fedipod-server 0.29.0 → 0.30.0

package/lib/pod/policy.mjs

@@ -1,58 +0,0 @@
-// policy.mjs — ap/gateway-policy.json: what the pod's owner has published
-// about which mail they want.
-//
-// The point of the document is that a service filtering on someone's behalf
-// reads their stated wishes from their own pod rather than holding a private
-// copy of them. So the reader here is deliberately unauthenticated: the
-// document is public, and a service that needed a credential to read it would
-// be holding something about the person it should not have to.
-
-import { readCapped } from './http.mjs';
-
-const POLICY_TTL_MS = 5 * 60_000;
-const POLICY_MAX_BYTES = 256 * 1024;
-
-/**
- * The published policy, or null when there is none to read.
- *
- * The cache is passed IN rather than kept here. A library that holds
- * process-global state decides its own lifetime, and the lifetime that matters
- * belongs to the service: on a warm serverless container one Map is shared
- * across every user it serves, so what it is keyed by is a correctness
- * property, not an optimisation. Keyed by `podHome`, it is one person's policy
- * under one person's key.
- *
- * Cached at all because a delivery flood must not become one read per delivery
- * against the person's pod — which is the load the whole arrangement exists to
- * spare them.
- *
- * ---- asked by: a delivery gateway, deciding what concerns this person ----
- */
-export async function read(fetchImpl, podHome, { cache = null, ttlMs = POLICY_TTL_MS } = {}) {
-  const hit = cache?.get(podHome);
-  if (hit && Date.now() - hit.at < ttlMs) return hit.policy;
-  let policy = null;
-  try {
-    const res = await fetchImpl(podHome + 'ap/gateway-policy.json',
-      { headers: { accept: 'application/json' } });
-    if (res && res.status < 400) policy = JSON.parse(await readCapped(res, POLICY_MAX_BYTES));
-  } catch { /* unpublished or unreachable: the caller's own fields stand */ }
-  cache?.set(podHome, { at: Date.now(), policy });
-  return policy;
-}
-
-// ---- the owner's agent ----
-
-/**
- * Publish the policy.
- *
- * Public-Read on purpose, and the only document in this library written
- * public specifically so that a service holding no credential can act on the
- * owner's behalf. What goes IN it — which follows count, which blocks — is the
- * caller's to decide; that it is readable is the point of it existing.
- */
-export async function write(pod, urls, doc) {
-  const url = urls.home + 'ap/gateway-policy.json';
-  await pod.putJson(url, doc, 'application/json');
-  await pod.setAcl(url, ['Read']);
-}

package/lib/pod/private.mjs

@@ -1,19 +0,0 @@
-// private.mjs — ap/private/: the collections that are nobody else's business.
-//
-// pending-followers and pending-following are FEP-4ccd's follows in limbo;
-// blocked is FEP-c648's block list. All three live in the private container so
-// the owner-only rule is INHERITED rather than re-stated per document — which
-// is why none of these writes sets an ACL of its own, and why writing one into
-// the wrong container would silently publish it.
-
-import * as collection from './collection.mjs';
-
-// ---- the owner's agent ----
-
-export async function writePending(pod, urls, { followers, following }) {
-  await collection.writeFlat(pod, urls.pendingFollowers, followers);
-  await collection.writeFlat(pod, urls.pendingFollowing, following);
-}
-
-export const writeBlocked = (pod, urls, doc) =>
-  collection.writeFlat(pod, urls.blocked, doc);

package/lib/pod/root.mjs

@@ -1,104 +0,0 @@
-// root.mjs — the pod itself, before any of its containers.
-//
-// Three questions get asked of a pod root rather than of a document in it: who
-// owns it, whether it is there at all, and — for a service publishing someone
-// else's pod on their behalf — what one of its public documents says.
-//
-// Every operation here takes a plain fetcher, not a transport. That is the
-// honest shape: these are asked by parties that hold no credential for the pod
-// — a keyless delivery gateway, a sign-up page looking at a pod the person
-// brought with them — and giving them an authenticated transport would let
-// them ask questions they have no business asking.
-
-import { readCapped } from './http.mjs';
-import { linkTargets, REL } from './links.mjs';
-
-const OWNER_LOOKUP_MS = 5_000;
-const PUBLIC_DOC_MAX_BYTES = 1024 * 1024;
-
-/**
- * Who the pod server says owns this pod.
- *
- * The server hosting it is the authority on that, so when it answers, its
- * answer decides. A server that says nothing leaves where the WebID lives as
- * the only evidence there is — which is weaker, and the caller's problem.
- *
- * ---- asked by: a service deciding whether someone may speak for a pod ----
- */
-export async function readOwnerLinks(fetchImpl, podBase, { timeoutMs = OWNER_LOOKUP_MS } = {}) {
-  try {
-    const res = await fetchImpl(podBase, {
-      method: 'HEAD', signal: AbortSignal.timeout(timeoutMs),
-    });
-    return linkTargets(res?.headers?.get?.('link'), REL.owner, podBase);
-  } catch { return []; }
-}
-
-/**
- * Does anything answer at this pod?
- *
- * ---- asked by: a provisioning client, about a pod the person brought ----
- */
-/**
- * Where a provider puts its pods: on hosts of their own, or on paths of one
- * suffix-based host. No spec says. What does say is the storage description at the
- * provider's root: a CSS that keeps pods on subdomains answers 501 there,
- * because its root is not a storage; one that keeps them on paths answers 200
- * with the root described as a storage. Anything else is unknown.
- *
- * Decides, at sign-up, whether the address can live on the pod at all: a pod
- * on a path shares its host, so nothing there answers WebFinger for it.
- *
- * @returns 'host' | 'path' | null
- */
-export async function podLayout(fetchImpl, providerOrigin, { timeoutMs = OWNER_LOOKUP_MS } = {}) {
-  let origin;
-  try { origin = new URL(providerOrigin).origin; } catch { return null; }
-  let res;
-  try {
-    res = await fetchImpl(`${origin}/.well-known/solid`,
-      { headers: { accept: 'text/turtle' }, signal: AbortSignal.timeout(timeoutMs) });
-  } catch { return null; }
-  if (res.status === 501) return 'host';
-  if (res.status !== 200) return null;
-  let body = '';
-  try { body = await readCapped(res, 64 * 1024); } catch { return null; }
-  return /ns\/pim\/space#Storage|pim:Storage/u.test(body) ? 'path' : null;
-}
-
-// Whether a document is there — one unauthenticated GET, 200 or not. The caller
-// names the URL; asked before a second setup, so a pod that already serves an
-// actor at the app's container refuses another rather than growing a duplicate.
-export async function resourceExists(fetchImpl, url, { timeoutMs = OWNER_LOOKUP_MS } = {}) {
-  try {
-    const res = await fetchImpl(url,
-      { headers: { accept: 'application/activity+json' }, signal: AbortSignal.timeout(timeoutMs) });
-    return !!res && res.status === 200;
-  } catch { return false; }
-}
-
-export async function probeAnswers(podUrl, fetchImpl = fetch) {
-  try {
-    const res = await fetchImpl(podUrl, { method: 'HEAD' });
-    return { ok: res.status < 400, status: res.status };
-  } catch (e) { return { ok: false, status: 0, error: e.message }; }
-}
-
-/**
- * One public document, read on behalf of someone who is not its owner.
- *
- * `getter` is how the read happens, which is not always a network fetch: a
- * component running inside the pod server reads its own store directly and has
- * no access control of its own, so the pod this read belongs to travels with
- * the request and the getter is told what it may reach.
- *
- * ---- asked by: a front publishing a pod's public face under its own name ----
- */
-export async function readPublicDocument(getter, podTarget, { podHome, accept = null, maxBytes = PUBLIC_DOC_MAX_BYTES } = {}) {
-  const res = await getter(podTarget, { podHome, accept });
-  if (!res || res.status >= 400) return { status: res?.status || 502, text: null };
-  // What the pod called it: a front that relabels an HTML page as JSON hands
-  // a browser something it will not render.
-  const type = res.headers?.get?.('content-type') || null;
-  return { status: 200, text: await readCapped(res, maxBytes), type };
-}

package/lib/pod/state.mjs

@@ -1,40 +0,0 @@
-// state.mjs — ap-state/: what the agent knows, kept where the agent is not.
-//
-// A browser has no disk you can carry to the next machine, so the durable copy
-// of an identity's state lives on its pod. Most of that tree is handled by a
-// caching store; what is here is the two documents read and written OUTSIDE
-// it, before there is a store to read them with.
-//
-// The container is owner-only, and every operation here assumes that has
-// already been established — see provisionKey, which is the one place that
-// establishes it, and does so in an order that is not negotiable.
-
-// ---- the owner's agent ----
-
-export const readKeys = (pod, urls) => pod.getJson(urls.state + 'keys.json');
-export const readConfig = (pod, urls) => pod.getJson(urls.state + 'config.json');
-
-export const writeKeys = (pod, urls, keys) =>
-  pod.putJson(urls.state + 'keys.json', keys, 'application/json');
-export const writeConfig = (pod, urls, config) =>
-  pod.putJson(urls.state + 'config.json', config, 'application/json');
-
-// ---- a provisioning client, setting an identity up for the first time ----
-
-/**
- * Lock the state container, THEN write the signing key into it.
- *
- * The order is the operation. Writing the key first leaves a window in which a
- * pod whose root is world-readable serves it to anyone who asks — and a pod
- * the person brought with them is exactly the case where that root may be
- * public. As two statements this was two chances to get it wrong; as one
- * operation there is nowhere to put them in the other order.
- *
- * The keys record is stored as it is: the container's access rule is what
- * keeps it to the owner, the same rule every private document on the pod
- * lives under.
- */
-export async function provisionKey(pod, { stateUrl, keysUrl, keys }) {
-  await pod.setAcl(stateUrl, []);
-  await pod.putJson(keysUrl, keys, 'application/json');
-}