store.getConfig();
-console.log(`\nRotating the signing key for @${cfg.handle}@${new URL(cfg.remotePod).host}\n`);
-console.log('  · a new keypair replaces the one in this home');
-console.log('  · the actor document is republished so other servers learn it');
-console.log('  · ANY OTHER DEVICE holding the old key stops being able to sign\n');
-const ans = has('yes') ? 'y' : await ask('rotate now? (y/n)', 'n');
-endAsking();
-if (!/^y/i.test(ans)) {
-  // --force arms the one-shot rotation before the prompt, so the preview
-  // connect can read past the mint refusal. Declining has to disarm it, or
-  // "key unchanged" would be a lie: the next ordinary start would rotate,
-  // and nothing on that path republishes the actor.
-  if (forced) {
-    try {
-      const { rotateKeyOnce, ...rest } = JSON.parse(fs.readFileSync(rotateCredPath, 'utf8'));
-      writeJsonAtomic(rotateCredPath, rest);
-    } catch { /* the credential moved under us; the flag goes with it */ }
-  }
-  console.log('key unchanged');
-  process.exit(0);
-}
-await agent.connect();                          // now it may act
-if (forced) {
-  // connect() has already minted it; all that is left is telling the
-  // fediverse. Calling rotateKey here would mint a second one for nothing.
-  await agent.publisher.publishProfile();
-  console.log('rotated and republished');
-} else {
-  const r = await agent.rotateKey();
-  console.log(r.changed ? 'rotated and republished' : 'no change — the key was already fresh');
-}
-await finish(agent);
-}
-
-export async function revokeCredential() {
-// The credential file cannot be protected from anything running as you —
-// so the answer to a suspected leak is to kill it server-side, fast.
-const { Agent } = await import(new URL('../../../../run-agent.mjs', import.meta.url));
-const { revokeCredentialViaAccount } = await import(new URL('../../../../lib/device/remote.mjs', import.meta.url));
-const agent = new Agent({ home: HOME, log: () => {} });
-const cred = agent.readCredential();
-if (!cred) { console.error('no credential to revoke'); process.exit(2); }
-const email = flag('email');
-if (!email) { console.error('need --email <account email> (the account password is prompted)'); process.exit(2); }
-const password = process.env.AP_PASSWORD || await askHidden(`password for ${email} at ${cred.issuerOrigin}: `);
-const ok = await revokeCredentialViaAccount({
-  origin: cred.issuerOrigin, email, password, resource: cred.resource,
-}).catch(e => { console.error(`revoke failed: ${e.message}`); return false; });
-if (ok) {
-  fs.rmSync(path.join(HOME, 'credential.json'), { force: true });
-  console.log('credential revoked server-side and deleted locally — run setup again to reconnect');
-} else {
-  console.error('server did not confirm revocation — revoke it from the account dashboard');
-  console.error(`(credential resource: ${cred.resource || 'unknown — dashboard only'})`);
-  process.exit(1);
-}
-}
-
-export async function tokens() {
-const { Agent } = await import(new URL('../../../../run-agent.mjs', import.meta.url));
-const { RemotePod } = await import(new URL('../../../../lib/device/remote.mjs', import.meta.url));
-const { apUrls } = await import(new URL('../../../../lib/core/wire.mjs', import.meta.url));
-const agent = new Agent({ home: HOME, log: () => {} });
-const cred = agent.readCredential();
-if (!cred) { console.error('no credential — run setup first'); process.exit(2); }
-agent.remote = new RemotePod(cred);
-await agent.remote.warmup();
-agent.urls = apUrls(cred.remotePod, cred.root);
-agent.store.attach(agent.privateStorage(cred, 'state'));   // honours privateRoot
-await agent.store.load();
-const recs = agent.store.read('masto-tokens.json', [])
-  .map(r => (typeof r === 'string' ? { token: r, createdAt: null } : r));
-if (has('revoke-all')) {
-  agent.store.write('masto-tokens.json', []);
-  await agent.store.flush();
-  console.log(`revoked ${recs.length} token(s) — every logged-in client must log in again`);
-} else if (flag('revoke')) {
-  const prefix = flag('revoke');
-  const kept = recs.filter(r => !r.token.startsWith(prefix));
-  agent.store.write('masto-tokens.json', kept);
-  await agent.store.flush();
-  console.log(`revoked ${recs.length - kept.length} token(s) matching "${prefix}"`);
-} else {
-  if (!recs.length) console.log('no client tokens issued');
-  for (const r of recs) {
-    const age = r.createdAt ? `${Math.round((Date.now() - r.createdAt) / 86400000)}d old` : 'undated';
-    console.log(`${r.token.slice(0, 8)}…  ${age}`);
-  }
-  console.log('\nrevoke with: fedipod tokens --revoke <prefix>   (or --revoke-all)');
-}
-}
-
-export async function passwd() {
-requireIdentity();
-const { Agent } = await import(new URL('../../../../run-agent.mjs', import.meta.url));
-const { hashPassword } = await import(new URL('../../../../lib/client/masto/index.mjs', import.meta.url));
-const { RemotePod } = await import(new URL('../../../../lib/device/remote.mjs', import.meta.url));
-const { apUrls } = await import(new URL('../../../../lib/core/wire.mjs', import.meta.url));
-const agent = new Agent({ home: HOME, log: () => {} });
-const cred = agent.readCredential();
-if (!cred) { console.error('no credential — run setup first'); process.exit(2); }
-const pw = await askHidden('new UI password: ');
-if (!pw) { console.error('empty password — aborted'); process.exit(2); }
-agent.remote = new RemotePod(cred);
-await agent.remote.warmup();
-agent.urls = apUrls(cred.remotePod, cred.root);
-agent.store.attach(agent.privateStorage(cred, 'state'));   // honours privateRoot
-await agent.store.load();
-const config = agent.store.getConfig();
-if (!config) { console.error('pod state empty — run setup first'); process.exit(2); }
-agent.store.setConfig({ ...config, uiPassword: hashPassword(pw) });
-await agent.store.flush();
-console.log('UI password set — /oauth/authorize now shows a login form (restart a running agent to pick it up)');
-}
-
-export async function keys() {
-// Where the signing key lives; `--to pod` moves it into pod state — with
-// the state store on a pod every device reaches, that is what lets them
-// all sign as one actor. `--to local` flips back: the next start adopts
-// the pod copy onto this machine and removes it from the pod.
-requireIdentity();
-const localKeyFile = path.join(HOME, 'keys.json');
-const to = flag('to');
-if (!to) {
-  const cred0 = JSON.parse(fs.readFileSync(path.join(HOME, 'credential.json'), 'utf8'));
-  console.log(fs.existsSync(localKeyFile)
-    ? `signing key: ${tildify(localKeyFile)} (this machine only)`
-    : cred0.keysMode === 'pod'
-      ? 'signing key: pod state (shared by every device that reaches the state store)'
-      : 'signing key: none found here — it mints on the next start');
-  process.exit(0);
-}
-if (!['pod', 'local'].includes(to)) {
-  console.error('usage: fedipod keys [--to pod|local]');
-  process.exit(2);
-}
-// The running agent holds the key and the config in memory — stop it first.
-const answering = await localFetch(HOME, PORT, `/status`).then(r => r.ok).catch(() => false);
-if (answering) {
-  console.error(`an agent is answering on :${PORT} — stop it first (fedipod stop), then re-run`);
-  process.exit(2);
-}
-const credPath = path.join(HOME, 'credential.json');
-const cred = JSON.parse(fs.readFileSync(credPath, 'utf8'));
-if (to === 'local') {
-  if (cred.keysMode !== 'pod') { console.log('keys are already local'); process.exit(0); }
-  delete cred.keysMode;
-  writeJsonAtomic(credPath, cred);
-  console.log('keys set to local — the next start adopts the pod copy onto this machine and removes it from the pod');
-  process.exit(0);
-}
-if (cred.keysMode === 'pod' && !fs.existsSync(localKeyFile)) {
-  console.log('keys are already pod-held');
-  process.exit(0);
-}
-const { Agent } = await import(new URL('../../../../run-agent.mjs', import.meta.url));
-const { RemotePod } = await import(new URL('../../../../lib/device/remote.mjs', import.meta.url));
-const { apUrls } = await import(new URL('../../../../lib/core/wire.mjs', import.meta.url));
-const { moveKeysToPod } = await import(new URL('../../../../lib/core/keys.mjs', import.meta.url));
-const agent = new Agent({ home: HOME, log: () => {} });
-agent.remote = new RemotePod(cred);
-await agent.remote.warmup();
-agent.store.attach(agent.privateStorage(cred, 'state'));
-await agent.store.load();
-const gwActor = agent.store.getConfig()?.gateway?.frontActor;
-const urls = apUrls(cred.remotePod, cred.root,
-  gwActor ? { publicBase: gwActor.replace(/ap\/actor\/?$/, '') } : undefined);
-try {
-  await moveKeysToPod(agent.store, { localDir: HOME, actorId: urls.actor, log: console.log });
-} catch (e) {
-  console.error(e.message);
-  process.exit(1);
-}
-cred.keysMode = 'pod';
-writeJsonAtomic(credPath, cred);
-if (cred.privateRoot) {
-  console.log(`note: this identity's state store is ${cred.privateRoot} — devices share the key`);
-  console.log('only when the state store is a pod they can all reach (`fedipod state --to pod`).');
-}
-console.log('done — restart the agent');
-}