fedipod-server 0.29.0 → 0.31.0

package/dist/opt-in.js

@@ -0,0 +1,176 @@
+"use strict";
+// opt-in.ts — what a pod owner asks of this server: to run their identity,
+// to stop running it, and to say what their pod would be as an identity
+// here; and reading who the server's own account session belongs to.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.webIdsFromSession = webIdsFromSession;
+exports.optInPod = optInPod;
+exports.describePod = describePod;
+exports.optOutPod = optOutPod;
+const store_pod_1 = require("./store-pod");
+const directory_1 = require("./directory");
+const fedipod_1 = require("./fedipod");
+const mounts_1 = require("./mounts");
+const identities_1 = require("./identities");
+/**
+ * The WebIDs behind the account session in the request, or none. The server
+ * keeps that session in a `css-account` cookie; its own account API is what
+ * says which WebIDs the session owns, and it takes the same cookie. Nothing
+ * here trusts the cookie's presence — the account API does the deciding, and
+ * the caller picks the WebID that owns the pod being claimed.
+ */
+async function webIdsFromSession(h, request) {
+    const s = h.internals();
+    const cookie = request.headers.get('cookie');
+    if (!cookie || !/(?:^|;\s*)css-account=/u.test(cookie))
+        return [];
+    const base = s.args.frontOrigin.replace(/\/$/u, '');
+    const asJson = { cookie, accept: 'application/json' };
+    try {
+        const index = await fetch(`${base}/.account/`, { headers: asJson });
+        if (!index.ok)
+            return [];
+        const controls = (await index.json()).controls;
+        const webIdLink = controls?.account?.webId;
+        if (!webIdLink)
+            return [];
+        const linked = await fetch(webIdLink, { headers: asJson });
+        if (!linked.ok)
+            return [];
+        const links = (await linked.json()).webIdLinks ?? {};
+        return Object.keys(links);
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * A pod owner, already proven to control podBase, asks this server to run
+ * their identity. Returns { httpStatus, ...body }; the secret appears in the
+ * reply and nowhere else. Re-opting-in rotates the secret — that is how a
+ * lost one is recovered.
+ */
+async function optInPod(h, { podBase, webId, container = '', createIndex = false }) {
+    const s = h.internals();
+    if (!s.registry)
+        return { httpStatus: 501, error: 'this server does not offer runtime opt-in' };
+    if (s.args.clusterManager && !s.args.clusterManager.isSingleThreaded()) {
+        return { httpStatus: 503, error: 'runtime opt-in needs a single-worker server (--workers 1)' };
+    }
+    const base = podBase.endsWith('/') ? podBase : `${podBase}/`;
+    const handle = (0, mounts_1.deriveHandle)(base);
+    // Already running here from an earlier opt-in: proving pod
+    // control again buys a fresh secret, nothing else.
+    if (s.agentHandles.get(handle) === base) {
+        const door = await (0, identities_1.doorSecretFor)(h, base, undefined, { rotate: true });
+        s.doorSecrets.set(base, door.secret);
+        return { httpStatus: 201, ok: true, handle, host: new URL(base).host.toLowerCase(),
+            doorSecret: door.secret, doorPath: s.uiPath, status: 'rotated' };
+    }
+    let claim;
+    try {
+        claim = (0, mounts_1.validateAgentPod)(h, base);
+    }
+    catch (e) {
+        return { httpStatus: 409, error: e.message };
+    }
+    const { host } = claim;
+    // Where on the pod: the container its owner named holds `fedipod/`. The
+    // place is recorded in their public type index — made only on their yes —
+    // before anything else is written, and read here with the server's own
+    // access to the pod.
+    const place = await (0, fedipod_1.esmImport)(fedipod_1.PLACE);
+    const chosen = place.chosenRoot(base, container);
+    if (chosen.problem || !chosen.root)
+        return { httpStatus: 400, error: `Where to store it: ${chosen.problem}.` };
+    const root = chosen.root;
+    const { PodTransport } = await (0, fedipod_1.esmImport)(fedipod_1.TRANSPORT);
+    const pod = new PodTransport((0, store_pod_1.makeStoreSession)(s.args.resourceStore, base), { webId });
+    if (!createIndex && !await place.hasPublicIndex(pod, base)) {
+        return { httpStatus: 409, code: 'needs-index',
+            error: 'Your pod has no public type index, the list Solid apps use to find your things. '
+                + 'FediPod needs one to record where your account lives.' };
+    }
+    try {
+        await place.recordPlace(pod, base, `${base}${root}ap/actor`, { create: createIndex });
+    }
+    catch (e) {
+        return { httpStatus: 500, error: `could not record where the account lives in your type index (${e.message})` };
+    }
+    s.roots.set(base, root);
+    try {
+        await s.registry.add({ podBase: base, handle, host, webId, root, optedInAt: new Date().toISOString() });
+    }
+    catch (e) {
+        s.logger.error(`opt-in row for ${base} could not be written: ${e.message}`);
+        return { httpStatus: 500, error: 'could not record the opt-in' };
+    }
+    // From this instant the pod's identity routes answer 503 instead of LDP,
+    // until the agent registers its surface.
+    s.claimed.set(base, claim);
+    s.agentHandles.set(handle, base);
+    const door = await (0, identities_1.doorSecretFor)(h, base, undefined, { rotate: true });
+    s.doorSecrets.set(base, door.secret);
+    void (0, identities_1.startIdentity)(h, base);
+    s.logger.info(`runtime opt-in: @${handle} on ${base} (door secret in its pod at ${door.url})`);
+    return { httpStatus: 201, ok: true, handle, host,
+        doorSecret: door.secret, doorPath: s.uiPath, status: 'starting' };
+}
+/**
+ * What a pod would be as an identity here, without changing anything: its
+ * handle, the host its address carries, and whether it runs here already.
+ */
+async function describePod(h, { podBase }) {
+    const s = h.internals();
+    const base = podBase.endsWith('/') ? podBase : `${podBase}/`;
+    const handle = (0, mounts_1.deriveHandle)(base);
+    let host;
+    try {
+        host = (0, mounts_1.validateAgentPod)(h, base).host;
+    }
+    catch {
+        host = new URL(base).host.toLowerCase();
+    }
+    const running = s.agentHandles.get(handle) === base;
+    // The management page's door takes its key once in the address and keeps
+    // the browser in with a cookie. Only the owner's own page ever asks for
+    // this description, so the key rides on the link for a running account.
+    // Read from the pod, where the key always is, rather than from what this
+    // process happens to hold: an account still starting has none in memory.
+    let key;
+    if (running) {
+        try {
+            key = (await (0, identities_1.doorSecretFor)(h, base)).secret;
+        }
+        catch {
+            key = s.doorSecrets.get(base);
+        }
+    }
+    const door = base.replace(/\/$/u, '') + s.uiPath;
+    return { handle, host, address: `@${handle}@${host}`, running,
+        manage: key ? `${door}?dk-token=${encodeURIComponent(key)}` : door };
+}
+/** The reverse: stop the identity and let the pod be plain LDP again. */
+async function optOutPod(h, { podBase }) {
+    const s = h.internals();
+    if (!s.registry)
+        return { httpStatus: 501, error: 'this server does not offer runtime opt-in' };
+    const base = podBase.endsWith('/') ? podBase : `${podBase}/`;
+    const host = new URL(base).host.toLowerCase();
+    const key = (0, directory_1.agentKey)(host, base);
+    const row = await s.registry.get(key);
+    if (!row || row.podBase !== base)
+        return { httpStatus: 404, error: 'this pod has not opted in' };
+    s.claimed.delete(base); // routes fall to LDP now
+    s.startCancelled.add(base); // a pending start stands down
+    const identity = s.identities.get(base);
+    s.identities.delete(base);
+    s.surfaces.delete(base);
+    s.agentHandles.delete(row.handle);
+    s.doorSecrets.delete(base);
+    if (identity)
+        await identity.stop();
+    await s.registry.remove(key);
+    s.logger.info(`runtime opt-out: @${row.handle} on ${base} — the pod serves plain LDP again`);
+    return { httpStatus: 200, ok: true, stopped: Boolean(identity) };
+}

package/dist/private-read.d.ts

@@ -0,0 +1,4 @@
+import type { HttpHandlerInput } from '@solid/community-server';
+import type { EmbeddedIdentity } from './identities';
+import type { FediPodServerHandler } from './handler';
+export declare function readPrivateAtDoor(h: FediPodServerHandler, identity: EmbeddedIdentity, request: HttpHandlerInput['request'], response: HttpHandlerInput['response']): Promise<void>;

package/dist/private-read.js

@@ -0,0 +1,34 @@
+"use strict";
+// private-read.ts — a signed read of a followers-only or direct post at its
+// address on this pod, answered to a server the post was sent to (ActivityPub
+// §3.2). The same rule the front applies (lib/gateway/private-read.mjs); the
+// post is read through the server's own store and the followers come from the
+// identity's live state. Anyone the post was not sent to gets 404.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readPrivateAtDoor = readPrivateAtDoor;
+const adapt_1 = require("./adapt");
+const fedipod_1 = require("./fedipod");
+async function readPrivateAtDoor(h, identity, request, response) {
+    const s = h.internals();
+    const { readPrivateForSigner } = await (0, fedipod_1.esmImport)(fedipod_1.EMBED);
+    let whatwg;
+    try {
+        // The pod's own origin: the signature covers the path and the Host header, and both are the pod's.
+        whatwg = await (0, adapt_1.nodeToWhatwg)(request, new URL(identity.podHome).origin);
+    }
+    catch (e) {
+        response.writeHead(400, { 'content-type': 'application/json' });
+        response.end(JSON.stringify({ error: e.message }));
+        return;
+    }
+    const out = await readPrivateForSigner(identity.agent, whatwg, { read: (url) => s.io.read(url) });
+    s.logger.info(`FediPod: private read for @${identity.handle} — ${out.reason} (${out.status})`);
+    const noStore = { 'cache-control': 'no-store', vary: 'Signature' };
+    if (out.status !== 200) {
+        response.writeHead(out.status, noStore);
+        response.end();
+        return;
+    }
+    response.writeHead(200, { ...noStore, 'content-type': 'application/activity+json' });
+    response.end(String(request.method).toUpperCase() === 'HEAD' ? '' : out.body);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fedipod-server",
-  "version": "0.29.0",
+  "version": "0.31.0",
   "description": "The FediPod Server: a full ActivityPub server as a Community Solid Server component.",
   "license": "MIT",
   "main": "dist/index.js",
@@ -8,11 +8,6 @@
   "files": [
     "dist",
     "config",
-    "lib",
-    "vendor",
-    "web",
-    "run-agent.mjs",
-    "phanpy",
     "README.md",
     "fedipod-server.svg"
   ],
@@ -20,20 +15,16 @@
     "@solid/community-server": "^7.0.0"
   },
   "dependencies": {
-    "@fedify/fedify": "^2.3.4",
-    "@solid/access-token-verifier": "^2.1.1",
-    "jose": "^6.2.8",
-    "node-forge": "^1.4.0",
-    "rdflib": "^2.4.0",
-    "sanitize-html": "^2.17.6",
-    "undici": "^6.28.0",
-    "web-push": "^3.6.7"
+    "fedipod": "^1.45.0"
   },
   "devDependencies": {
-    "typescript": "^5.5.3",
-    "componentsjs-generator": "^3.1.2",
+    "@fedify/fedify": "^2.3.4",
+    "@solid/community-server": "^7.2.0",
     "@types/node": "^20.0.0",
-    "@solid/community-server": "^7.2.0"
+    "componentsjs-generator": "^3.1.2",
+    "n3": "^2.1.1",
+    "rdflib": "^2.4.0",
+    "typescript": "^5.5.3"
   },
   "overrides": {
     "@opentelemetry/core": "^2.8.0",
@@ -53,11 +44,12 @@
   "scripts": {
     "build": "tsc && npm run build:components",
     "build:components": "componentsjs-generator -s src -c dist/components -r fps",
+    "pretest": "node scripts/link-fedipod.mjs",
     "test": "npm run build && node --test test/*.mjs",
+    "pretest:e2e": "node scripts/link-fedipod.mjs",
     "test:e2e": "node test/e2e/live-agent.mjs",
+    "pretest:e2e:suffix": "node scripts/link-fedipod.mjs",
     "test:e2e:suffix": "node test/e2e/live-suffix.mjs",
-    "prepublishOnly": "npm test",
-    "prepack": "node scripts/pack-tree.mjs copy",
-    "postpack": "node scripts/pack-tree.mjs clean"
+    "prepublishOnly": "npm test"
   }
 }