fedipod-server 0.29.0 → 0.30.0

package/lib/client/masto/timelines.mjs

@@ -1,438 +0,0 @@
-// timelines.mjs — what a client reads by the page: the home and public
-// timelines, hashtags and the tag feed, lists and their timelines, the v2
-// filters, conversations, notifications, and search.
-
-import crypto from 'node:crypto';
-import * as social from '../../core/social.mjs';
-import { sanitizeHtml } from '../../core/wire.mjs';
-import { authorOf } from '../../core/intake/index.mjs';
-import { readBody } from './body.mjs';
-
-export async function handle(api, ctx) {
-  const { req, res, pathname, url, send } = ctx;   // eslint-disable-line no-unused-vars
-
-  // home + public = everything known (follows, boosts, tag feed, own);
-  // public?local=true = own posts; trends/statuses = the same activity (a
-  // single-actor instance has no firehose — what it knows IS its public
-  // face). Sorted by publish time so tag-feed backfill interleaves.
-  if (pathname === '/api/v1/timelines/home' || pathname === '/api/v1/timelines/public'
-    || pathname === '/api/v1/trends/statuses') {
-    const localOnly = pathname === '/api/v1/timelines/public' && url.searchParams.get('local') === 'true';
-    // The UNFILTERED list, both as the source and as the reply-count corpus:
-    // a reply can be a mention, and mentions are filtered out of timelines
-    // below — counting against the filtered set would undercount them.
-    const all = api.store.getStatuses();
-    const muted = new Set(api.store.getMuted().actors);
-    let items = all
-      // search ingests and strangers' mentions stay out of the timelines
-      // (mentions remain in notifications and /api/v1/statuses); direct
-      // posts belong to the conversations view, not a timeline; and the
-      // local/public view shows only what is actually public-facing.
-      .filter(s => s.kind !== 'remote' && s.kind !== 'mention')
-      .filter(s => !s.direct && s.visibility !== 'direct')
-      .filter(s => !muted.has(s.actor) && !muted.has(s.via))
-      .filter(s => !localOnly || (s.kind === 'post' && s.visibility !== 'private'))
-      .sort((a, b) => String(b.published || '').localeCompare(String(a.published || '')));
-    const { items: page, headers } = api.page(items, url);
-    return send(200, page.map(s => api.statusOrBoost(s, { all })), headers);
-  }
-
-  // --- hashtags: the client's Followed Hashtags surface drives the tag feed ---
-  // followed_tags is what the feed currently pulls; follow/unfollow add and
-  // remove a hashtag (unfollow the last and the topical feed goes quiet); the
-  // tag timeline is the mirrored notes carrying that tag.
-  if (pathname === '/api/v1/followed_tags') {
-    const tags = api.agent.tagfeed?.config().tags || [];
-    return send(200, tags.map(t => api.tagObject(t, true, req)));
-  }
-  const mTagFollow = pathname.match(/^\/api\/v1\/tags\/([^/]+)\/(follow|unfollow)$/);
-  if (mTagFollow && req.method === 'POST') {
-    const name = decodeURIComponent(mTagFollow[1]).replace(/^#/, '').toLowerCase();
-    const follow = mTagFollow[2] === 'follow';
-    const tf = api.agent.tagfeed;
-    if (tf) {
-      const cur = tf.config().tags;
-      tf.setConfig({ tags: follow ? [...new Set([...cur, name])] : cur.filter(t => t !== name) });
-    }
-    return send(200, api.tagObject(name, follow, req));
-  }
-  const mTagGet = pathname.match(/^\/api\/v1\/tags\/([^/]+)$/);
-  if (mTagGet && req.method === 'GET') {
-    const name = decodeURIComponent(mTagGet[1]).replace(/^#/, '').toLowerCase();
-    const following = (api.agent.tagfeed?.config().tags || []).includes(name);
-    return send(200, api.tagObject(name, following, req));
-  }
-  // --- trending tags: counted off the notes already mirrored ---
-  //
-  // A single-actor instance has no firehose to measure, so "trending" here can
-  // only mean what the tag feed has actually brought in — which is the honest
-  // answer, and the one that makes a client's Explore surface show something
-  // instead of an empty list. `/api/v1/trends` is Mastodon's older name for the
-  // same thing.
-  if (pathname === '/api/v1/trends/tags' || pathname === '/api/v1/trends') {
-    const DAY = 86400000;
-    const today = Math.floor(Date.now() / DAY) * DAY;
-    // tag -> day -> { uses, accounts }. Accounts are counted distinctly, which
-    // is what the number means in Mastodon: one person posting nine times is
-    // nine uses by one account, and a client shows the second number.
-    const seen = new Map();
-    for (const st of api.store.getStatuses()) {
-      if (st.kind !== 'tag' || !st.tag) continue;
-      const at = Date.parse(st.published || '');
-      if (!Number.isFinite(at) || at < today - 6 * DAY) continue;
-      const day = Math.floor(at / DAY) * DAY;
-      if (!seen.has(st.tag)) seen.set(st.tag, new Map());
-      const days = seen.get(st.tag);
-      if (!days.has(day)) days.set(day, { uses: 0, accounts: new Set() });
-      const rec = days.get(day);
-      rec.uses++;
-      if (st.actor) rec.accounts.add(st.actor);
-    }
-    const followed = new Set(api.agent.tagfeed?.config().tags || []);
-    const ranked = [...seen.entries()].map(([name, days]) => {
-      // Seven entries, newest first, gaps filled with zeroes — a client draws
-      // the sparkline straight off this and a short array draws a short line.
-      const history = [];
-      for (let i = 0; i < 7; i++) {
-        const rec = days.get(today - i * DAY);
-        history.push({ day: String(Math.floor((today - i * DAY) / 1000)),
-          uses: String(rec ? rec.uses : 0), accounts: String(rec ? rec.accounts.size : 0) });
-      }
-      return { total: history.reduce((n, h) => n + Number(h.uses), 0),
-        tag: api.tagObject(name, followed.has(name), req, history) };
-    }).sort((a, b) => b.total - a.total);
-    const limit = Math.min(Math.max(Number(url.searchParams.get('limit')) || 10, 1), 40);
-    return send(200, ranked.slice(0, limit).map(x => x.tag));
-  }
-
-  const mTagTl = pathname.match(/^\/api\/v1\/timelines\/tag\/([^/]+)$/);
-  if (mTagTl && req.method === 'GET') {
-    const name = decodeURIComponent(mTagTl[1]).replace(/^#/, '').toLowerCase();
-    const all = api.store.getStatuses();
-    const items = all.filter(s => s.kind === 'tag' && s.tag === name)
-      .sort((a, b) => String(b.published || '').localeCompare(String(a.published || '')));
-    const { items: page, headers } = api.page(items, url);
-    return send(200, page.map(s => api.statusOrBoost(s, { all })), headers);
-  }
-
-  // Lists, filters and scheduled posts are the client's own arrangements —
-  // kept in local state, nothing federates.
-  const listJson = (l) => ({ id: l.id, title: l.title, replies_policy: l.repliesPolicy || 'list', exclusive: false });
-  if (pathname === '/api/v1/lists' && req.method === 'GET') {
-    return send(200, api.store.getLists().map(listJson));
-  }
-  if (pathname === '/api/v1/lists' && req.method === 'POST') {
-    const body = await readBody(req);
-    const title = String(body.title || '').trim();
-    if (!title) return send(422, { error: 'a title is required' });
-    const lists = api.store.getLists();
-    const l = { id: crypto.randomBytes(8).toString('hex'), title, repliesPolicy: body.replies_policy || 'list', members: [] };
-    lists.push(l);
-    api.store.setLists(lists);
-    return send(200, listJson(l));
-  }
-  const mList = /^\/api\/v1\/lists\/([a-f0-9]+)$/.exec(pathname);
-  if (mList) {
-    const lists = api.store.getLists();
-    const l = lists.find(x => x.id === mList[1]);
-    if (!l) return send(404, { error: 'Record not found' });
-    if (req.method === 'DELETE') {
-      api.store.setLists(lists.filter(x => x.id !== mList[1]));
-      return send(200, {});
-    }
-    if (req.method === 'PUT') {
-      const body = await readBody(req);
-      if (body.title) l.title = String(body.title);
-      if (body.replies_policy) l.repliesPolicy = body.replies_policy;
-      api.store.setLists(lists);
-    }
-    return send(200, listJson(l));
-  }
-  const mListAcc = /^\/api\/v1\/lists\/([a-f0-9]+)\/accounts$/.exec(pathname);
-  if (mListAcc) {
-    const lists = api.store.getLists();
-    const l = lists.find(x => x.id === mListAcc[1]);
-    if (!l) return send(404, { error: 'Record not found' });
-    if (req.method === 'GET') return send(200, (l.members || []).map(a => api.account(a)));
-    const body = await readBody(req).catch(() => ({}));
-    const ids = [].concat(body.account_ids || body['account_ids[]'] || url.searchParams.getAll('account_ids[]')).filter(Boolean);
-    const actors = ids.map(id => api.store.urlFor(id)).filter(Boolean);
-    if (req.method === 'POST') l.members = [...new Set([...(l.members || []), ...actors])];
-    if (req.method === 'DELETE') l.members = (l.members || []).filter(a => !actors.includes(a));
-    api.store.setLists(lists);
-    return send(200, {});
-  }
-  const mListTl = /^\/api\/v1\/timelines\/list\/([a-f0-9]+)$/.exec(pathname);
-  if (mListTl) {
-    const l = api.store.getLists().find(x => x.id === mListTl[1]);
-    if (!l) return send(404, { error: 'Record not found' });
-    const members = new Set(l.members || []);
-    const all = api.store.getStatuses();
-    const items = all.filter(s => members.has(s.actor) || members.has(s.via))
-      .sort((a, b) => String(b.published || '').localeCompare(String(a.published || '')));
-    const { items: page, headers } = api.page(items, url);
-    return send(200, page.map(s => api.statusOrBoost(s, { all })), headers);
-  }
-
-  // v2 filters: stored, served, and APPLIED — every status carries what it
-  // matched in `filtered` (see filtersFor), because no client matches
-  // keywords for itself.
-  const filterJson = (f) => ({
-    id: f.id, title: f.title, context: f.context || ['home'],
-    expires_at: f.expiresAt || null, filter_action: f.action || 'warn',
-    keywords: (f.keywords || []).map((k, i) => ({ id: `${f.id}-${i}`, keyword: k.keyword, whole_word: !!k.wholeWord })),
-    statuses: [],
-  });
-  const keywordsOf = (attrs) => [].concat(attrs || [])
-    .filter(k => k?.keyword && !(k._destroy === true || k._destroy === 'true'))
-    .map(k => ({ keyword: String(k.keyword), wholeWord: k.whole_word === true || k.whole_word === 'true' }));
-  if (pathname === '/api/v2/filters' && req.method === 'GET') {
-    return send(200, api.store.getFilters().map(filterJson));
-  }
-  if (pathname === '/api/v2/filters' && req.method === 'POST') {
-    const body = await readBody(req);
-    const title = String(body.title || '').trim();
-    if (!title) return send(422, { error: 'a title is required' });
-    const filters = api.store.getFilters();
-    const f = {
-      id: crypto.randomBytes(8).toString('hex'), title,
-      context: [].concat(body.context || ['home']),
-      action: body.filter_action || 'warn', expiresAt: null,
-      keywords: keywordsOf(body.keywords_attributes),
-    };
-    filters.push(f);
-    api.store.setFilters(filters);
-    return send(200, filterJson(f));
-  }
-  const mFilter = /^\/api\/v2\/filters\/([a-f0-9]+)$/.exec(pathname);
-  if (mFilter) {
-    const filters = api.store.getFilters();
-    const f = filters.find(x => x.id === mFilter[1]);
-    if (!f) return send(404, { error: 'Record not found' });
-    if (req.method === 'DELETE') {
-      api.store.setFilters(filters.filter(x => x.id !== mFilter[1]));
-      return send(200, {});
-    }
-    if (req.method === 'PUT') {
-      const body = await readBody(req);
-      if (body.title) f.title = String(body.title);
-      if (body.context) f.context = [].concat(body.context);
-      if (body.filter_action) f.action = body.filter_action;
-      if (body.keywords_attributes) f.keywords = keywordsOf(body.keywords_attributes);
-      api.store.setFilters(filters);
-    }
-    return send(200, filterJson(f));
-  }
-
-  // Conversations: direct posts, grouped by who is in them.
-  if (pathname === '/api/v1/conversations' && req.method === 'GET') {
-    const all = api.store.getStatuses();
-    const me = api.urls.actor;
-    const convos = new Map();
-    for (const s of all) {
-      if (!(s.direct || s.visibility === 'direct')) continue;
-      const others = [...new Set([
-        ...(s.actor !== me ? [s.actor] : []),
-        ...((s.mentions || []).map(m => m.href).filter(a => a && a !== me)),
-      ])];
-      const key = others.sort().join(' ') || me;
-      const c = convos.get(key) || { accounts: new Set(), last: s };
-      for (const o of others) c.accounts.add(o);
-      if (String(s.published || '') > String(c.last.published || '')) c.last = s;
-      convos.set(key, c);
-    }
-    const items = [...convos.entries()]
-      .sort((a, b) => String(b[1].last.published || '').localeCompare(String(a[1].last.published || '')));
-    return send(200, items.map(([key, c]) => ({
-      id: api.store.idFor('conversation:' + key),
-      unread: false,
-      accounts: [...(c.accounts.size ? c.accounts : [me])].map(a => api.account(a)),
-      last_status: api.status(c.last, { all }),
-    })));
-  }
-
-  // The direct timeline: every direct post, newest first, paged like the rest.
-  if (pathname === '/api/v1/timelines/direct' && req.method === 'GET') {
-    const all = api.store.getStatuses();
-    const items = all.filter(s => s.direct || s.visibility === 'direct');
-    const { items: page, headers } = api.page(items, url);
-    return send(200, page.map(s => api.status(s, { all })), headers);
-  }
-
-  // One notification by id — what a push notification tap opens — and the
-  // two ways of being rid of them.
-  if (pathname === '/api/v1/notifications/clear' && req.method === 'POST') {
-    api.store.removeNotifications(() => true);
-    return send(200, {});
-  }
-  const mNotif = /^\/api\/v1\/notifications\/([A-Za-z0-9_-]+)(\/dismiss)?$/.exec(pathname);
-  if (mNotif) {
-    const n = api.store.getNotifications().find(x => x.id === mNotif[1]);
-    if (!n) return send(404, { error: 'Record not found' });
-    if (mNotif[2] && req.method === 'POST') { api.store.removeNotifications(x => x.id === n.id); return send(200, {}); }
-    if (!mNotif[2] && req.method === 'GET') return send(200, api.notification(n));
-  }
-
-  // Grouped notifications, the shape a client reads from API version 2 on.
-  // One group per notification: the client does its own gathering of
-  // favourites and boosts on a post, and every field it joins on — the
-  // account and status ids — is here.
-  const mGroup = /^\/api\/v2\/notifications\/([A-Za-z0-9_-]+)(\/accounts|\/dismiss)?$/.exec(pathname);
-  if (mGroup) {
-    const n = api.store.getNotifications().find(x => x.id === mGroup[1]);
-    if (!n) return send(404, { error: 'Record not found' });
-    if (mGroup[2] === '/dismiss' && req.method === 'POST') { api.store.removeNotifications(x => x.id === n.id); return send(200, {}); }
-    if (mGroup[2] === '/accounts' && req.method === 'GET') return send(200, [api.account(n.actor)]);
-    if (!mGroup[2] && req.method === 'GET') return send(200, groupedNotifications(api, [n]));
-  }
-  if (pathname === '/api/v2/notifications') {
-    const { page, headers } = notificationPage(api, ctx);
-    return send(200, groupedNotifications(api, page), headers);
-  }
-
-  if (pathname === '/api/v1/notifications') {
-    const { page, headers } = notificationPage(api, ctx);
-    return send(200, page.map((n) => api.notification(n)), headers);
-  }
-
-  // Search: @user@host → webfinger resolve; URL → actor or note ingest;
-  // plain text → local mirror + actor-cache scan.
-  if (pathname === '/api/v2/search' || pathname === '/api/v1/search') {
-    return searchHandler(api, ctx);
-  }
-  return false;
-}
-
-function groupedNotifications(api, page) {
-  const accounts = new Map();
-  const statuses = new Map();
-  const groups = page.map((n) => {
-    const acct = api.account(n.actor);
-    accounts.set(acct.id, acct);
-    const s = n.noteId && api.store.getStatuses().find(x => x.noteId === n.noteId);
-    let statusId = null;
-    if (s) { const j = api.status(s); statuses.set(j.id, j); statusId = j.id; }
-    return {
-      group_key: n.id, notifications_count: 1, type: api.notificationType(n.type),
-      most_recent_notification_id: n.id, page_min_id: n.id, page_max_id: n.id,
-      latest_page_notification_at: n.at, sample_account_ids: [acct.id],
-      ...(statusId ? { status_id: statusId } : {}),
-      ...(n.type === 'reaction' ? { emoji: n.emoji, ...(n.url ? { emoji_url: n.url } : {}) } : {}),
-    };
-  });
-  return { accounts: [...accounts.values()], statuses: [...statuses.values()], notification_groups: groups };
-}
-
-// The slice of notifications a request asks for, and the Link header that
-// pages it. Shared by the flat list and the grouped one.
-function notificationPage(api, ctx) {
-  const { req, pathname, url } = ctx;
-  {
-    const limit = Math.min(Number(url.searchParams.get('limit')) || 30, 60);
-    const q = url.searchParams;
-    // Newest first, which is what every id rule below assumes.
-    let items = api.store.getNotifications();
-
-    // Which KINDS. A client that asks for mentions and is handed favourites
-    // and boosts renders them as mentions — Phanpy's Mentions column did
-    // exactly that, and re-pilled on every poll. Both spellings: clients send
-    // `types[]=mention` and some send bare `types=mention`.
-    const listParam = (name) => {
-      const all = [...q.getAll(`${name}[]`), ...q.getAll(name)]
-        .flatMap((v) => String(v).split(',')).map((v) => v.trim()).filter(Boolean);
-      return all.length ? new Set(all) : null;
-    };
-    const want = listParam('types');
-    const skip = listParam('exclude_types');
-    // Mastodon spells the type with an underscore; ours is stored with a
-    // hyphen, and notification() translates on the way out — so match on what
-    // the client would have been given, not on what is on disk.
-    const shown = (n) => api.notificationType(n.type);
-    if (want) items = items.filter((n) => want.has(shown(n)));
-    if (skip) items = items.filter((n) => !skip.has(shown(n)));
-
-    // Which SLICE. `max_id` walks backwards into history; `since_id` and
-    // `min_id` both mean "newer than this", which is how a client asks
-    // "anything since I last looked?". Ignoring them meant every poll
-    // returned the whole list, so the client always saw unread items and the
-    // bell never went out.
-    const cut = (id, keepNewer) => {
-      const i = items.findIndex((n) => n.id === id);
-      if (i < 0) return;
-      items = keepNewer ? items.slice(0, i) : items.slice(i + 1);
-    };
-    const maxId = q.get('max_id');
-    if (maxId) cut(maxId, false);
-    const sinceId = q.get('since_id') || q.get('min_id');
-    if (sinceId) cut(sinceId, true);
-    // min_id asks for the ones IMMEDIATELY newer, i.e. the oldest end of
-    // what is newer; since_id asks for the newest. Only the window differs.
-    const page = q.get('min_id') && !q.get('since_id')
-      ? items.slice(Math.max(0, items.length - limit))
-      : items.slice(0, limit);
-
-    // A client pages by following these rather than by guessing ids.
-    if (page.length) {
-      const base = `${api.scheme || (req.socket?.encrypted ? 'https' : 'http')}://${req.headers.host}${api.mount || ''}${pathname}`;
-      const link = (params) => {
-        const u = new URL(base);
-        for (const [k, v] of q) if (k !== 'max_id' && k !== 'since_id' && k !== 'min_id') u.searchParams.append(k, v);
-        for (const [k, v] of Object.entries(params)) u.searchParams.set(k, v);
-        return u.href;
-      };
-      return { page, headers: {
-        link: `<${link({ max_id: page[page.length - 1].id })}>; rel="next", `
-          + `<${link({ min_id: page[0].id })}>; rel="prev"`,
-      } };
-    }
-    return { page: [], headers: undefined };
-  }
-}
-
-// Search: @user@host → webfinger resolve; URL → actor or note ingest;
-// plain text → local mirror + actor-cache scan.
-async function searchHandler(api, ctx) {
-  const { req, res, pathname, url, send } = ctx;   // eslint-disable-line no-unused-vars
-  {
-    const q = String(url.searchParams.get('q') || '').trim();
-    const type = url.searchParams.get('type');
-    const out = { accounts: [], statuses: [], hashtags: [] };
-    const asHandle = /^@?[^@\s]+@[^@\s.]+\.[^@\s]+$/.test(q);
-    if (asHandle && type !== 'statuses') {
-      try {
-        const doc = await social.resolveHandle(api.agent, q);
-        out.accounts.push(api.account(doc.id));
-      } catch (e) { api.log(`search resolve ${q}: ${e.message}`); }
-    } else if (/^https?:\/\//.test(q)) {
-      const doc = await api.agent.intake.fetchAP(q).catch(() => null);
-      if (doc?.type === 'Person' && doc.id) out.accounts.push(api.account(doc.id));
-      else if (doc?.type === 'Note' && doc.id) {
-        let s = api.store.getStatuses().find(x => x.noteId === doc.id);
-        // Third site of the same rule: the note's own origin has to vouch for
-        // the author before we store one. The owner chose the URL, but the
-        // document at it still names whoever it likes.
-        const author = authorOf(doc);
-        if (!s && author) {
-          s = {
-            noteId: doc.id, actor: author, content: sanitizeHtml(doc.content),
-            published: doc.published, inReplyTo: doc.inReplyTo, kind: 'remote',
-          };
-          api.store.addStatus(s);
-        }
-        if (s) out.statuses.push(api.status(s));
-      }
-    } else if (q) {
-      const needle = q.toLowerCase();
-      if (type !== 'accounts') {
-        const all = api.store.getStatuses();
-        out.statuses = all
-          .filter(s => (s.content || '').toLowerCase().includes(needle)).slice(0, 20)
-          .map(s => api.status(s, { all }));
-      }
-      if (type !== 'statuses') out.accounts = await api.accountSearch(q);
-    }
-    return send(200, out);
-  }
-
-  return false;
-}

package/lib/client/oidc-auth.mjs

@@ -1,62 +0,0 @@
-// oidc-auth.mjs — who may drive the C2S surface. Two proofs are accepted:
-// the Mastodon facade's bearer (minted on this machine, so its holder is the
-// operator by construction), or a Solid-OIDC token with its DPoP proof,
-// which Solid-OIDC requires, verified by the same library the wider
-// Solid world uses. The token alone is not enough: the WebID it names must
-// be THIS identity's owner, an authorization step the token does not carry.
-//
-// The verifier is injected so offline tests stub it, and wrapped so the
-// library (CJS, older jose) can be replaced without touching any caller.
-
-export function makeC2sAuth({ agent, masto = null, verifier = null, log = () => {}, scheme = null, mount = '' }) {
-  let verify = verifier;
-  const loadVerifier = async () => {
-    if (!verify) {
-      const { createSolidTokenVerifier } = await import('@solid/access-token-verifier');
-      verify = createSolidTokenVerifier();
-    }
-    return verify;
-  };
-
-  return async function authenticate(req, pathname) {
-    if (masto?.authed(req)) {
-      return { ok: true, webid: agent.remote?.webId || null, via: 'bearer' };
-    }
-    if (!req.headers.authorization) {
-      return { ok: false, status: 401, error: 'authentication required: a Solid-OIDC token (DPoP) or this agent\'s own bearer' };
-    }
-    // Solid-OIDC binds the token to a key and has the client prove it holds
-    // that key on every request. A token shown without its proof is a token
-    // anyone who saw it could show.
-    if (!req.headers.dpop) {
-      return { ok: false, status: 401, error: 'a Solid-OIDC token must come with its DPoP proof',
-        headers: { 'www-authenticate': 'DPoP' } };
-    }
-    let webid;
-    try {
-      const v = await loadVerifier();
-      // The URL the client signed its proof over. The Host header already
-      // passed the Authorities firewall, so whichever alias the client used
-      // (localhost, 127.0.0.1, the named origin) is one this agent answers on;
-      // the scheme is whichever listener the request arrived on. `pathname` is
-      // relative to this identity's mount, so a suffix pod folds the mount back
-      // in — the client signed over the full path it actually requested.
-      const htu = `${scheme ? scheme.replace(/:$/u, '') : req.socket?.encrypted ? 'https' : 'http'
-      }://${req.headers.host}${mount}${pathname}`;
-      ({ webid } = await v(
-        req.headers.authorization,
-        { header: req.headers.dpop, method: req.method, url: htu },
-      ));
-    } catch (e) {
-      log(`c2s auth: token rejected — ${e.message}`);
-      return { ok: false, status: 401, error: `token rejected: ${e.message}` };
-    }
-    const owner = agent.remote?.webId;
-    if (!owner || webid !== owner) {
-      // Verified is not authorized: a valid token from ANY WebID must not
-      // post as this actor. (The gap jg10's outbox leaves open.)
-      return { ok: false, status: 403, error: 'authenticated, but this outbox belongs to its owner alone' };
-    }
-    return { ok: true, webid, via: 'oidc' };
-  };
-}

package/lib/client/streaming.mjs

@@ -1,154 +0,0 @@
-// streaming.mjs — the Mastodon streaming API over a hand-rolled WebSocket
-// server (send-mostly; we answer pings and ignore everything else a client
-// frames at us). No dependencies — the handshake is one SHA-1 and text
-// frames are trivial to emit. Clients connect to
-//   ws://host/api/v1/streaming?access_token=…&stream=user
-// and receive {stream, event, payload} messages for new statuses and
-// notifications the moment the agent learns of them.
-
-import crypto from 'node:crypto';
-
-const WS_MAGIC = '258EAFA5-E914-47DA-95CA-C5AB0DC85B11';
-
-// One identity's live feed is a handful of that owner's clients, so these are
-// generous. Without them a single token could hold every file descriptor open,
-// and one client that stops reading would grow its write buffer forever.
-const MAX_SOCKETS = 20;                       // matches the client-token cap
-const MAX_BUFFERED_BYTES = 1024 * 1024;       // a consumer this far behind is gone
-
-import { checkRequest } from '../shared/guard.mjs';
-
-export class Streaming {
-  constructor({ masto, log = console.log, allowed = null, gate = null, gateOptional = false }) {
-    this.masto = masto;
-    this.log = log;
-    this.allowed = allowed;
-    this.gate = gate;
-    // A pod-hosted identity is a public instance: a phone app arrives with its
-    // bearer and no way to send the operator's header, so there the bearer is
-    // the credential. Locally the gate stands in front of the socket as well.
-    this.gateOptional = gateOptional;
-    this.sockets = new Set();      // entries: { send(string), close() }
-  }
-
-  // Whether a client may open the live feed, asked of the upgrade request
-  // alone. Shared with the pod-server front, which completes the handshake
-  // before any of this runs and so must answer by closing rather than refusing.
-  authorizeUpgrade(req, url) {
-    const proto = String(req.headers['sec-websocket-protocol'] || '').split(',')[0].trim();
-    const token = url.searchParams.get('access_token') || proto;
-    const hasToken = this.masto.tokens().includes(token);
-    // WebSockets are exempt from CORS. A live bearer is the credential — a
-    // web client on its own origin connects the way it does to any Mastodon
-    // server — so with one, only the Host check stands (it is what stops DNS
-    // rebinding); without one the full Host/Origin firewall applies.
-    const bad = this.allowed ? checkRequest(req, this.allowed, { ignoreOrigin: hasToken }) : null;
-    if (bad) return `streaming refused: ${bad}`;
-    // A gate token covers every other route; an upgrade that skipped it was a
-    // hole in a control the operator had switched on. A client bearer is the
-    // other way in — a phone app has no way to send the operator's header.
-    if (this.gate && !this.gate.upgradeOk(req) && !(this.gateOptional && hasToken)) {
-      return 'streaming refused: no gate token';
-    }
-    if (!hasToken) return 'streaming refused: not a live client token';
-    if (this.sockets.size >= MAX_SOCKETS) return 'streaming refused: too many live connections';
-    return null;
-  }
-
-  // Adopt a WebSocket somebody else finished the handshake for — the pod
-  // server owns the socket, and hands over an object that already frames.
-  adopt(ws) {
-    const entry = {
-      send: (str) => {
-        // A consumer that stops reading must not keep costing memory.
-        if ((ws.bufferedAmount ?? 0) > MAX_BUFFERED_BYTES) {
-          this.sockets.delete(entry);
-          try { ws.close(); } catch { /* already gone */ }
-          return;
-        }
-        ws.send(str);
-      },
-      close: () => ws.close(),
-    };
-    this.sockets.add(entry);
-    const drop = () => this.sockets.delete(entry);
-    ws.on('close', drop);
-    ws.on('error', drop);
-    return entry;
-  }
-
-  // Let go of every client: the server is stopping, not the connection failing.
-  stop() {
-    for (const s of this.sockets) { try { s.close(); } catch { /* already gone */ } }
-    this.sockets.clear();
-  }
-
-  // Attach the upgrade handler to an http.Server.
-  attach(server) {
-    server.on('upgrade', (req, socket) => {
-      const url = new URL(req.url, 'http://localhost');
-      if (!url.pathname.startsWith('/api/v1/streaming')) { socket.destroy(); return; }
-      // WebSockets are exempt from CORS, so the Host/Origin firewall is the
-      // only thing standing between a visited page and the live feed.
-      const refusal = this.authorizeUpgrade(req, url);
-      if (refusal) {
-        this.log(refusal);
-        socket.write(refusal.includes('refused:') && !refusal.includes('token')
-          ? 'HTTP/1.1 403 Forbidden\r\n\r\n'
-          : 'HTTP/1.1 401 Unauthorized\r\n\r\n');
-        socket.destroy();
-        return;
-      }
-      const proto = String(req.headers['sec-websocket-protocol'] || '').split(',')[0].trim();
-      const accept = crypto.createHash('sha1')
-        .update(req.headers['sec-websocket-key'] + WS_MAGIC).digest('base64');
-      socket.write('HTTP/1.1 101 Switching Protocols\r\nUpgrade: websocket\r\nConnection: Upgrade\r\n'
-        + `Sec-WebSocket-Accept: ${accept}\r\n`
-        + (proto ? `Sec-WebSocket-Protocol: ${proto}\r\n` : '') + '\r\n');
-      socket.setNoDelay(true);
-      const entry = {
-        send: (str) => {
-          // A consumer that stops reading must not keep costing memory.
-          if (socket.writableLength > MAX_BUFFERED_BYTES) {
-            this.sockets.delete(entry);
-            try { socket.destroy(); } catch { /* already gone */ }
-            return;
-          }
-          socket.write(this.frame(str));
-        },
-        close: () => { try { socket.end(); } catch { /* already gone */ } },
-      };
-      this.sockets.add(entry);
-      const drop = () => this.sockets.delete(entry);
-      socket.on('close', drop);
-      socket.on('error', drop);
-      socket.on('data', (buf) => {
-        if (buf.length && (buf[0] & 0x0f) === 0x9) {          // ping → pong
-          try { socket.write(Buffer.from([0x8a, 0x00])); } catch { drop(); }
-        }
-        if (buf.length && (buf[0] & 0x0f) === 0x8) { drop(); try { socket.end(); } catch {} }  // close
-      });
-    });
-  }
-
-  // Server→client unmasked text frame.
-  frame(str) {
-    const payload = Buffer.from(str);
-    let header;
-    if (payload.length < 126) header = Buffer.from([0x81, payload.length]);
-    else if (payload.length < 65536) {
-      header = Buffer.alloc(4); header[0] = 0x81; header[1] = 126; header.writeUInt16BE(payload.length, 2);
-    } else {
-      header = Buffer.alloc(10); header[0] = 0x81; header[1] = 127; header.writeBigUInt64BE(BigInt(payload.length), 2);
-    }
-    return Buffer.concat([header, payload]);
-  }
-
-  broadcast(event, payloadObj, streams = ['user']) {
-    if (!this.sockets.size) return;
-    const message = JSON.stringify({ stream: streams, event, payload: JSON.stringify(payloadObj) });
-    for (const s of this.sockets) {
-      try { s.send(message); } catch { this.sockets.delete(s); }
-    }
-  }
-}