fedipod-server 0.29.0 → 0.31.0

package/lib/device/admin/routes/lifecycle.mjs

@@ -1,200 +0,0 @@
-// lifecycle.mjs — what happens to the identity over time: draining and
-// pruning the inbox, rebuilding posts, republishing, parking and reviving,
-// rotating the key, moving, aliases, importing, retiring.
-
-import { resolveHandle } from '../../../core/social.mjs';
-import { webfingerHost } from '../../../core/wire.mjs';
-import { normalizeImport, IMPORT_KINDS } from '../../../connections/import.mjs';
-
-export async function post(p, body, ctx, req, res) {   // eslint-disable-line no-unused-vars
-  const { agent, log, allowed, embedded, port, publicOrigin, versionOnDisk, isGroup } = ctx;   // eslint-disable-line no-unused-vars
-  const json = (res, status, obj) => { ctx.json(res, status, obj); return true; };
-  switch (p) {
-    // Both of these DELETE from the pod's inbox, which is the one thing the
-    // lease exists to keep to a single agent. A viewer must claim it first
-    // and give up if it cannot — the facade has refused viewer writes since
-    // multi-device landed, and these two were simply missed.
-    // The account back in this agent's hands. A viewer publishes nothing and
-    // drains nothing, so a lease left behind by something that is gone leaves
-    // the account silent with nothing in the interface to say so.
-    case '/takeover': {
-      if (!await agent.requestTakeover?.()) {
-        return json(res, 503, { error: 'the lease could not be taken — the pod refused the write' });
-      }
-      return json(res, 200, { ok: true, mode: agent.status().mode });
-    }
-    case '/drain': {
-      if (!await agent.requestTakeover?.()) {
-        return json(res, 503, { error: 'another agent is active for this pod — it is doing the draining' });
-      }
-      await agent.intake.drain();
-      return json(res, 200, agent.status());
-    }
-    // The owner's answer to "your inbox is very full". Never automatic:
-    // discarding someone's mail is their call, not the agent's.
-    case '/inbox/prune': {
-      if (!body.before) return json(res, 400, { error: 'before (a date) required' });
-      if (!await agent.requestTakeover?.()) {
-        return json(res, 503, { error: 'another agent is active for this pod — discard from that one' });
-      }
-      return json(res, 200, await agent.intake.prune({
-        before: body.before,
-        ...(body.keepConcerning ? { keepConcerning: true } : {}),
-      }));
-    }
-    // Put back the posts a lost or restored machine no longer knows about,
-    // from what the pod still serves. It writes the statuses store, which is
-    // the lease's business, so it refuses the same way the drain does.
-    case '/rebuild': {
-      if (!await agent.requestTakeover?.()) {
-        return json(res, 503, { error: 'another agent is active for this pod — rebuild from that one' });
-      }
-      return json(res, 200, await agent.publisher.rebuildStatuses({ fromNotes: !!body.fromNotes }));
-    }
-    case '/publish-profile': {
-      // The explicit "republish now" control. Asking for it IS the reason.
-      const r = await agent.publisher.publishProfile({ force: true });
-      return json(res, 200, { ok: true, ...(r?.unreachable?.length ? { unreachable: r.unreachable } : {}) });
-    }
-    // ---- lifecycle: what the CLI calls park | revive | rotate-key | retire ----
-    // Each claims the lease first, for the same reason /config does: someone
-    // acting on this page outranks an idle active agent on another device.
-    // Asking first is the page's job — see the warnings in its markup.
-    case '/park': {
-      await agent.requestTakeover?.();
-      return json(res, 200, { ok: true, ...await agent.park() });
-    }
-    case '/revive': {
-      await agent.requestTakeover?.();
-      return json(res, 200, { ok: true, ...await agent.revive() });
-    }
-    case '/rotate-key': {
-      await agent.requestTakeover?.();
-      const r = await agent.rotateKey();
-      return json(res, 200, { ok: true, changed: !!r?.changed });
-    }
-    // Hand the identity on. Federated and effectively one-way: the Move
-    // tells every follower's server to migrate them, and the actor is left
-    // advertising movedTo so the old handle redirects. Same typed-handle
-    // interlock as retire — a stray click cannot produce it.
-    case '/move': {
-      if (!body.target) return json(res, 400, { error: 'target required' });
-      if (!body.confirm || body.confirm !== agent.store.getConfig()?.handle) {
-        return json(res, 400, { error: 'type the handle to confirm' });
-      }
-      await agent.requestTakeover?.();
-      // A handle is not an actor URI, and the Move's target has to be one or
-      // the far side has nothing to migrate anyone to. The CLI resolves it
-      // the same way; doing it here rather than in the page keeps the one
-      // WebFinger lookup on the side that already knows how.
-      let target = String(body.target).trim();
-      if (!/^https?:\/\//.test(target)) {
-        const doc = await resolveHandle(agent, target);
-        if (!doc?.id) return json(res, 400, { error: `could not resolve ${target}` });
-        target = doc.id;
-      }
-      return json(res, 200, { ok: true, ...await agent.moveTo(target) });
-    }
-    // The inbound half of a migration: list an old account elsewhere in
-    // this actor's alsoKnownAs, which is what the old server checks for
-    // before it will send a Move here. Whatever is entered is resolved to
-    // the account's canonical id — the check on the far side is an exact
-    // string match, so a pasted profile URL stored as typed would fail it.
-    case '/alias': {
-      const urls = agent.publisher?.urls;
-      if (!urls) return json(res, 409, { error: 'agent not connected yet' });
-      if (!body.add && !body.remove) return json(res, 400, { error: 'add or remove required' });
-      await agent.requestTakeover?.();
-      const cfg = { ...agent.store.getConfig() };
-      const aliases = [...(cfg.aliases || [])];
-      if (body.add) {
-        // A Move target nobody can resolve is a landing pad nobody lands on.
-        if (!webfingerHost(urls.base) && !cfg.gateway?.frontActor) {
-          return json(res, 400, {
-            error: 'this pod is suffixed, so WebFinger cannot answer for it '
-              + '— other servers could never resolve this account as a Move target',
-          });
-        }
-        const input = String(body.add).trim().replace(/^@/, '');
-        let doc = /^https?:\/\//.test(input)
-          ? await agent.intake.fetchAP(input).catch(() => null)
-          : await resolveHandle(agent, input).catch(() => null);
-        // A URL may answer with any id it likes; before that id is stored
-        // it must vouch for itself — the intake's verify-by-deref.
-        if (doc?.id && /^https?:\/\//.test(input) && doc.id !== input) {
-          const own = await agent.intake.fetchAP(doc.id).catch(() => null);
-          doc = own?.id === doc.id ? own : null;
-        }
-        if (!doc?.id) {
-          return json(res, 400, { error: `could not fetch the old account (${input}) — it must exist and answer` });
-        }
-        if (doc.id === urls.actor) return json(res, 400, { error: 'that is this account' });
-        if (!aliases.includes(doc.id)) aliases.push(doc.id);
-      } else {
-        const target = String(body.remove).trim();
-        if (!aliases.includes(target)) return json(res, 404, { error: 'no such alias' });
-        // Follower servers process a Move on their own retry schedules,
-        // over days — an alias removed early strands the late ones.
-        if (!body.confirm) {
-          return json(res, 409, {
-            error: 'servers still retrying the Move check this alias and would strand '
-              + 'their followers — send confirm: true to remove it anyway',
-          });
-        }
-        aliases.splice(aliases.indexOf(target), 1);
-      }
-      cfg.aliases = aliases;
-      agent.store.setConfig(cfg);
-      agent.publisher.config.aliases = aliases;
-      await agent.store.flush();
-      const pub = await agent.publisher.publishProfile();
-      return json(res, 200, {
-        ok: true, aliases,
-        ...(pub?.unreachable?.length ? { unreachable: pub.unreachable } : {}),
-      });
-    }
-    // Stage a CSV export from the old account. Rows are applied by the
-    // agent's paced worker, not in this request — big lists take a while,
-    // and GET /import is the window onto how far it has gotten.
-    case '/import': {
-      if (!agent.importer) return json(res, 409, { error: 'agent not connected yet' });
-      // Unlike the one-shot routes, staging arms a worker that keeps
-      // writing for minutes — a device that could not take the lease must
-      // not run one alongside the device that holds it.
-      const took = await agent.requestTakeover?.();
-      if (took === false) {
-        return json(res, 503, { error: 'another device is active for this pod — import from there' });
-      }
-      if (body.clear === true) {
-        agent.importer.clear();
-        return json(res, 200, { ok: true, cleared: true });
-      }
-      if (!IMPORT_KINDS.includes(body.kind)) {
-        return json(res, 400, { error: `kind must be one of: ${IMPORT_KINDS.join(', ')}` });
-      }
-      if (typeof body.text !== 'string' || !body.text.trim()) {
-        return json(res, 400, { error: 'text required — the CSV file contents' });
-      }
-      const { values, invalid } = normalizeImport(body.kind, body.text);
-      const r = agent.importer.stage(body.kind, values);
-      await agent.store.flush();
-      return json(res, 200, {
-        ok: true, kind: body.kind, ...r,
-        invalid: invalid.length,
-        ...(invalid.length ? { invalidSample: invalid.slice(0, 5) } : {}),
-      });
-    }
-    case '/retire': {
-      // Irreversible and federated: a Delete leaves for every follower and
-      // the actor becomes a Tombstone. The typed handle is the interlock —
-      // a stray click cannot produce it, and nor can anything that never
-      // read the record.
-      if (!body.confirm || body.confirm !== agent.store.getConfig()?.handle) {
-        return json(res, 400, { error: 'type the handle to confirm' });
-      }
-      await agent.requestTakeover?.();
-      return json(res, 200, { ok: true, ...await agent.publisher.retireActor() });
-    }
-    default: return false;
-  }
-}

package/lib/device/admin/routes/owner.mjs

@@ -1,322 +0,0 @@
-// owner.mjs — the record: what the owner's page reads about this identity,
-// and the one write that edits it.
-
-import fs from 'node:fs';
-import path from 'node:path';
-import { announceModeration } from '../../../core/social.mjs';
-import { addRemoveActivity, publicHandle } from '../../../core/wire.mjs';
-import { hashPassword } from '../../../client/masto/index.mjs';
-import { identityHomes, rootOf, tildify, defaultProfile } from '../../home.mjs';
-import { localFetch } from '../../../client/localapi.mjs';
-import { AGENT_VERSION } from '../static.mjs';
-import { secureOrigin } from '../origins.mjs';
-
-// The identity itself. Changing any of these means a different actor at a
-// different address, which is a new setup, not an edit.
-const PERMANENT_CONFIG = ['handle', 'remotePod', 'issuer', 'root', 'kind'];
-// Config the actor document carries, so a change is not real until it is
-// republished.
-const WIRE_CONFIG = ['name', 'summary', 'icon', 'image', 'fields', 'approveJoins', 'moderators'];
-
-export async function get(p, ctx, req, res, url) {   // eslint-disable-line no-unused-vars
-  const { agent, log, allowed, embedded, port, publicOrigin, versionOnDisk, isGroup } = ctx;   // eslint-disable-line no-unused-vars
-  const json = (res, status, obj) => { ctx.json(res, status, obj); return true; };
-
-  if (req.method === 'GET' && p === '/status') return json(res, 200, agent.status());
-  // The moderation queue: what listed moderators asked for over federation,
-  // waiting for the operator to vouch (or not). See POST /modqueue.
-  if (req.method === 'GET' && p === '/modqueue') {
-    return json(res, 200, agent.store.getConfig()?.kind === 'group'
-      ? agent.store.read('modqueue.json', []) : []);
-  }
-  // The inbox gateway (optional, opt-in). Its state, and the shadow-mode
-  // measurement that says whether it is worth trusting. The HMAC secret is
-  // never returned — only whether one is set.
-  if (req.method === 'GET' && p === '/gateway') {
-    const g = agent.store.getConfig()?.gateway || null;
-    return json(res, 200, {
-      configured: !!(g && g.url),
-      url: g?.url || null, webId: g?.webId || null,
-      frontActor: g?.frontActor || null,
-      mode: g?.mode || 'off', hasSecret: !!g?.hmacSecret,
-      stats: agent.store.read('gateway-stats.json', { verified: 0, unverified: 0, lastAt: null }),
-    });
-  }
-  // The other identities on this machine, so the page can link to each one.
-  // Their `agent.json` is the only file read — a port and a handle. A
-  // sibling's credential and keys are never opened; anything else shown
-  // here comes from that agent answering /status for itself.
-  if (req.method === 'GET' && p === '/profiles') {
-    const here = path.resolve(agent.home || '');
-    // Which identity a plain command means: the last one started. A
-    // different question from `current`, which is the page you are on.
-    const wasLast = defaultProfile(rootOf(here));
-    const rows = await Promise.all(identityHomes(rootOf(here)).map(async ({ name, dir }) => {
-      // agent.json holds a port AND a handle — setup records both, exactly
-      // so the named origin can be built before that agent has said a word.
-      let rec = {};
-      try { rec = JSON.parse(fs.readFileSync(path.join(dir, 'agent.json'), 'utf8')) || {}; } catch {}
-      const port = rec.port || null;
-      // A directory under profiles/ is not an identity until it holds a
-      // credential or has run somewhere. A half-finished setup leaves one
-      // behind, and listing it offers a page that cannot exist yet.
-      if (!port && !fs.existsSync(path.join(dir, 'credential.json'))) return null;
-      const current = path.resolve(dir) === here;
-      const live = current ? agent.status() : port
-        ? await localFetch(agent.home, port, '/status', { timeout: 1200 })
-          .then(r => r.json()).catch(() => null)
-        : null;
-      // The handle is right here — spending it on the origin is the whole
-      // point of having asked that agent who it is. A stopped one never
-      // answers, so its recorded handle stands in: the link has to be named
-      // before you get there, or starting it lands you on the shared origin.
-      const handle = live?.handle || rec.handle || null;
-      const origin = port
-        ? secureOrigin(handle, port)
-        : null;
-      // The fediverse address, assembled from the two things /status has:
-      // the handle, and the pod host its actor URL sits on.
-      let address = null;
-      if (live?.handle && live?.actor) {
-        try {
-          const front = live.actor.match(/\/u\/([^/]+)\/ap\/actor\/?$/)?.[1];
-          address = `${front || live.handle}@${new URL(live.actor).host}`;
-        } catch { /* not a URL yet */ }
-      }
-      return {
-        name, port, current,
-        admin: origin ? `${origin}/admin/` : null,
-        app: origin ? `${origin}/` : null,
-        handle,
-        address,
-        lastUsed: name === wasLast,
-        kind: live?.kind || null,
-        mode: live ? live.mode : null,
-      };
-    }));
-    return json(res, 200, { identities: rows.filter(Boolean) });
-  }
-  if (req.method === 'GET' && p === '/blocks') return json(res, 200, agent.store.getBlocklist());
-  if (req.method === 'GET' && p === '/log') return json(res, 200, { lines: agent.logLines(200) });
-  if (req.method === 'GET' && p === '/deadletter') return json(res, 200, { items: agent.store.getDeadLetters() });
-
-  if (req.method === 'GET' && p === '/config') {
-    const cfg = agent.store.getConfig();
-    if (!cfg) return json(res, 409, { error: 'agent not configured — set it up at /admin/setup/' });
-    const urls = agent.urls || agent.publisher?.urls || null;
-    const wfHost = urls ? new URL(urls.base).host : null;
-    // A fronted identity's address is its name AT THE FRONT — the front
-    // serves the actor under that name, whatever this pod calls it.
-    const address = cfg.gateway?.frontActor
-      ? `@${publicHandle(cfg)}@${new URL(cfg.gateway.frontActor).host}`
-      : (wfHost ? `@${cfg.handle}@${wfHost}` : null);
-    return json(res, 200, {
-      // permanent
-      handle: cfg.handle, remotePod: cfg.remotePod, issuer: cfg.issuer,
-      root: cfg.root || null, kind: cfg.kind || 'person',
-      actor: urls?.actor || null, webId: agent.readCredential?.()?.webId || null,
-      // The opaque id the client addresses this actor by, so the record can
-      // link straight at its profile there. Derived from the actor URL the
-      // same way every other id is — computed here rather than in the page,
-      // which has no business knowing how they are made.
-      accountId: urls?.actor ? agent.store.idFor(urls.actor) : null,
-      address,
-      // editable
-      name: cfg.name || null, summary: cfg.summary || null, icon: cfg.icon || null,
-      image: cfg.image || null, fields: cfg.fields || [],
-      approveJoins: !!cfg.approveJoins, review: !!cfg.review,
-      aliases: cfg.aliases || [],
-      autoAcceptFollows: !!cfg.autoAcceptFollows,
-      // never the record itself
-      hasUiPassword: !!cfg.uiPassword,
-      quiescedAt: cfg.quiescedAt || null, movedTo: cfg.movedTo || null,
-      // Per-machine, so it comes from the credential file, not pod config —
-      // and it is a fact here, not a setting: moving it means moving data,
-      // which is `fedipod state --to <url>`.
-      privateRoot: agent.readCredential?.()?.privateRoot || null,
-      mode: agent.status?.().mode || null, port, home: tildify(agent.home) || null,
-      update: agent.updateInfo || null,
-      // What this process is running, against what a restart would run:
-      // the checkout can move while an agent stays up.
-      version: AGENT_VERSION,
-      versionOnDisk: versionOnDisk(),
-      pendingUpgrade: agent.pendingUpgrade || [],
-      // The connected Bluesky account, non-secret half. `connected` is the
-      // credential's word, so a config entry orphaned by a deleted
-      // atproto.json shows as disconnected rather than pretending.
-      atproto: cfg.atproto
-        ? { ...cfg.atproto, connected: !!agent.atproto?.connected() }
-        : null,
-      // Connected fediverse accounts, from the credentials themselves
-      // rather than from config — a roster entry whose file was deleted
-      // should stop being listed, not linger.
-      fediAccounts: agent.fediaccts?.status() || [],
-      origins: {
-        loopback: publicOrigin
-          || `https://localhost:${port}/`,
-        named: publicOrigin
-          ? null
-          : allowed.label
-            ? (true
-              ? `https://${allowed.label}.localhost:${port}/`
-              : `http://${allowed.label}.localhost:${port}/`)
-            : null,
-      },
-    });
-  }
-  // How far the CSV import has gotten — polled by the CLI while it runs.
-  if (req.method === 'GET' && p === '/import') {
-    if (!agent.importer) return json(res, 409, { error: 'agent not connected yet' });
-    return json(res, 200, agent.importer.progress());
-  }
-  // Group-only: who is here, and what the group has carried. A group cannot
-  // force an unfollow, so muting — declining to carry — is its whole lever.
-  if (req.method === 'GET' && p === '/members') {
-    if (!isGroup()) return json(res, 404, { error: 'not a group' });
-    const muted = agent.store.getMuted().actors;
-    return json(res, 200, {
-      members: agent.store.getContacts().followers
-        .map(f => ({
-          actor: f.actor,
-          handle: agent.store.handleOf(f.actor),
-          inbox: f.sharedInbox || f.inbox,
-          muted: muted.includes(f.actor),
-        })),
-    });
-  }
-  if (req.method === 'GET' && p === '/announced') {
-    if (!isGroup()) return json(res, 404, { error: 'not a group' });
-    return json(res, 200, {
-      announced: agent.store.getStatuses().filter(s => s.announcedAt)
-        .map(s => ({ noteId: s.noteId, actor: s.actor, announcedAt: s.announcedAt })),
-    });
-  }
-  if (req.method === 'GET' && p === '/requests') {
-    // Not group-only any more: a person queues unverifiable follows here
-    // too, and a queue with no way to read it is worse than no queue.
-    return json(res, 200, {
-      approveJoins: !!agent.store.getConfig()?.approveJoins,
-      requests: agent.store.getRequests().map(r => ({ actor: r.actor, at: r.at })),
-    });
-  }
-  if (req.method === 'GET' && p === '/pending') {
-    if (!isGroup()) return json(res, 404, { error: 'not a group' });
-    return json(res, 200, {
-      review: !!agent.store.getConfig()?.review,
-      pending: agent.store.getPending(),
-    });
-  }
-
-  return false;
-}
-
-export async function post(p, body, ctx, req, res) {   // eslint-disable-line no-unused-vars
-  const { agent, log, allowed, embedded, port, publicOrigin, versionOnDisk, isGroup } = ctx;   // eslint-disable-line no-unused-vars
-  const json = (res, status, obj) => { ctx.json(res, status, obj); return true; };
-  switch (p) {
-    // ---- the record, edited from the page at /admin/ ----
-    case '/config': {
-      const fixed = PERMANENT_CONFIG.filter(k => k in body);
-      if (fixed.length) {
-        return json(res, 400, {
-          error: `${fixed.join(', ')} cannot be changed — that is the identity itself, not a setting`,
-        });
-      }
-      for (const k of ['approveJoins', 'review']) {
-        if (k in body && !isGroup()) return json(res, 404, { error: 'not a group' });
-      }
-      // A user acting here outranks an idle active agent on another device:
-      // claim the lease rather than write state that one will clobber.
-      await agent.requestTakeover?.();
-      // Merge, never replace: the UI password and anything else set later
-      // must survive an edit that never mentions it.
-      const cfg = { ...agent.store.getConfig() };
-      if ('name' in body) {
-        if (!body.name) return json(res, 400, { error: 'a display name is required' });
-        cfg.name = String(body.name);
-      }
-      if ('summary' in body) cfg.summary = body.summary || undefined;
-      if ('icon' in body) cfg.icon = body.icon || undefined;
-      // The banner and the labelled rows, so a client and this page edit one
-      // record rather than each other's leftovers.
-      if ('image' in body) cfg.image = body.image || undefined;
-      if ('fields' in body) {
-        cfg.fields = (Array.isArray(body.fields) ? body.fields : [])
-          .filter(f => f?.name?.trim())
-          .map(f => ({ name: String(f.name).trim(), value: String(f.value ?? '').trim() }));
-      }
-      if ('approveJoins' in body) cfg.approveJoins = !!body.approveJoins;
-      if ('review' in body) cfg.review = !!body.review;
-      // A person's queue gate: on, and an inbound Follow is accepted on
-      // arrival instead of waiting in the requests queue. Local behavior,
-      // not on the wire — but intake reads the LIVE config, so it is
-      // patched below whether or not anything republishes.
-      if ('autoAcceptFollows' in body) cfg.autoAcceptFollows = !!body.autoAcceptFollows;
-      // The moderator roster (FEP-1b12): actor IRIs whose federated
-      // moderation asks are queued, published as attributedTo.
-      let rosterDiff = null;
-      if ('moderators' in body) {
-        if (!isGroup()) return json(res, 404, { error: 'not a group' });
-        const next = [...new Set((Array.isArray(body.moderators) ? body.moderators : [])
-          .map(String).filter(m => /^https?:\/\/\S+$/.test(m)))];
-        const prev = cfg.moderators || [];
-        rosterDiff = {
-          added: next.filter(m => !prev.includes(m)),
-          removed: prev.filter(m => !next.includes(m)),
-        };
-        cfg.moderators = next;
-      }
-      if ('password' in body) {
-        // '' clears it. The UI password is what turns the instant OAuth
-        // redirect into a login form; switching that off is a real choice.
-        if (body.password) cfg.uiPassword = hashPassword(body.password);
-        else delete cfg.uiPassword;
-      }
-      const republish = WIRE_CONFIG.some(k => k in body);
-      agent.store.setConfig(cfg);
-      if ('autoAcceptFollows' in body && agent.publisher) {
-        agent.publisher.config.autoAcceptFollows = cfg.autoAcceptFollows;
-      }
-      if (republish && agent.publisher) {
-        Object.assign(agent.publisher.config, {
-          name: cfg.name, summary: cfg.summary, icon: cfg.icon,
-          image: cfg.image, fields: cfg.fields,
-          approveJoins: !!cfg.approveJoins,
-          moderators: cfg.moderators,
-          aliases: cfg.aliases,
-        });
-      }
-      await agent.store.flush();
-      // Publishing is only half of it: publishProfile re-fetches the public
-      // documents unauthenticated and reports the ones a stranger's server
-      // could not read. Carrying that back is what lets this be the only
-      // republish control there is.
-      const pub = republish ? await agent.publisher.publishProfile() : null;
-      // Roster changes are announced to the membership (FEP-1b12), so
-      // their servers can mirror who moderates here.
-      if (rosterDiff && agent.publisher) {
-        const urls = agent.publisher.urls;
-        for (const [type, list] of [['Add', rosterDiff.added], ['Remove', rosterDiff.removed]]) {
-          for (const m of list) {
-            await announceModeration(agent, addRemoveActivity({
-              urls, type, object: m, target: urls.moderators, serial: Date.now(),
-            })).catch(e => log(`moderation announce failed: ${e.message}`));
-          }
-        }
-      }
-      return json(res, 200, {
-        ok: true, published: republish,
-        ...(pub?.unreachable?.length ? { unreachable: pub.unreachable } : {}),
-        config: {
-          name: cfg.name || null, summary: cfg.summary || null, icon: cfg.icon || null,
-      image: cfg.image || null, fields: cfg.fields || [],
-          approveJoins: !!cfg.approveJoins, review: !!cfg.review,
-          autoAcceptFollows: !!cfg.autoAcceptFollows,
-          ...(isGroup() ? { moderators: cfg.moderators || [] } : {}),
-          hasUiPassword: !!cfg.uiPassword,
-        },
-      });
-    }
-    default: return false;
-  }
-}