fedipod-server 0.29.0 → 0.31.0

package/lib/session/fedi-login.mjs

@@ -1,123 +0,0 @@
-// fedi-login.mjs — sign a person in at their own Solid pod from their
-// Fediverse address, and bring them back to where they were.
-//
-//   import { fediLogin } from './fedi-login.mjs';
-//   const login = fediLogin({ dbName: 'my-app-oidc', clientName: 'My app' });
-//
-//   await login.login('@mei@fedipod.net');   // leaves for the pod's login page
-//   await login.resume();                     // on every page load: finishes a
-//                                             // login in progress and returns them
-//   const s = await login.getSession();       // null, or { webId, issuer, fetch, signOut }
-//
-// How an address becomes a login page. WebFinger at the address's host names
-// the actor and its aliases. An origin among those that answers
-// /.well-known/openid-configuration is the login provider, or says which is
-// (a pod host redirects there). Failing that, the WebID — the URL typed, or
-// the ones the actor names as its own — is read as JSON-LD and its
-// solid:oidcIssuer is the provider. A Mastodon address has neither, and the
-// person is told so in words.
-//
-// No imports but the session engine beside it, no Node built-ins, nothing
-// named after the application that uses it.
-import { solidOidcSession } from './oidc-session.mjs';
-
-const OIDC_ISSUER = 'http://www.w3.org/ns/solid/terms#oidcIssuer';
-
-/** `@mei@host`, `mei@host`, or a WebID or actor URL. Null when it is neither. */
-export function parseAddress(input) {
-  const t = String(input || '').trim();
-  if (/^https?:\/\//u.test(t)) { try { return { url: new URL(t).href, host: new URL(t).host }; } catch { return null; } }
-  const m = /^@?([^@\s/]+)@([^@\s/]+)$/u.exec(t);
-  if (!m) return null;
-  const name = m[1]; const host = m[2].toLowerCase();
-  return { name, host, at: `@${name}@${host}` };
-}
-
-export function fediLogin({ dbName, clientName, redirectUri = null, fetch: f = globalThis.fetch?.bind(globalThis) } = {}) {
-  const oidc = solidOidcSession({ dbName, clientName });
-  const get = (url, accept) => f(url, { headers: { accept }, redirect: 'follow' });
-  const json = (url, accept) => get(url, accept).then((r) => (r.ok ? r.json() : null)).catch(() => null);
-  const here = () => (globalThis.location ? location.origin + location.pathname : null);
-
-  const discovery = (base) => json(`${String(base).replace(/\/+$/, '')}/.well-known/openid-configuration`, 'application/json');
-  const isProvider = (cfg) => !!(cfg?.issuer && cfg.authorization_endpoint);
-  const origin = (u) => { try { return new URL(u).origin; } catch { return null; } };
-
-  // The issuer a WebID document names, read as the expanded JSON-LD a pod answers.
-  const issuerOfWebId = async (webId) => {
-    const doc = await json(webId, 'application/ld+json');
-    const nodes = Array.isArray(doc) ? doc : (doc?.['@graph'] || (doc ? [doc] : []));
-    const me = nodes.find((n) => n?.['@id'] === webId && n[OIDC_ISSUER]) || nodes.find((n) => n?.[OIDC_ISSUER]);
-    const v = [].concat(me?.[OIDC_ISSUER] || [])[0];
-    return typeof v === 'string' ? v : (v?.['@id'] || null);
-  };
-
-  /** Where an address signs in: { address, actor, origin, issuer, webId? }.
-   *  Throws, in plain words, when the host does not know the address or
-   *  nothing about it names a login provider. */
-  async function resolve(address) {
-    const a = parseAddress(address);
-    if (!a) throw new Error('an address looks like @you@your.server');
-    let actor = null;
-    const urls = [];
-    if (a.url) urls.push(a.url);
-    else {
-      const r = await get(`https://${a.host}/.well-known/webfinger?resource=${encodeURIComponent(`acct:${a.name}@${a.host}`)}`,
-        'application/jrd+json, application/json').catch(() => null);
-      if (!r?.ok) throw new Error(`${a.host} does not know ${a.at}`);
-      const jrd = await r.json().catch(() => null);
-      const self = (jrd?.links || []).find((l) => l.rel === 'self' && /activity\+json|ld\+json/u.test(l.type || ''));
-      actor = self?.href || null;
-      // The aliases first: at a Gateway they name the actor on the pod itself,
-      // and the pod is where the login is.
-      for (const u of [...(jrd?.aliases || []), ...(actor ? [actor] : [])]) if (typeof u === 'string') urls.push(u);
-      if (!urls.length) throw new Error(`${a.host} did not say where ${a.at} lives`);
-    }
-    const found = (extra) => ({ address: a.at || a.url, actor, ...extra });
-
-    // 1. An origin that is the login provider, or says which is.
-    for (const o of [...new Set(urls.map(origin).filter(Boolean))]) {
-      const cfg = await discovery(o);
-      if (isProvider(cfg)) return found({ origin: o, issuer: cfg.issuer });
-    }
-    // 2. The WebID: the URL typed, or the ones the actor names as its own.
-    const webIds = a.url ? [a.url] : [];
-    if (actor) {
-      const doc = await json(actor, 'application/activity+json');
-      for (const u of [].concat(doc?.alsoKnownAs || [])) if (typeof u === 'string') webIds.push(u);
-    }
-    for (const webId of webIds) {
-      const issuer = await issuerOfWebId(webId);
-      if (issuer && isProvider(await discovery(issuer))) return found({ origin: origin(webId), issuer, webId });
-    }
-    throw new Error(`${a.host} is not a Solid pod, so there is no pod login to send you to`);
-  }
-
-  /** Everything `login` does short of leaving the page: returns the found pod
-   *  and the `authorizationUrl` to send the person to. */
-  async function startLogin(address, { returnTo = globalThis.location?.href || null, redirectUri: ru = redirectUri || here() } = {}) {
-    const found = await resolve(address);
-    const { authorizationUrl } = await oidc.beginLogin({ issuer: found.issuer, redirectUri: ru, returnTo });
-    return { ...found, authorizationUrl, returnTo };
-  }
-
-  /** Send the person to their pod's login page. They come back to `redirectUri`
-   *  (this page, unless set) and `resume` there returns them to `returnTo`
-   *  (where they were, unless set). */
-  async function login(address, opts) {
-    const s = await startLogin(address, opts);
-    location.href = s.authorizationUrl;
-    return s;
-  }
-
-  /** Call on every page load. Finishes a login the person is coming back from
-   *  and returns them to where they were; null when no login is in progress. */
-  async function resume({ currentUrl = globalThis.location?.href, go = (u) => location.replace(u) } = {}) {
-    const session = await oidc.completeLogin({ currentUrl });
-    if (!session) return null;
-    if (session.returnTo && session.returnTo !== currentUrl) go(session.returnTo);
-    return session;
-  }
-
-  return { resolve, startLogin, login, resume, getSession: oidc.getSession, signOut: oidc.signOut };
-}

package/lib/session/oidc-session.mjs

@@ -1,233 +0,0 @@
-// oidc-session.mjs — Solid-OIDC login for a browser page, with a secure,
-// durable, worker-visible session.
-//
-// The redirect handshake (authorization-code + PKCE) runs in the page. The
-// session it yields — a DPoP keypair whose private half is NON-EXTRACTABLE, plus
-// the refresh token, the token endpoint and the WebID — is kept in IndexedDB.
-// IndexedDB survives a browser restart and is readable by a service worker,
-// and a non-extractable key can sign but never be read out, even by injected
-// script.
-//
-//   import { solidOidcSession } from 'solid-oidc-session/oidc-session.mjs';
-//   const oidc = solidOidcSession({ dbName: 'my-app-oidc', clientName: 'My app' });
-//
-// Page:   const { authorizationUrl } = await oidc.beginLogin({ issuer, redirectUri });
-//         location.href = authorizationUrl;                      // ... redirect ...
-//         await oidc.completeLogin({ currentUrl: location.href });  // on return
-// Anywhere (page or worker, SAME dbName):
-//         const session = await oidc.getSession();  // { webId, issuer, fetch, refresh, signOut } | null
-//
-// No imports, no Node built-ins, nothing named after the application that
-// uses it: IndexedDB, WebCrypto and fetch are all it needs.
-
-const STORE = 'session';
-const b64u = (buf) => btoa(String.fromCharCode(...new Uint8Array(buf))).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
-const enc = (o) => b64u(new TextEncoder().encode(JSON.stringify(o)));
-const sha256 = (s) => crypto.subtle.digest('SHA-256', new TextEncoder().encode(s));
-const rand = (n = 32) => b64u(crypto.getRandomValues(new Uint8Array(n)));
-
-async function dpopKey() { return crypto.subtle.generateKey({ name: 'ECDSA', namedCurve: 'P-256' }, false, ['sign']); }
-async function publicJwk(pair) { const j = await crypto.subtle.exportKey('jwk', pair.publicKey); return { kty: j.kty, crv: j.crv, x: j.x, y: j.y }; }
-async function dpopProof(pair, jwk, htm, htu, ath) {
-  const header = { typ: 'dpop+jwt', alg: 'ES256', jwk };
-  const payload = { htm, htu: htu.split('#')[0], jti: crypto.randomUUID(), iat: Math.floor(Date.now() / 1000), ...(ath ? { ath } : {}) };
-  const data = `${enc(header)}.${enc(payload)}`;
-  const sig = await crypto.subtle.sign({ name: 'ECDSA', hash: 'SHA-256' }, pair.privateKey, new TextEncoder().encode(data));
-  return `${data}.${b64u(sig)}`;
-}
-const jwtPayload = (jwt) => { try { return JSON.parse(new TextDecoder().decode(Uint8Array.from(atob(jwt.split('.')[1].replace(/-/g, '+').replace(/_/g, '/')), (c) => c.charCodeAt(0)))); } catch { return {}; } };
-
-async function discover(issuer) {
-  const res = await fetch(`${issuer.replace(/\/+$/, '')}/.well-known/openid-configuration`, { headers: { accept: 'application/json' } });
-  if (!res.ok) throw new Error(`OIDC discovery failed at ${issuer} (HTTP ${res.status})`);
-  return res.json();
-}
-async function registerClient(cfg, redirectUri, clientName) {
-  const res = await fetch(cfg.registration_endpoint, {
-    method: 'POST', headers: { 'content-type': 'application/json' },
-    body: JSON.stringify({ client_name: clientName, redirect_uris: [redirectUri], token_endpoint_auth_method: 'none',
-      grant_types: ['authorization_code', 'refresh_token'], response_types: ['code'], application_type: 'web', scope: 'openid webid offline_access' }),
-  });
-  if (!res.ok) throw new Error(`client registration failed (HTTP ${res.status})`);
-  return (await res.json()).client_id;
-}
-
-/**
- * One session store. `dbName` is the IndexedDB database the session lives in:
- * a page and its service worker must pass the same name to see the same
- * sign-in, and two apps on one origin pass different names to keep theirs
- * apart. `clientName` is what the pod's login screen shows the person.
- */
-export function solidOidcSession({ dbName = 'solid-oidc-session', clientName = 'Solid app' } = {}) {
-  function idb() {
-    return new Promise((res, rej) => {
-      const r = indexedDB.open(dbName, 1);
-      r.onupgradeneeded = () => r.result.createObjectStore(STORE);
-      r.onsuccess = () => res(r.result);
-      r.onerror = () => rej(r.error);
-    });
-  }
-  async function idbGet(key) {
-    const db = await idb();
-    return new Promise((res, rej) => { const t = db.transaction(STORE).objectStore(STORE).get(key); t.onsuccess = () => res(t.result); t.onerror = () => rej(t.error); });
-  }
-  async function idbPut(key, val) {
-    const db = await idb();
-    return new Promise((res, rej) => { const t = db.transaction(STORE, 'readwrite').objectStore(STORE).put(val, key); t.onsuccess = () => res(); t.onerror = () => rej(t.error); });
-  }
-  async function idbDel(key) {
-    const db = await idb();
-    return new Promise((res, rej) => { const t = db.transaction(STORE, 'readwrite').objectStore(STORE).delete(key); t.onsuccess = () => res(); t.onerror = () => rej(t.error); });
-  }
-
-  /** Begin login: prepare PKCE + a non-extractable DPoP key, stash the pending
-   *  state, and return the authorization URL for the caller to navigate to. */
-  async function beginLogin({ issuer, redirectUri, clientName: name = clientName, returnTo = null }) {
-    const cfg = await discover(issuer);
-    const client_id = await registerClient(cfg, redirectUri, name);
-    const pair = await dpopKey();
-    const verifier = rand(48);
-    const challenge = b64u(await sha256(verifier));
-    const state = rand(16);
-    await idbPut('pending', { issuer, client_id, redirectUri, verifier, state, pair, returnTo,
-      tokenEndpoint: cfg.token_endpoint, authorizationEndpoint: cfg.authorization_endpoint,
-      revocationEndpoint: cfg.revocation_endpoint || null });
-    const url = new URL(cfg.authorization_endpoint);
-    for (const [k, v] of Object.entries({ client_id, redirect_uri: redirectUri, response_type: 'code',
-      scope: 'openid webid offline_access', code_challenge: challenge, code_challenge_method: 'S256', state, prompt: 'consent' })) url.searchParams.set(k, v);
-    return { authorizationUrl: url.href };
-  }
-
-  /** Complete login from the redirect back. Exchanges the code (DPoP + PKCE),
-   *  stores the durable session, and returns it. Returns null if there is no code. */
-  async function completeLogin({ currentUrl }) {
-    const u = new URL(currentUrl);
-    const code = u.searchParams.get('code');
-    const state = u.searchParams.get('state');
-    if (!code) return null;
-    const p = await idbGet('pending');
-    if (!p || p.state !== state) throw new Error('login state mismatch');
-    const jwk = await publicJwk(p.pair);
-    const res = await fetch(p.tokenEndpoint, {
-      method: 'POST',
-      headers: { 'content-type': 'application/x-www-form-urlencoded', dpop: await dpopProof(p.pair, jwk, 'POST', p.tokenEndpoint) },
-      body: new URLSearchParams({ grant_type: 'authorization_code', code, redirect_uri: p.redirectUri, client_id: p.client_id, code_verifier: p.verifier }),
-    });
-    const tok = await res.json().catch(() => ({}));
-    if (!res.ok || !tok.access_token) throw new Error(`token exchange failed (HTTP ${res.status}): ${tok.error || ''}`);
-    const webId = jwtPayload(tok.access_token).webid || jwtPayload(tok.id_token || '').webid || null;
-    const session = { issuer: p.issuer, client_id: p.client_id, tokenEndpoint: p.tokenEndpoint, pair: p.pair,
-      // Where to hand the refresh token back at sign-out. Kept on the session
-      // because discovery is a network round trip and sign-out should not need
-      // one — see signOut().
-      revocationEndpoint: p.revocationEndpoint || null,
-      refreshToken: tok.refresh_token || null, accessToken: tok.access_token,
-      expiresAt: Date.now() + Math.max(30, (tok.expires_in || 300)) * 1000, webId };
-    await idbPut('session', session);
-    await idbDel('pending');
-    // `returnTo` rides only on the handle this call returns: where the person
-    // was when they left for the login page, for the caller to send them back.
-    return Object.assign(sessionHandle(session), p.returnTo ? { returnTo: p.returnTo } : {});
-  }
-
-  /** Restore the session from IndexedDB — works in the page and the worker. */
-  async function getSession() {
-    const s = await idbGet('session');
-    return s ? sessionHandle(s) : null;
-  }
-
-  /**
-   * Sign out, and tell the issuer.
-   *
-   * Dropping the row locally leaves the REFRESH TOKEN alive at the pod for its
-   * full life — signing out of a shared or borrowed browser would clear the
-   * screen and nothing else, and anyone who had copied the token could go on
-   * minting access tokens with it. RFC 7009: hand it back.
-   *
-   * Best effort, and the local teardown happens either way: an issuer that is
-   * unreachable, or that publishes no revocation endpoint, must not be able to
-   * keep somebody signed in.
-   */
-  async function signOut() {
-    const s = await idbGet('session').catch(() => null);
-    if (s?.revocationEndpoint && s.refreshToken) {
-      try {
-        await fetch(s.revocationEndpoint, {
-          method: 'POST',
-          headers: { 'content-type': 'application/x-www-form-urlencoded' },
-          body: new URLSearchParams({
-            token: s.refreshToken, token_type_hint: 'refresh_token', client_id: s.client_id,
-          }),
-        });
-      } catch { /* told if we could; leaving is not conditional on being heard */ }
-    }
-    await idbDel('session');
-    await idbDel('pending');
-  }
-
-  function sessionHandle(s) {
-    let { accessToken, expiresAt, refreshToken } = s;
-    const jwkP = publicJwk(s.pair);
-    const refresh = async () => {
-      if (!refreshToken) throw new Error('session expired and there is no refresh token — sign in again');
-      const jwk = await jwkP;
-      let res;
-      try {
-        res = await fetch(s.tokenEndpoint, {
-          method: 'POST', headers: { 'content-type': 'application/x-www-form-urlencoded', dpop: await dpopProof(s.pair, jwk, 'POST', s.tokenEndpoint) },
-          body: new URLSearchParams({ grant_type: 'refresh_token', refresh_token: refreshToken, client_id: s.client_id, scope: 'openid webid offline_access' }),
-        });
-      } catch (e) {
-        // A renewal that never reached the server is not a refused one: the
-        // session is still good, and saying "your pod refused the write" about
-        // it sends whoever reads it looking in the wrong place. Under load a
-        // server refuses the token endpoint first, and a refusal with no CORS
-        // headers arrives here as the browser's bare "Failed to fetch".
-        throw new Error(`${e.message} — renewing your sign-in at ${new URL(s.tokenEndpoint).host}`);
-      }
-      const tok = await res.json().catch(() => ({}));
-      if (res.status === 429) {
-        throw new Error(`${new URL(s.tokenEndpoint).host} is asking us to slow down — your sign-in could not be renewed just now`);
-      }
-      if (!res.ok || !tok.access_token) { await idbDel('session'); throw new Error('refresh failed — sign in again'); }
-      accessToken = tok.access_token;
-      expiresAt = Date.now() + Math.max(30, (tok.expires_in || 300)) * 1000;
-      if (tok.refresh_token) refreshToken = tok.refresh_token;
-      // Re-read before writing back. There is ONE 'session' row, and this handle
-      // closed over the session it was made from — so a refresh that was already
-      // in flight when the user signed in as somebody else would put the OLD
-      // identity back, silently, over the new one. Only write if the row is still
-      // the session this handle belongs to.
-      const now = await idbGet('session');
-      if (now && now.webId !== s.webId) {
-        throw new Error('signed in as somebody else while this session was refreshing');
-      }
-      await idbPut('session', { ...s, accessToken, expiresAt, refreshToken });
-    };
-    const send = async (url, init) => {
-      const jwk = await jwkP;
-      const ath = b64u(await sha256(accessToken));
-      const headers = { ...(init.headers || {}), authorization: `DPoP ${accessToken}`, dpop: await dpopProof(s.pair, jwk, (init.method || 'GET'), url, ath) };
-      return fetch(url, { ...init, headers });
-    };
-    const authFetch = async (url, init = {}) => {
-      if (Date.now() > expiresAt - 30_000) await refresh();
-      const res = await send(url, init);
-      // A token the pod REFUSES is not only ever an expired one: a pod that
-      // restarted, a clock that drifted, a token the server stopped recognising
-      // all answer 401 while the clock here still says the token is good — so the
-      // renewal above never fires and every call fails from then on. Renew once
-      // and ask again.
-      if (res.status === 401 && refreshToken) {
-        try { await refresh(); } catch { return res; }
-        return send(url, init);
-      }
-      return res;
-    };
-    // `issuer` so a page that cannot renew can send the person back to the right
-    // login without asking them for their address again.
-    return { webId: s.webId, issuer: s.issuer, fetch: authFetch, refresh, signOut };
-  }
-
-  return { beginLogin, completeLogin, getSession, signOut };
-}

package/lib/session/package.json

@@ -1,49 +0,0 @@
-{
-  "name": "fediverse-account",
-  "version": "0.2.1",
-  "description": "Type a Fediverse handle or a WebID and get back an account you can act with: post, read its timeline, follow, reply, favourite, boost. Works out whether the account lives on a Mastodon-family server or on a Solid pod through FediPod, sends the person to sign in there, brings them back to where they were, and speaks to whichever it is.",
-  "type": "module",
-  "license": "MIT",
-  "author": "Jeff Zucker",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/jeff-zucker/FediPod.git",
-    "directory": "lib/session"
-  },
-  "homepage": "https://github.com/jeff-zucker/FediPod/tree/main/lib/session#readme",
-  "keywords": [
-    "fediverse",
-    "activitypub",
-    "mastodon",
-    "solid",
-    "solid-oidc",
-    "webid",
-    "login",
-    "oauth",
-    "fedipod"
-  ],
-  "files": [
-    "fedi-account.mjs",
-    "fedi-login.mjs",
-    "oidc-session.mjs",
-    "README.md"
-  ],
-  "exports": {
-    ".": "./fedi-account.mjs",
-    "./fedi-account.mjs": "./fedi-account.mjs",
-    "./fedi-login.mjs": "./fedi-login.mjs",
-    "./oidc-session.mjs": "./oidc-session.mjs"
-  },
-  "scripts": {
-    "prepublishOnly": "node ../../scripts/check-pod-calls.mjs"
-  },
-  "dependencies": {},
-  "peerDependencies": {
-    "jsonld": "^9.0.0"
-  },
-  "peerDependenciesMeta": {
-    "jsonld": {
-      "optional": true
-    }
-  }
-}

package/lib/shared/guard.mjs

@@ -1,213 +0,0 @@
-// guard.mjs — the browser-facing firewall. A loopback HTTP server is
-// reachable by any web page the user visits, and DNS rebinding lets such a
-// page keep its own origin while its requests land here — so binding to
-// loopback is NOT an access control. Two header checks close that door:
-//
-//   Host   must name a loopback authority we expect (or an operator-declared
-//          host) — a rebound `evil.example` fails here.
-//   Origin when present, must be one of those same authorities — a
-//          cross-origin fetch/WebSocket fails here even without rebinding.
-//
-// AP_ALLOWED_HOSTS (comma-separated host[:port]) extends the set for
-// deliberate exposure (tailnet name, reverse-proxy domain).
-//
-// An agent also answers at <handle>.localhost, so each identity on a machine
-// gets an origin of its own — one browser storage jar per actor, instead of
-// every agent sharing localhost:<port> and asking which instance you meant.
-// `.localhost` is reserved by RFC 6761 and cannot be delegated in public DNS,
-// so it is not the rebinding hole this file exists to close; the label comes
-// from config, never from a request header, and matching stays exact-string.
-
-const LOOPBACK_NAMES = ['localhost', '127.0.0.1', '[::1]', '::1'];
-
-// A handle earns a named origin only when it is already a clean DNS label.
-// Nothing is rewritten: a mangled name would be a different origin from the
-// one we printed, and the user would land on a 403 with no way to see why.
-export function hostLabel(handle) {
-  const s = String(handle || '').toLowerCase();
-  return /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/.test(s) ? s : null;
-}
-
-// The authorities that are this machine, and only this machine.
-//
-// The port-less form is a DIFFERENT origin: `http://localhost` means port 80
-// and `https://localhost` means 443. Emitting it whatever port we are on put
-// every other local server's pages inside our own origin set — a page served
-// from 127.0.0.1:80 sends `Origin: http://localhost`, which passed the Origin
-// check, and a form POST needs no preflight to reach a write route. So the
-// bare form is emitted only when it really is this server's own authority.
-export function loopbackAuthorities(port, labels = []) {
-  const out = [];
-  const bare = Number(port) === 80 || Number(port) === 443;
-  for (const name of LOOPBACK_NAMES) {
-    out.push(`${name}:${port}`);
-    if (bare) out.push(name);
-  }
-  for (const l of labels) {
-    const label = hostLabel(l);
-    if (!label) continue;
-    out.push(`${label}.localhost:${port}`);
-    if (bare) out.push(`${label}.localhost`);
-  }
-  return out;
-}
-
-const LOOPBACK_ADDRESSES = new Set(['127.0.0.1', '::1', '::ffff:127.0.0.1']);
-
-// Where the connection came FROM, as opposed to which authority it asked for.
-// Both listeners bind loopback, so today this is true of everything that
-// arrives — including a request relayed by a same-host reverse proxy, which is
-// exactly why it is not what keeps an exposed agent safe (see exposureProblem).
-// It is here so that binding to another address later cannot silently turn the
-// local-only routes into public ones.
-export function isLoopbackSocket(req) {
-  const a = req?.socket?.remoteAddress;
-  if (!a) return false;
-  return LOOPBACK_ADDRESSES.has(a) || a.startsWith('127.');
-}
-
-// AP_ALLOWED_HOSTS is the documented way to put the agent on a tailnet name or
-// behind a reverse proxy. Doing so removes every transport signal that told the
-// operator apart from everyone else: the listeners bind loopback, so exposure
-// means something on this machine is relaying, and a stock
-// `proxy_pass http://127.0.0.1:<port>;` rewrites Host to a loopback authority
-// and connects from loopback. Every caller then looks local, which is what the
-// local-only routes and the password-less authorize path were trusting.
-//
-// A secret is all that is left, and AP_GATE_TOKEN is the one every route
-// checks — a uiPassword guards the OAuth login and nothing else. Returns a
-// reason string when the agent must not start, or null.
-export function exposureProblem({ allowedHosts, gateToken } = {}) {
-  const exposed = String(allowedHosts || '').split(',').map(s => s.trim()).filter(Boolean);
-  if (!exposed.length || gateToken) return null;
-  return `AP_ALLOWED_HOSTS names ${exposed.join(', ')}, but AP_GATE_TOKEN is not set.\n`
-    + 'An exposed agent cannot tell your requests from anyone else\'s — a reverse proxy\n'
-    + 'rewrites Host to a loopback authority and connects from loopback, so every caller\n'
-    + 'looks like this machine. Without a shared secret that means the admin API, the\n'
-    + 'setup routes and the OAuth mint answer whoever reaches the address.\n\n'
-    + 'Either set AP_GATE_TOKEN to a secret (send it as the x-dk-token header, or visit\n'
-    + '?dk-token=<secret> once to be given the cookie), or unset AP_ALLOWED_HOSTS.';
-}
-
-export function allowedAuthorities(port, labels = []) {
-  const extra = String(process.env.AP_ALLOWED_HOSTS || '')
-    .split(',').map(s => s.trim().toLowerCase()).filter(Boolean);
-  return new Set([...loopbackAuthorities(port, labels), ...extra]);
-}
-
-// The set has to stay live. startAdmin runs before connect, so an unconfigured
-// agent has no handle yet — and MastoApi consults this same object to decide
-// whether an OAuth redirect_uri is one of ours, so a snapshot taken at listen
-// time would reject the named origin for the life of the process.
-export class Authorities {
-  constructor(port, handle = null, extraPorts = []) {
-    this.port = port;
-    // The https listener's port: same machine, same names, second authority.
-    this.extraPorts = extraPorts.filter(Boolean);
-    this.label = null;
-    this.set = null;
-    this.local = null;
-    this.rebuild();
-    this.setHandle(handle);
-  }
-
-  rebuild() {
-    const labels = this.labels();
-    this.set = allowedAuthorities(this.port, labels);
-    this.local = new Set(loopbackAuthorities(this.port, labels));
-    for (const p of this.extraPorts) {
-      for (const a of loopbackAuthorities(p, labels)) { this.set.add(a); this.local.add(a); }
-    }
-  }
-
-  // Returns true when the named origin actually changed.
-  setHandle(handle) {
-    const label = hostLabel(handle);
-    if (label === this.label) return false;
-    this.label = label;
-    this.rebuild();
-    return true;
-  }
-
-  labels() { return this.label ? [this.label] : []; }
-
-  has(authority) { return this.set.has(authority); }
-
-  // Machine-local, ignoring AP_ALLOWED_HOSTS: an agent deliberately exposed
-  // under a tailnet name answers the fediverse there, but must not offer
-  // account creation or config editing over it.
-  isLocal(host) { return this.local.has(String(host || '').toLowerCase()); }
-
-  // The Host header says which authority the client asked for; the socket says
-  // where it came from. A local-only route wants both to agree. Neither
-  // survives a same-host proxy on its own — exposureProblem is what covers
-  // that case — but requiring both costs nothing and closes the plain forgery.
-  isLocalRequest(req) {
-    return isLoopbackSocket(req) && this.isLocal(req?.headers?.host);
-  }
-}
-
-// The authority set for an identity served by somebody else's server: one
-// origin, the pod's own, and no notion of "this machine" at all. Nothing is
-// local here — a request from the next room and one from the far side of the
-// world arrive the same way — so the routes that were local-only are guarded
-// by the door's secret instead.
-export class FixedAuthorities {
-  constructor(origin) {
-    const u = new URL(origin);
-    this.host = u.host.toLowerCase();
-    this.port = Number(u.port) || (u.protocol === 'https:' ? 443 : 80);
-    this.secure = u.protocol === 'https:';
-    this.label = null;
-    this.set = new Set([this.host]);
-    this.extraPorts = [];
-  }
-
-  rebuild() { /* one origin, fixed at construction */ }
-
-  setHandle() { return false; }        // the origin does not follow the handle
-
-  labels() { return []; }
-
-  has(authority) { return this.set.has(String(authority || '').toLowerCase()); }
-
-  isLocal() { return false; }
-
-  isLocalRequest() { return false; }
-
-  // What a page here may open a streaming socket to. Built from the pod's own
-  // origin: the loopback list would leave the socket refused by the page's own
-  // content-security-policy, with nothing in the console to say why.
-  wsAuthorities() { return [`${this.secure ? 'wss' : 'ws'}://${this.host}`]; }
-}
-
-const authorityOf = (originHeader) => {
-  try { return new URL(originHeader).host.toLowerCase(); } catch { return null; }
-};
-
-// Returns null when the request is acceptable, else a reason string.
-// `ignoreOrigin` keeps the Host check (what stops DNS rebinding) while letting
-// a foreign Origin through — the bearer-gated API answers any origin the way
-// a Mastodon server does, and a websocket with a live token likewise.
-export function checkRequest(req, allowed, { ignoreOrigin = false } = {}) {
-  const host = String(req.headers.host || '').toLowerCase();
-  if (!host || !allowed.has(host)) return `unexpected Host "${host || '(none)'}"`;
-  if (ignoreOrigin) return null;
-  const origin = req.headers.origin;
-  // 'null' is what a sandboxed/file: page sends — never trusted here.
-  if (origin && origin !== 'null') {
-    const oh = authorityOf(origin);
-    if (!oh || !allowed.has(oh)) return `cross-origin request from "${origin}"`;
-  } else if (origin === 'null') {
-    return 'opaque origin';
-  }
-  return null;
-}
-
-// Same-site navigations and typed URLs only — blocks a visited page from
-// driving a top-level navigation into an endpoint that mints credentials.
-// Absent header (older browsers, curl) is allowed: Host/Origin still apply.
-export function isCrossSiteNavigation(req) {
-  const site = req.headers['sec-fetch-site'];
-  return site === 'cross-site';
-}

package/lib/shared/links.mjs

@@ -1,9 +0,0 @@
-// links.mjs — reading RFC 8288 Link headers.
-//
-// The implementation moved into the pod library (lib/pod/links.mjs), which has
-// to carry it: that library runs unmodified in a service worker and may not
-// import anything above its own directory. This path stays so the dozen
-// importers around the project do not move, and so there is still one obvious
-// place to look for "how does this read a Link header".
-
-export { linkTargets, REL } from '../pod/links.mjs';