fedipod-server 0.28.1 → 0.30.0

package/lib/device/update.mjs

@@ -1,96 +0,0 @@
-// update.mjs — is a newer FediPod published, and the update itself.
-//
-// "Latest" is the version field of package.json on the repo's main branch —
-// the same file a clone reads to know what it is running. The check is one
-// GET of that file; nothing else leaves the machine, and AP_UPDATE_CHECK=0
-// turns it off. The update is what re-running the installer does: fast-forward
-// the checkout, reinstall dependencies, restart the agents.
-
-import fs from 'node:fs';
-import path from 'node:path';
-import { execFileSync, spawn } from 'node:child_process';
-import { fileURLToPath } from 'node:url';
-
-export const LATEST_URL = 'https://raw.githubusercontent.com/jeff-zucker/FediPod/main/package.json';
-
-export const repoRoot = () => path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../..');
-
-export const localVersion = (root = repoRoot()) => {
-  try { return JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8')).version || null; }
-  catch { return null; }
-};
-
-// a newer than b, for dotted numeric versions.
-export const newerThan = (a, b) => {
-  const pa = String(a).split('.').map(Number);
-  const pb = String(b).split('.').map(Number);
-  for (let i = 0; i < Math.max(pa.length, pb.length); i++) {
-    const d = (pa[i] || 0) - (pb[i] || 0);
-    if (d) return d > 0;
-  }
-  return false;
-};
-
-export async function checkLatest({ current = localVersion(), fetchImpl = fetch } = {}) {
-  if (process.env.AP_UPDATE_CHECK === '0') return null;
-  try {
-    const res = await fetchImpl(LATEST_URL, { signal: AbortSignal.timeout(10_000) });
-    if (!res.ok) return null;
-    const latest = (await res.json()).version || null;
-    if (!latest || !current) return null;
-    return { current, latest, available: newerThan(latest, current), checkedAt: new Date().toISOString() };
-  } catch { return null; }
-}
-
-// The npm half, injectable — a test asking what runUpdate DOES must never be
-// able to install software on the machine running it.
-const npmInstallLatest = () =>
-  execFileSync('npm', ['install', '-g', 'fedipod@latest'], { stdio: 'pipe' });
-
-// Fast-forward only: a checkout with local changes is somebody's work, and an
-// update must refuse rather than eat it.
-export function runUpdate({ root = repoRoot(), log = () => {}, install = npmInstallLatest } = {}) {
-  // The ordinary install comes from npm, where updating is npm's job and the
-  // files under us are not ours to move. A checkout is somebody working on it,
-  // and gets the fast-forward below.
-  if (!fs.existsSync(path.join(root, '.git'))) {
-    try {
-      log('updating from npm…');
-      install();
-      return { ok: true, note: 'updated from npm — restart the agent to serve it' };
-    } catch (e) {
-      return { ok: false,
-        note: `npm install -g fedipod@latest failed: ${String(e.stderr || e.message).slice(0, 300).trim()}` };
-    }
-  }
-  try {
-    execFileSync('git', ['-C', root, 'pull', '--ff-only'], { stdio: 'pipe' });
-  } catch (e) {
-    return { ok: false, note: `git pull refused: ${String(e.stderr || e.message).slice(0, 300).trim()}` };
-  }
-  try {
-    execFileSync('npm', ['install', '--omit=dev', '--no-audit', '--no-fund'], { cwd: root, stdio: 'pipe' });
-  } catch (e) {
-    return { ok: false, note: `npm install failed: ${String(e.stderr || e.message).slice(0, 300).trim()}` };
-  }
-  const version = localVersion(root);
-  log(`updated the checkout to ${version}`);
-  return { ok: true, note: `updated to ${version}`, version };
-}
-
-// New code runs only after a restart. Where systemd units exist they are all
-// restarted by name; otherwise the caller re-execs its own process.
-export function restartAgents({ log = () => {} } = {}) {
-  try {
-    const list = execFileSync('systemctl',
-      ['--user', 'list-units', '--plain', '--no-legend', 'fedipod-*'], { stdio: 'pipe' })
-      .toString().trim();
-    if (list) {
-      const child = spawn('systemctl', ['--user', 'restart', 'fedipod-*'], { detached: true, stdio: 'ignore' });
-      child.unref();
-      log('restarting the fedipod units');
-      return 'units';
-    }
-  } catch { /* no systemd here */ }
-  return 'self';
-}

package/lib/gateway/caches.mjs

@@ -1,36 +0,0 @@
-// caches.mjs — what one warm gateway process keeps between requests: the
-// pod-token verifier, and the public keys of the servers that deliver here.
-// Built per request, each costs round trips to somebody else's server for
-// every call; built once, a process pays them once.
-
-// The Solid-OIDC verifier remembers the issuers' key sets it has seen. A
-// fresh one per call re-read the caller's WebID document, the issuer's
-// discovery document and its keys on every signed-in call.
-let verifier = null;
-export async function podTokenVerifier() {
-  if (!verifier) verifier = (await import('@solid/access-token-verifier')).createSolidTokenVerifier();
-  return verifier;
-}
-
-// The keys deliveries are signed with, by key id, in the shape Fedify's
-// verifier asks for. A key is held an hour; a key that could not be fetched
-// is held five minutes, so a server that was down is asked again soon.
-// Fedify re-fetches on its own when a held key no longer verifies, so a
-// rotated key costs one failed check, not an hour of refused mail.
-const KEY_TTL_MS = 60 * 60_000;
-const MISS_TTL_MS = 5 * 60_000;
-const KEY_CACHE_MAX = 500;
-const keys = new Map();   // key id → { key, until }
-export const senderKeys = {
-  async get(keyId) {
-    const hit = keys.get(keyId.href);
-    if (!hit) return undefined;
-    if (hit.until < Date.now()) { keys.delete(keyId.href); return undefined; }
-    return hit.key;
-  },
-  async set(keyId, key) {
-    if (keys.size >= KEY_CACHE_MAX) keys.delete(keys.keys().next().value);
-    keys.set(keyId.href, { key, until: Date.now() + (key ? KEY_TTL_MS : MISS_TTL_MS) });
-  },
-  size: () => keys.size,
-};

package/lib/gateway/directory.mjs

@@ -1,90 +0,0 @@
-// directory.mjs — the well-known door. Whichever running agent holds port
-// 8030 answers there with a redirect to its own record page, so opening
-// https://localhost:8030/ always reaches a page that lists every identity on
-// this machine, whatever ports they actually run on. Loopback only, https
-// only — like every listener this project starts. Held only by a CONFIGURED agent: an
-// unconfigured one's record page is a setup form with no identity list,
-// which strands whoever the door sends there.
-//
-// The door is held politely: it identifies itself at GET /__directory, and a
-// real owner of the port — an identity that recorded 8030 as its own — asks it
-// to step aside with POST /__directory/yield before binding. The holder frees
-// the port at once and stays off it for a minute. AP_DIRECTORY=0 disables the
-// whole mechanism (the test suite sets it, so throwaway agents do not fight
-// over a real machine's door).
-import https from 'node:https';
-import { localFetch } from '../client/localapi.mjs';
-
-export const DIRECTORY_PORT = 8030;
-
-// Answer for a running agent. No-op when this agent already IS the door, or
-// when the mechanism is switched off. `eligible` is asked before every claim
-// attempt — the 15 s retry means an agent that configures later takes the
-// door soon after, and one that never does never holds it.
-export function claimDirectory({ port, origin, log = () => {}, eligible = () => true, tls = null }) {
-  if (process.env.AP_DIRECTORY === '0' || port === DIRECTORY_PORT) {
-    return { stop: () => {} };
-  }
-  const servers = [];
-  let held = false;
-  let pausedUntil = 0;
-  const handler = (req, res) => {
-    const p = req.url || '/';
-    if (p === '/__directory') {
-      res.writeHead(200, { 'content-type': 'application/json' });
-      res.end(JSON.stringify({ directory: true, agent: origin() }) + '\n');
-      return;
-    }
-    if (req.method === 'POST' && p === '/__directory/yield') {
-      pausedUntil = Date.now() + 60_000;
-      res.writeHead(200, { 'content-type': 'application/json' });
-      res.end('{"ok":true}\n');
-      release();
-      log(`directory: yielded port ${DIRECTORY_PORT}`);
-      return;
-    }
-    res.writeHead(302, { location: origin().replace(/\/$/, '') + p });
-    res.end();
-  };
-  const release = () => {
-    for (const s of servers.splice(0)) { try { s.close(); } catch { /* already down */ } }
-    held = false;
-  };
-  const tryClaim = () => {
-    if (held || !eligible() || Date.now() < pausedUntil) return;
-    // Loopback both ways, like the agent's own listener: "localhost" resolves
-    // to ::1 first on many systems. IPv4 is the one that decides `held`.
-    if (!tls) return;   // no certificate, no door: this project serves https only
-    const tlsOpts = { key: tls.key, cert: tls.cert };
-    const s4 = https.createServer(tlsOpts, handler);
-    s4.on('error', () => { /* someone else holds the door — retry later */ });
-    s4.listen(DIRECTORY_PORT, '127.0.0.1', () => {
-      held = true;
-      servers.push(s4);
-      const s6 = https.createServer(tlsOpts, handler);
-      s6.on('error', () => { /* no IPv6 loopback here — IPv4 covers it */ });
-      s6.listen(DIRECTORY_PORT, '::1', () => servers.push(s6));
-      log(`directory: https://localhost:${DIRECTORY_PORT}/ now reaches ${origin()}`);
-    });
-  };
-  tryClaim();
-  const timer = setInterval(tryClaim, 15_000);
-  timer.unref();
-  return { stop: () => { clearInterval(timer); release(); } };
-}
-
-// Free `port` if what holds it is the directory door. Returns true when the
-// port is free afterwards. Quick and quiet on every other kind of holder.
-export async function yieldDirectory(port, { portFree, home = null } = {}) {
-  const probe = await localFetch(home, port, '/__directory', { timeout: 1000 })
-    .then(r => (r.ok ? r.json() : null)).catch(() => null);
-  if (!probe?.directory) return false;
-  await localFetch(home, port, '/__directory/yield', { method: 'POST', timeout: 1000 })
-    .catch(() => {});
-  if (!portFree) return true;
-  for (let i = 0; i < 10; i++) {
-    if (await portFree(port)) return true;
-    await new Promise(r => setTimeout(r, 100));
-  }
-  return false;
-}