fedipod-server 0.29.0 → 0.31.0

package/lib/gateway/gateway-core.mjs

@@ -1,244 +0,0 @@
-// gateway-core.mjs — the runtime-agnostic logic of an inbox gateway: verify a
-// delivery at the door (where the HTTP-Signature headers still exist), drop
-// spam and forgeries at the edge, and forward what remains — with a signed
-// verification receipt — into the pod inbox for the ordinary drain.
-//
-// This holds NO signing key. It verifies with remotes' PUBLIC keys, writes to
-// the pod inbox with an Append-only credential the adapter supplies, and stamps
-// the receipt with a shared HMAC secret. A compromise here can inject inbox
-// items (which still meet verify-by-dereference in the drain) but cannot
-// impersonate the actor, read the private tree, or post as it.
-//
-// `netlify/functions/inbox.mjs` is a thin adapter over this; an agent-side
-// endpoint could be another. The core is what the smoke suite exercises.
-
-import crypto from 'node:crypto';
-import { verifyHttpSignature, makeSafeLoader, makeReceipt, signReceipt } from './httpsig.mjs';
-import * as inbox from '../pod/inbox.mjs';
-import { senderKeys } from './caches.mjs';
-
-const DEFAULT_MAX_BYTES = 512 * 1024;   // mirror intake.mjs MAX_ITEM_BYTES
-
-// Control activities are the message itself and must always pass — you want
-// Follows from strangers. Only CONTENT is subject to the concerns-us drop,
-// and to a pause: an account nobody is reading still takes its follows.
-export const CONTROL = new Set(['Follow', 'Undo', 'Accept', 'Reject', 'Delete', 'Move',
-  'Add', 'Remove', 'Block']);
-export const isControl = (type) => CONTROL.has(type);
-
-const idOf = (v) => (typeof v === 'string' ? v : v?.id) || null;
-const sha256hex = (s) => crypto.createHash('sha256').update(s).digest('hex');
-
-function httpUrl(u) {
-  try { const p = new URL(u).protocol; return p === 'http:' || p === 'https:'; } catch { return false; }
-}
-
-// Mirror of intake.isBlocked over the policy doc's public blocklist mirror.
-function isBlocked(actor, blocklist = {}) {
-  if (!actor) return true;
-  if ((blocklist.actors || []).includes(actor)) return true;
-  // hostname, not host: the agent's own isBlocked strips the port, and a door
-  // that keeps it lets a blocked domain back in on a non-default port.
-  let host; try { host = new URL(actor).hostname; } catch { return false; }
-  return (blocklist.domains || []).some(d => host === d || host.endsWith('.' + d));
-}
-
-// The edge form of intake.concernsUs — pure addressing, no I/O. Conservative:
-// only DROPS content it is confident does not concern the identity. A GROUP
-// owns conversations under anything it has carried, which the keyless edge
-// cannot see, so a group defers the whole check to the drain (returns true).
-function concernsUsAtEdge(activity, ident) {
-  if (ident.kind === 'group') return true;
-  const actor = idOf(activity.actor);
-  if ((ident.following || []).includes(actor)) return true;
-  const obj = typeof activity.object === 'object' ? activity.object : null;
-  const audience = []
-    .concat(activity.to || [], activity.cc || [], activity.bto || [], activity.bcc || [], activity.audience || [],
-      obj?.to || [], obj?.cc || [], obj?.audience || [])
-    .map(idOf).filter(Boolean);
-  if (audience.includes(ident.actorUrl) || audience.includes(ident.followersUrl)) return true;
-  const tag = [].concat(obj?.tag || activity.tag || []);
-  if (tag.some(t => t?.type === 'Mention' && (t.href === ident.actorUrl || t.name?.includes(ident.actorUrl)))) return true;
-  const inReplyTo = idOf(obj?.inReplyTo ?? activity.inReplyTo);
-  return !!inReplyTo && ident.notesPrefix && String(inReplyTo).startsWith(ident.notesPrefix);
-}
-
-// Handle one inbound delivery. `request` is a WHATWG Request. `ident` is the
-// resolved identity policy: { inboxUrl, actorUrl, followersUrl, notesPrefix,
-// following, blocklist, kind, gatewayWebId, hmacSecret }. `podPut(url, body,
-// contentType) → boolean` appends to the pod with the gateway's credential.
-// `paused` says nobody is reading this inbox: content is accepted and
-// discarded (the same quiet 202 a blocked sender gets, so nothing retries
-// and nothing counts a failure against this host), control still lands.
-// Returns { status, reason } — the adapter turns it into an HTTP response —
-// and, for a delivery that reached the pod, `content` (whether it was
-// content rather than control) and `bytes`, so the caller can keep count.
-export async function handleDelivery(request, ident, { podPut, fetchImpl = fetch, maxBytes = DEFAULT_MAX_BYTES, paused = false } = {}) {
-  // Read the body once from a clone; the original, unconsumed, goes to the
-  // verifier (which needs the body for the Digest check).
-  let raw;
-  try { raw = await request.clone().text(); } catch { return { status: 400, reason: 'unreadable body' }; }
-  if (Buffer.byteLength(raw) > maxBytes) return { status: 413, reason: 'too large' };
-
-  let activity;
-  try { activity = JSON.parse(raw); } catch { return { status: 400, reason: 'unparsable JSON' }; }
-  const actor = idOf(activity.actor);
-  if (!httpUrl(actor)) return { status: 400, reason: 'actor is not an http(s) URL' };
-
-  // Edge drops — silent 202 so a rejected sender does not retry a delivery we
-  // will never accept. None of these becomes a pod write.
-  if (isBlocked(actor, ident.blocklist)) return { status: 202, reason: 'blocked' };
-  const content = !CONTROL.has(activity.type);
-  if (content && paused) return { status: 202, reason: 'paused' };
-  if (content && !concernsUsAtEdge(activity, ident)) {
-    return { status: 202, reason: 'does not concern us' };
-  }
-
-  // The sender's key, kept between deliveries: a server pushing a hundred
-  // items is asked for its key once (caches.mjs).
-  const v = await verifyHttpSignature(request, {
-    documentLoader: makeSafeLoader({ fetchImpl }), keyCache: senderKeys,
-  });
-  // A present-but-invalid signature is a forgery — dropped here, so it never
-  // reaches the pod (today it would, drain, and die unapplied). An absent or
-  // unfetchable-key signature is NOT dropped: it forwards unverified and the
-  // drain's verify-by-dereference still stands behind it.
-  if (v.verified === false && v.reason === 'bad-signature') {
-    return { status: 202, reason: 'forged signature' };
-  }
-
-  // No per-user secret on record = no receipt: the delivery still filters and
-  // forwards, it just reads as unverified at the drain — never a failure.
-  const receipt = ident.hmacSecret
-    ? signReceipt(makeReceipt(v, { gateway: ident.gatewayWebId }), ident.hmacSecret)
-    : null;
-  const hash = sha256hex(raw);
-  const okA = await inbox.appendVerifiedDelivery(podPut, ident.inboxUrl, hash, raw);
-  // A pod-write failure returns 5xx so the ORIGIN retries over its own ladder —
-  // that is what preserves the pod's buffer property without the gateway
-  // holding any state.
-  if (!okA) return { status: 502, reason: 'pod inbox write failed' };
-  if (receipt) await inbox.writeReceiptBeside(podPut, ident.inboxUrl, hash, receipt);
-  return { status: 202, reason: v.verified ? 'verified' : 'buffered-unverified', content, bytes: Buffer.byteLength(raw) };
-}
-
-// The outbox door: the owner's own post, taken on their behalf.
-//
-// A client such as dokieli POSTs an activity — or a bare object — to the
-// outbox address the actor advertises. The door holds no key and mints nothing:
-// it checks that the token proves the account's owner (the caller has already
-// done that and hands in `owner`), writes the bytes into the pod inbox exactly
-// as verified mail is written, and stamps them with a receipt whose method is
-// `c2s` and whose actor is this account. The drain hands such an item to the
-// client-to-server dispatcher, which publishes and delivers it — so the post
-// goes out when the agent next runs, the same way inbound mail is read.
-//
-// `slug` is the name of the new document — the client's, or one the door
-// chose — and `serial` and `at` name any other activity. They ride in the
-// receipt so the dispatcher uses them, and they are what let the door answer a
-// Location before anything exists. A name the client chose that is already
-// taken is the one case where the agent picks another.
-export const SLUG_OK = /^[A-Za-z0-9._-]{1,64}$/u;
-export const safeSlug = (s) => (typeof s === 'string' && SLUG_OK.test(s) && !/^\.+$/u.test(s) ? s : null);
-
-export async function handleOwnerPost(request, ident, { podPut, ownerWebId, maxBytes = DEFAULT_MAX_BYTES, exists = null } = {}) {
-  if (!ident.hmacSecret) return { status: 409, reason: 'this account has no door secret — attach it again' };
-  let raw;
-  try { raw = await request.text(); } catch { return { status: 400, reason: 'unreadable body' }; }
-  if (Buffer.byteLength(raw) > maxBytes) return { status: 413, reason: 'too large' };
-  let doc;
-  try { doc = JSON.parse(raw); } catch { return { status: 400, reason: 'unparsable JSON' }; }
-  if (!doc || typeof doc !== 'object' || Array.isArray(doc) || !doc.type) {
-    return { status: 400, reason: 'a typed ActivityStreams object is required' };
-  }
-  // A post that makes something new is named HERE, when the client did not
-  // name it, so the answer can give the address of what it made (§6: 201 with
-  // the new activity's id in Location) though nothing has been made yet.
-  // What the account would refuse is refused here, before the app is told
-  // "created" for something that will never exist.
-  const refusal = refusedAtTheDoor(doc, ident);
-  if (refusal) return { status: 422, reason: refusal };
-  const makes = doc.type === 'Create' || !ACTIVITY_TYPES.has(doc.type);
-  // A name the client asks for that is already taken is replaced here, so the
-  // address answered is the one the post gets.
-  let slug = safeSlug(request.headers.get('slug'));
-  if (slug && makes && exists && await exists(containerFor(doc, ident) + slug).catch(() => false)) slug = null;
-  if (!slug && makes) slug = mintSlug();
-  // Anything else is named the way the agent names it, from a serial and a
-  // time chosen here and handed over in the receipt.
-  // Two posts in the same millisecond still get different names.
-  const now = Date.now();
-  const serial = now * 1000 + crypto.randomInt(1000);
-  const at = new Date(now).toISOString();
-  const hash = sha256hex(raw);
-  // The receipt names the body it vouches for, so it vouches for nothing else,
-  // and the agent can tell the same body sent twice.
-  const receipt = signReceipt({
-    v: 1, verified: true, method: 'c2s', keyId: ownerWebId || null, actor: ident.actorUrl,
-    checks: ['owner-token'], reason: 'owner', gateway: ident.gatewayWebId, ...(slug ? { slug } : {}),
-    serial, at, hash,
-  }, ident.hmacSecret);
-  const okA = await inbox.appendVerifiedDelivery(podPut, ident.inboxUrl, hash, raw);
-  if (!okA) return { status: 502, reason: 'pod inbox write failed' };
-  await inbox.writeReceiptBeside(podPut, ident.inboxUrl, hash, receipt);
-  if (makes) {
-    const object = slug && ident.notesPrefix ? containerFor(doc, ident) + slug : null;
-    return { status: 201, reason: 'accepted', object, location: object ? object + '-create' : null };
-  }
-  const object = typeof doc.object === 'string' ? doc.object : doc.object?.id || null;
-  return { status: 201, reason: 'accepted', object, location: activityIdFor(doc.type, object, ident, serial, at) };
-}
-
-// The id the agent gives each kind of activity (lib/core/wire.mjs): an edit by
-// its note and time, a deletion by its note, a boost and an undo as documents
-// in the posts folder, the rest by the actor and serial.
-const SERIAL_NAMED = new Set(['Like', 'Follow', 'Block', 'Add', 'Remove', 'Accept', 'Reject']);
-function activityIdFor(type, object, ident, serial, at) {
-  const actor = ident.actorUrl;
-  if ((type === 'Update' || type === 'Delete') && object && object !== actor) {
-    return type === 'Delete' ? object + '-delete' : object + '-update-' + at.replace(/[^0-9TZ]/g, '');
-  }
-  if ((type === 'Announce' || type === 'Undo') && ident.notesPrefix) return `${ident.notesPrefix}${type.toLowerCase()}-${serial}`;
-  return SERIAL_NAMED.has(type) ? `${actor}#${type.toLowerCase()}-${serial}` : null;
-}
-
-// The account's own changes are made on its manage page, and the one
-// collection a client may add to or take from is the pinned posts.
-function refusedAtTheDoor(doc, ident) {
-  const object = typeof doc.object === 'string' ? doc.object : doc.object?.id || null;
-  const target = typeof doc.target === 'string' ? doc.target : doc.target?.id || null;
-  if (doc.type === 'Move') return 'moving the account is done on its manage page';
-  if ((doc.type === 'Update' || doc.type === 'Delete') && object === ident.actorUrl) {
-    return 'the account itself is changed on its manage page';
-  }
-  if ((doc.type === 'Add' || doc.type === 'Remove') && target !== ident.actorUrl.replace(/actor$/u, 'featured')) {
-    return 'the pinned posts are the one collection an app may add to or take from';
-  }
-  return null;
-}
-
-// The activity types §6 names; anything else with a type is an object the
-// agent wraps in a Create. The same list the dispatcher keeps (lib/client/c2s.mjs).
-const ACTIVITY_TYPES = new Set([
-  'Create', 'Update', 'Delete', 'Follow', 'Like', 'Announce', 'Undo',
-  'Block', 'Add', 'Remove', 'Accept', 'Reject', 'Move',
-]);
-
-// The name the agent would have chosen itself: the day and eight hex characters.
-const mintSlug = () => new Date().toISOString().slice(0, 10) + '-' + crypto.randomBytes(4).toString('hex');
-
-// Where the agent will keep it: public and unlisted posts under notes/, posts
-// for followers or named people under private/ — decided by the addressing,
-// read the way the dispatcher reads it (nothing stated is public).
-const PUBLIC_NAMES = new Set(['https://www.w3.org/ns/activitystreams#Public', 'as:Public', 'Public']);
-function containerFor(doc, ident) {
-  const object = doc.type === 'Create' && doc.object && typeof doc.object === 'object' ? doc.object : doc;
-  const list = (v) => (v == null ? [] : Array.isArray(v) ? v : [v]).map(x => (typeof x === 'string' ? x : x?.id));
-  const to = list(doc.to ?? object.to);
-  const cc = list(doc.cc ?? object.cc);
-  const blind = list(doc.bto ?? object.bto).length + list(doc.bcc ?? object.bcc).length;
-  const open = (!to.length && !cc.length && !blind) || [...to, ...cc].some(a => PUBLIC_NAMES.has(a));
-  return open ? ident.notesPrefix : ident.notesPrefix.replace(/ap\/notes\/$/u, 'ap/private/');
-}
-
-export const _internal = { isBlocked, concernsUsAtEdge, httpUrl, sha256hex };

package/lib/gateway/headers.mjs

@@ -1,49 +0,0 @@
-// headers.mjs — the hardening every front response carries, in one place.
-// Split out of front-core.mjs, which is at its size gate; nothing here knows
-// about routes.
-
-// Every response this file makes, hardened in one place rather than in each of
-// the dozen shapes below.
-//
-// `nosniff` matters most: the front serves user-supplied JSON straight from
-// somebody's pod (the proxied actor and object documents), and without it a
-// browser is free to decide for itself that a document is HTML and run what is
-// inside it. The rest is the same posture the app already has — nothing may be
-// framed, no base tag may be rewritten, no plugin content.
-//
-// A content-security-policy goes on the HTML only: it would mean nothing on a
-// JSON document, and `frame-ancestors` has to be a header rather than a meta
-// tag anyway.
-//
-// `script-src 'self'` is the one that matters, and it is only possible because
-// none of these pages carries inline script any more — each has its own file and
-// its own route above. A policy cannot tell an inline block the author wrote
-// from one an attacker injected, so as long as any inline script has to run,
-// every inline script may.
-//
-// `connect-src` allows https: because the pages sign in against the user's own
-// pod, which is a different origin by definition and not one we can name here.
-export function withSecurityHeaders(headers = {}, body = null) {
-  const ct = String(headers['content-type'] || '');
-  const isHtml = ct.startsWith('text/html');
-  return {
-    ...headers,
-    'x-content-type-options': 'nosniff',
-    'referrer-policy': 'same-origin',
-    'x-frame-options': 'SAMEORIGIN',
-    ...(isHtml && body ? {
-      'content-security-policy': [
-        "default-src 'self'",
-        "script-src 'self'",             // no inline script: see above
-        "style-src 'self' 'unsafe-inline'",
-        "img-src 'self' https: data:",
-        "connect-src 'self' https:",     // sign-in goes to the user's own pod
-        "object-src 'none'",             // no plugin content, ever
-        "base-uri 'none'",               // no rewriting where relative URLs resolve
-        "frame-ancestors 'self'",        // nobody else may frame these pages
-        "form-action 'self'",            // a form here submits here
-      ].join('; '),
-    } : {}),
-  };
-}
-

package/lib/gateway/httpsig.mjs

@@ -1,159 +0,0 @@
-// httpsig.mjs — inbound HTTP-Signature verification, and the verification
-// receipt that carries the outcome from wherever the verify happened (an
-// always-on gateway, or the agent's own endpoint when it is publicly reachable)
-// into the drain, which cannot see the delivery's headers.
-//
-// We SIGN outbound with Fedify draft-cavage (lib/deliver.mjs); we VERIFY with
-// the same library, so the signing-string reconstruction can never drift out
-// of step with what we produce. The one thing Fedify must be prevented from
-// doing on its own is fetching an attacker-named key over an unguarded socket
-// — so the key deref is injected as a loader that goes through safefetch.
-
-import crypto from 'node:crypto';
-import { verifyRequestDetailed } from '@fedify/fedify/sig';
-import { assertPublicUrl, safeFetch, readCapped } from '../shared/safefetch.mjs';
-
-// An SSRF-safe JSON-LD document loader for Fedify's key fetch. The keyId in a
-// delivery is chosen by the sender, so every deref it triggers is untrusted
-// input and must pass the same address policy as the rest of our outbound
-// path. `skipActor` forces a network read past any cache, for the one refetch
-// a rotated key needs.
-export function makeSafeLoader({ getActors = null, fetchImpl = fetch } = {}) {
-  return async (url) => {
-    // A cached actor document short-circuits the network entirely — and it was
-    // only cached after its own origin vouched for its id (intake.fetchAP).
-    if (getActors) {
-      const hit = getActors()[url];
-      if (hit) return { document: hit, documentUrl: url, contextUrl: null };
-    }
-    await assertPublicUrl(url);
-    const res = await safeFetch(url, {
-      headers: { accept: 'application/activity+json, application/ld+json' },
-    }, fetchImpl);
-    if (res.status >= 400) throw new Error(`key fetch ${url} → ${res.status}`);
-    const document = JSON.parse(await readCapped(res));
-    return { document, documentUrl: url, contextUrl: null };
-  };
-}
-
-// Verify a delivery's signature. `request` is a WHATWG Request (the gateway
-// has one natively; an agent-side endpoint builds one from its req). Returns a
-// normalized result both the gateway and the drain understand — never throws
-// on a bad signature, because "unverified" is a routine outcome, not an error.
-//
-// Three outcomes, kept apart because the door acts on them differently. Only a
-// signature we could CHECK and found wrong is a forgery. A key we could not
-// fetch proves nothing: a sender in secure mode — Threads, Mastodon with
-// AUTHORIZED_FETCH — answers this keyless loader 404 or 401, so its deliveries
-// have to degrade to unverified rather than be read as forged.
-export async function verifyHttpSignature(request, { documentLoader, keyCache, timeWindow } = {}) {
-  const hadSig = request.headers.get('signature') != null;
-  let result = null;
-  try {
-    result = await verifyRequestDetailed(request, {
-      documentLoader,
-      ...(keyCache ? { keyCache } : {}),
-      timeWindow: timeWindow ?? { hours: 1 },
-    });
-  } catch {
-    result = null;   // the library itself failed — no more informative than a bad signature
-  }
-  // Which signature the sender used: RFC 9421 carries a Signature-Input
-  // header beside Signature; the cavage draft carries Signature alone. The
-  // library picks the verifier by the same header.
-  const method = request.headers.has('signature-input') ? 'rfc9421' : 'draft-cavage';
-  if (result?.verified) {
-    const key = result.key;
-    return {
-      verified: true, method,
-      keyId: key.id?.href ?? null, actor: key.ownerId?.href ?? null, reason: null,
-      checks: { signature: true, digest: true, dateSkew: true, keyFetched: true },
-    };
-  }
-  const kind = result?.reason?.type;
-  if (!hadSig || kind === 'noSignature') {
-    return {
-      verified: false, method: 'none', keyId: null, actor: null,
-      reason: 'no-signature', checks: { signature: false },
-    };
-  }
-  if (kind === 'keyFetchError') {
-    return {
-      verified: false, method, keyId: null, actor: null,
-      reason: 'key-unfetchable', checks: { signature: false, keyFetched: false },
-    };
-  }
-  return {
-    verified: false, method, keyId: null, actor: null,
-    reason: 'bad-signature', checks: { signature: false },
-  };
-}
-
-// The receipt: what the door concluded, HMAC-stamped so the drain can trust it
-// even while the inbox is still public-Append (a forger without the secret
-// cannot mint `verified: true`). The HMAC is over the receipt minus the hmac
-// field itself, with sorted keys so gateway and drain canonicalize alike.
-//
-// JSON.stringify's replacer ARRAY applies at EVERY level, not just the top: the
-// old canonical() passed the top-level key names, so `checks` — whose own keys
-// are `signature`, `digest`, `dateSkew`, `keyFetched` — serialized as `{}` and
-// was covered by no signature at all. Anything nested was equally unstamped.
-// Sort recursively instead, and exclude `hmac` only where it actually lives.
-function sortedKeys(v) {
-  if (Array.isArray(v)) return v.map(sortedKeys);
-  if (v && typeof v === 'object') {
-    const out = {};
-    for (const k of Object.keys(v).sort()) out[k] = sortedKeys(v[k]);
-    return out;
-  }
-  return v;
-}
-function canonical(obj) {
-  const { hmac, ...rest } = obj;       // eslint-disable-line no-unused-vars
-  return JSON.stringify(sortedKeys(rest));
-}
-
-// What canonical() used to produce. Kept ONLY for verification, and only until
-// every door has been redeployed: a gateway (fedipod.net) and an agent update
-// independently, so for a while a receipt signed by an old door has to keep
-// verifying against a new drain. Receipts are short-lived — one per inbox item,
-// deleted with the item — so this can go once the doors have turned over.
-// Nothing signs with it.
-function canonicalLegacy(obj) {
-  return JSON.stringify(obj, Object.keys(obj).filter(k => k !== 'hmac').sort());
-}
-
-export function makeReceipt(result, { gateway = null } = {}) {
-  return {
-    v: 1,
-    verified: !!result.verified,
-    method: result.method,
-    keyId: result.keyId,
-    actor: result.actor,
-    checks: result.checks,
-    reason: result.reason,
-    gateway,
-  };
-}
-
-export function signReceipt(receipt, secret) {
-  const hmac = crypto.createHmac('sha256', secret).update(canonical(receipt)).digest('base64');
-  return { ...receipt, hmac };
-}
-
-// True only when the receipt carries a valid HMAC for `secret`. A missing
-// secret, a missing hmac, or a mismatch all read as "not ours" → the drain
-// treats the receipt as absent (today's unverified behavior). timingSafeEqual
-// over equal-length buffers; unequal lengths are a straight mismatch.
-export function verifyReceipt(receipt, secret) {
-  if (!receipt || typeof receipt !== 'object' || !receipt.hmac || !secret) return false;
-  let given;
-  try { given = Buffer.from(receipt.hmac, 'base64'); } catch { return false; }
-  const matches = (text) => {
-    const expected = crypto.createHmac('sha256', secret).update(text).digest();
-    return given.length === expected.length && crypto.timingSafeEqual(given, expected);
-  };
-  // The current stamp first; the pre-2026-09-09 one second, for receipts a door
-  // that has not been redeployed yet is still writing. See canonicalLegacy.
-  return matches(canonical(receipt)) || matches(canonicalLegacy(receipt));
-}

package/lib/gateway/notices.mjs

@@ -1,84 +0,0 @@
-// notices.mjs — notices from whoever runs the front, to every account here.
-//
-// The operator writes them on the /notices page, proved as the admin the way
-// the roster is; every page of ours asks GET /api/notices once per load and
-// shows a bell when there are any. A notice is a title, a plain-text body and
-// a time. The body is never markup: the pages render it as text.
-//
-// Kept beside the directory, in a store the adapter supplies:
-//   listNotices() -> { id: notice }     putNotice(id, notice)     deleteNotice(id)
-// A front that supplies none has no notices to offer, and says so.
-
-import crypto from 'node:crypto';
-
-const TITLE_MAX = 120;
-const BODY_MAX = 4000;
-const NOTICES_EDGE_SECONDS = 60;
-
-const clean = (v, max) => String(v ?? '').replace(/\r\n?/gu, '\n').trim().slice(0, max);
-const newest = (a, b) => String(b.at || '').localeCompare(String(a.at || ''));
-
-export async function listNotices(ctx) {
-  const all = ctx.listNotices ? await ctx.listNotices() : {};
-  return Object.values(all || {}).filter(Boolean).sort(newest);
-}
-
-// GET is public: what every account is shown. POST is the admin's alone. The
-// /notices page is where the admin writes them; it signs in like the roster.
-// Returns a response, or null when the path is neither.
-export async function routeNoticesApi(request, pathname, ctx, { j, verifyPodToken, publicFor, notFound }) {
-  // The two admin pages: the roster (who has accounts here) and the notices.
-  // Each signs in and calls its API; a deploy with no admin supplies no page.
-  const page = pathname === '/notices' ? ctx.noticesPage : pathname === '/roster' ? ctx.adminPage : undefined;
-  if (page !== undefined) {
-    if (request.method !== 'GET' && request.method !== 'HEAD') return { status: 405, headers: {}, body: '' };
-    if (!page) return notFound();
-    return { status: 200, headers: { 'content-type': 'text/html; charset=utf-8' }, body: page };
-  }
-  if (pathname !== '/api/notices') return null;
-  const open = { 'access-control-allow-origin': '*' };
-  if (request.method === 'OPTIONS') {
-    return { status: 204, headers: { ...open, 'access-control-allow-methods': 'GET, OPTIONS',
-      'access-control-allow-headers': 'Accept', allow: 'GET, POST, OPTIONS' }, body: null };
-  }
-  if (request.method === 'GET') {
-    if (!ctx.listNotices) return j(501, { error: 'this front keeps no notices' });
-    const out = j(200, { notices: await listNotices(ctx) });
-    Object.assign(out.headers, open, publicFor(NOTICES_EDGE_SECONDS));
-    return out;
-  }
-  if (request.method !== 'POST') return { status: 405, headers: {}, body: '' };
-  if (!ctx.putNotice || !ctx.deleteNotice || !ctx.adminWebId) return j(501, { error: 'this front keeps no notices' });
-  const webid = await verifyPodToken(request, pathname, ctx.verifier);
-  if (!webid) return j(401, { error: 'a Solid-OIDC token is required' });
-  if (webid !== ctx.adminWebId) return j(403, { error: 'that WebID is not the admin of this front' });
-  let body;
-  try { body = JSON.parse(await request.clone().text()); } catch { return j(400, { error: 'bad JSON' }); }
-  const action = String(body.action || '');
-  const all = (ctx.listNotices ? await ctx.listNotices() : {}) || {};
-  if (action === 'delete') {
-    const id = String(body.id || '');
-    if (!all[id]) return j(404, { error: 'no such notice' });
-    await ctx.deleteNotice(id);
-    console.log(`front: notice ${id} deleted by the admin`);
-    return j(200, { ok: true, id, deleted: true });
-  }
-  if (action !== 'create' && action !== 'update') return j(400, { error: 'action must be create, update or delete' });
-  const title = clean(body.title, TITLE_MAX);
-  const text = clean(body.body, BODY_MAX);
-  if (!title) return j(400, { error: 'a title is required' });
-  if (!text) return j(400, { error: 'a body is required' });
-  const now = new Date().toISOString();
-  let notice;
-  if (action === 'create') {
-    const id = `${Date.now().toString(36)}-${crypto.randomBytes(4).toString('hex')}`;
-    notice = { id, title, body: text, at: now, updatedAt: now };
-  } else {
-    const prior = all[String(body.id || '')];
-    if (!prior) return j(404, { error: 'no such notice' });
-    notice = { ...prior, title, body: text, updatedAt: now };
-  }
-  await ctx.putNotice(notice.id, notice);
-  console.log(`front: notice ${notice.id} ${action}d by the admin`);
-  return j(action === 'create' ? 201 : 200, { ok: true, notice });
-}