fedipod-server 0.29.0 → 0.30.0

package/lib/device/migrate.mjs

@@ -1,115 +0,0 @@
-// Keeping every identity on this machine at the current shape of an install.
-//
-// bbba587 fixed the DEFAULT: a new install keeps its private half — timeline,
-// contacts, blocklist, notifications, masto-tokens.json — on this machine.
-// It did nothing for the installs that already existed, and `privateRoot`
-// absent still means "on the pod" (run-agent.mjs privateUrls). So an identity
-// set up before that commit still writes every state change to a pod, and
-// still keeps its private data on a server.
-//
-// A new default only ever fixes the installs that do not exist yet. That is the
-// reason this file exists rather than a one-off script: a change to install
-// shape ships as a numbered step HERE, and `fedipod upgrade` runs the
-// pending ones over every identity under the root, not just the one you
-// happened to be in.
-
-// Bump when a step is added, and add the step to pendingSteps below.
-export const CURRENT_LAYOUT = 1;
-
-// 0 is "never stamped", which is every install made before this file existed.
-// It is not the same as "wrong": an old install may already be in the right
-// shape, and pendingSteps is what decides, per step.
-export const layoutOf = (cred) => Number(cred?.layout) || 0;
-
-// Layout 1 — the private half lives on this machine.
-//
-// Only when `privateRoot` is ABSENT. An operator who pointed it somewhere
-// deliberately, with `--private-root`, has said where they want it; a migration
-// that overrode that would be moving data on its own initiative.
-export function needsStateMove(cred) {
-  // `stateOnPod` is a move-in from a browser account (setup.mjs): the state
-  // is on the pod because that is where the account already lives.
-  return !cred?.privateRoot && !cred?.stateOnPod;
-}
-
-export function pendingSteps(cred) {
-  const steps = [];
-  if (needsStateMove(cred)) {
-    steps.push({
-      id: 'state-off-pod',
-      what: 'move the private half off the pod, onto this machine',
-      why: 'receiving a post costs pod writes, and the timeline lives on a server',
-    });
-  }
-  return steps;
-}
-
-// True when there is nothing left to do and the stamp can be written.
-export const isCurrent = (cred) => pendingSteps(cred).length === 0;
-
-// The documents on the pod that the state tree consists of — everything the
-// move copied. Deliberately NOT "everything in the container":
-//
-//   lease.json stays. It is the single-active-agent lock, and it is on the pod
-//   precisely BECAUSE the private half is not: a lease only one machine can
-//   reach coordinates nothing. run-agent builds it from urls.state, never from
-//   privateRoot, so it goes on being used after the move.
-//
-//   .keep and .acl belong to the container, which also stays — the container is
-//   what carries the owner-only ACL that lease.json sits behind.
-//
-// RemotePod.delete's deny-list is the backstop under all of this; this list is
-// what we affirmatively claim, and the two disagreeing is a bug worth hearing
-// about rather than a file quietly surviving.
-export const MOVED_STATE_DOCS = new Set([
-  'config.json', 'queue.json', 'blocklist.json', 'contacts.json', 'muted.json',
-  'pending.json', 'requests.json', 'deadletter.json', 'statuses.json',
-  'notifications.json', 'media.json', 'actors.json', 'ids.json', 'published.json',
-  'outbox.json', 'outbox-removed.json', 'outbox-own.json', 'liked.json', 'c2s-seen.json', 'parked.json', 'tagfeed.json',
-  'intake-attempts.json', 'inbox-channel.json', 'masto-tokens.json', 'masto-markers.json',
-  'lists.json', 'filters.json', 'scheduled.json', 'webpush.json',
-  'import-state.json',
-  // Present only in pod-keys mode; a state move must carry it or the moved
-  // store cannot sign.
-  'keys.json',
-]);
-
-export const KEPT_ON_POD = new Set(['lease.json', '.keep']);
-
-// What `state --drop-remote` would remove, given a container listing. Split out
-// so the decision can be tested without a pod, and so the caller can show it
-// before doing anything.
-export function classifyRemoteState(urls, base) {
-  const drop = [];
-  const keep = [];
-  for (const u of urls) {
-    const name = String(u).slice(String(base).length).replace(/^\/+/, '');
-    if (!name || name.includes('/')) { keep.push({ url: u, name, why: 'not a document of this container' }); continue; }
-    if (KEPT_ON_POD.has(name)) {
-      keep.push({ url: u, name, why: name === 'lease.json' ? 'the lease stays on the pod by design' : 'the container needs it' });
-    } else if (MOVED_STATE_DOCS.has(name)) {
-      drop.push({ url: u, name });
-    } else {
-      keep.push({ url: u, name, why: 'not one of ours' });
-    }
-  }
-  return { drop, keep };
-}
-
-// Copy the private half — every state document — from one storage to the
-// other. Copy and verify only: nothing is repointed and nothing is deleted, so
-// a failure part-way leaves the source authoritative.
-// Used by both `state --to` and the record page's Move private data.
-export async function copyPrivateHalf({ from, to, log = () => {} }) {
-  const { PodStore } = await import('../core/store.mjs');
-  const src = new PodStore({ log: () => {} });
-  src.attach(from.state);
-  await src.load();
-  const dst = new PodStore({ log });
-  dst.attach(to.state);
-  for (const [name, value] of src.cache) dst.write(name, value);
-  if (!await dst.commit()) {
-    throw new Error('some state documents did not land — nothing was repointed, nothing was deleted');
-  }
-  return { docs: src.cache.size };
-}

package/lib/device/ports.mjs

@@ -1,27 +0,0 @@
-// ports.mjs — finding a port nothing else is on.
-//
-// This lived twice, in bin/fedipod.mjs and lib/admin.mjs, and the two
-// copies had already drifted: one returned null when it ran out of ports and
-// the other threw. Both spawn agents, so which one you got decided whether a
-// full range produced an error message or a silent undefined.
-
-import net from 'node:net';
-
-// Bind to find out. Something holding a port without answering HTTP reads as
-// free to a probe that only asks for a response, and the new agent then dies on
-// EADDRINUSE with nobody watching.
-export function portFree(port) {
-  return new Promise((resolve) => {
-    const probe = net.createServer();
-    probe.once('error', () => resolve(false));
-    probe.once('listening', () => probe.close(() => resolve(true)));
-    probe.listen(port, '127.0.0.1');
-  });
-}
-
-// null when the whole span is taken. Callers that want an error say so in their
-// own words — the CLI has a person reading it, the admin API has a status code.
-export async function freePortFrom(first, span = 50) {
-  for (let p = first; p < first + span; p++) if (await portFree(p)) return p;
-  return null;
-}

package/lib/device/remote.mjs

@@ -1,54 +0,0 @@
-// remote.mjs — the Node agent's pod transport: CSS client-credentials + DPoP
-// (vendor/idp-grant.cjs, extracted from data-kitchen's "remember this IdP"
-// machinery — plain Node, no Electron).
-//
-// Everything about talking to a pod — the verbs, the ACL documents, the
-// deletion deny-list, the Retry-After cooldown, the container listing — lives
-// in lib/pod/transport.mjs, which knows nothing about Node and is shared with
-// the browser. What is left here is the one thing that genuinely differs: how
-// the session is obtained. That top-level `require` of the vendor grant is also
-// exactly why the split exists — it cannot be bundled for a service worker.
-
-import { createRequire } from 'node:module';
-import path from 'node:path';
-import { fileURLToPath } from 'node:url';
-import { PodTransport } from '../pod/transport.mjs';
-
-const require = createRequire(import.meta.url);
-const vendorDir = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../../vendor');
-const { mintCredential, discoverTokenEndpoint, createGrantSession, revokeCredentialViaAccount } =
-  require(path.join(vendorDir, 'idp-grant.cjs'));
-
-export { mintCredential, discoverTokenEndpoint, revokeCredentialViaAccount };
-
-// Re-exported so the callers that guard their own deletions — run-agent, the
-// server package's live test, the smoke suite — keep importing it from here.
-export { protectedFromDeletion } from '../pod/transport.mjs';
-
-export class RemotePod extends PodTransport {
-  constructor(credential, { log = () => {}, home = null, session = null, role = 'agent' } = {}) {
-    // An injected session replaces the credential-backed one, and everything
-    // above it — the cooldown, the deny-list, the url map — is unchanged. That
-    // is how the agent runs inside a pod server: same class, no token to mint.
-    super(session || createGrantSession(credential, home ? {
-      backoffFile: path.join(home, 'backoff.json'),
-      tokenFile: path.join(home, 'token.json'),
-    } : {}), {
-      webId: credential.webId,
-      log,
-      role,
-      runtime: 'node',
-      // Fail fast for the window rather than sleeping it out: a daemon has
-      // timers behind it, and a request that waits is a timer that does not
-      // fire. The callers' existing retry paths take it from there.
-      cooldownMode: 'refuse',
-    });
-  }
-
-  async warmup() { return this.session.warmup(); }
-
-  /** The grant's own counters, under the transport's. */
-  stats() {
-    return { ...(this.session.stats?.() || {}), ...super.stats() };
-  }
-}