fedipod-server 0.29.0 → 0.31.0

package/lib/client/masto/index.mjs

@@ -1,206 +0,0 @@
-// mastoapi.mjs — Mastodon client-API facade over ap-agent (M1: read + post).
-// Modeled on snac2's approach: real implementations for the endpoints
-// clients actually exercise, empty-collection stubs for the rest. Reached
-// through the router (/api/*, /oauth/* → this port), so requests carry the
-// gate; OAuth here is theater for a single already-trusted local user.
-//
-// Surface: oauth trio · instance v1/v2 · verify_credentials · timelines/home
-// (M1) · notifications, relationships, lookup, follow/unfollow, thread
-// context, /v2/search (M2) · favourite/reblog, media upload, markers,
-// DELETE status (M3) · stub farm. Unknown /api/* GETs 404 and are LOGGED —
-// that log is the running punch list.
-//
-// This file is the class and the dispatcher. The endpoints are in the modules
-// beside it, one per area — oauth.mjs, instance.mjs, accounts.mjs,
-// timelines.mjs, statuses.mjs, media.mjs — each exporting handle(api, ctx),
-// which answers and returns true or returns false; handle() below walks them
-// in order with the bearer gate between the public ones and the rest. The
-// JSON shapes are render.mjs and the request readers body.mjs; every helper
-// the areas reach through `api.` is a one-line delegation here.
-
-import { Push } from '../webpush.mjs';
-import * as oauth from './oauth.mjs';
-import * as render from './render.mjs';
-import * as instance from './instance.mjs';
-import * as accounts from './accounts.mjs';
-import * as timelines from './timelines.mjs';
-import * as statuses from './statuses.mjs';
-import * as media from './media.mjs';
-export { hashPassword } from './oauth.mjs';
-export { pollParams } from './body.mjs';
-export { attachmentType, extensionFor } from './media.mjs';
-
-export class MastoApi {
-  constructor({ agent, log = console.log, allowed = null, scheme = null, embedded = false, throughDoor = null,
-    mount = '', streaming = true, webPush = true, scheduling = true }) {
-    this.agent = agent;
-    // The path this identity's surface answers under, when it shares its origin
-    // with others (a suffix pod, e.g. `/aisha`). Empty for a host-root or
-    // subdomain pod. Folded into the self-URLs the client is handed —
-    // pagination links, the OAuth issuer — so they name the address the client
-    // actually reached.
-    this.mount = mount;
-    // A server-hosted identity has no CLI of its own, so the advice this gives
-    // when it refuses has to name the route that identity really has.
-    this.embedded = embedded;
-    this.log = log;
-    this.allowed = allowed;             // authorities a redirect_uri may name
-    // Whether a request already passed the owner's door (its key or cookie):
-    // an owner who opened the management page is the owner at the sign-in too.
-    this.throughDoor = throughDoor;
-    // The scheme this identity is reached on, when the socket cannot say —
-    // a server behind a TLS proxy terminates cleartext and still is https.
-    this.scheme = scheme;
-    // Whether this deployment can serve the Mastodon streaming WebSocket. A
-    // Node agent can; the in-browser service-worker facade cannot (it is
-    // fetch-only), so it advertises NO streaming URL. Otherwise the client
-    // opens wss://localhost/... (the worker has no request host to name), which
-    // not only fails but, from a public origin, trips Chrome's private-network
-    // permission prompt ("access other apps and services on this device").
-    // With no streaming URL the client falls back to polling, which is served.
-    this.streaming = streaming;
-    // The same idea for two more capabilities the browser build does not have.
-    // A client decides what to offer from what the instance document says, so
-    // the honest thing is to say nothing rather than advertise and no-op.
-    //
-    // `webPush`: the browser build's web-push is a shim that mints a random
-    // placeholder VAPID key and whose sendNotification does nothing. Advertised,
-    // the client shows a notifications toggle that looks on and never fires.
-    // Omit `vapid` and it hides the toggle instead.
-    this.webPush = webPush;
-    // `scheduling`: a scheduled post is only a stored row until something
-    // publishes it when its time comes, and the only such tick is the Node
-    // agent's (run-agent.mjs). Where nothing ticks, accepting one is silent
-    // loss — the client says "scheduled" and the post never appears. Refusing
-    // it is worse UX and better behaviour.
-    this.scheduling = scheduling;
-    this.authzAttempts = [];            // password-attempt timestamps
-  }
-
-  get store() { return this.agent.store; }
-  get urls() { return this.agent.publisher?.urls; }
-  get push() {
-    this._push ||= new Push({
-      store: this.store,
-      subject: () => this.urls?.actor || 'https://localhost/',
-      log: this.log,
-    });
-    return this._push;
-  }
-  // The host in the owner's own address: the gateway's when the identity is
-  // fronted (its documents still live on the pod, but its name does not).
-  get host() {
-    if (!this.urls) return 'unconfigured.invalid';
-    return new URL(this.urls.publicHome || this.urls.base).host;
-  }
-
-  // Where the live feed is, as the CLIENT must address it: this agent's own
-  // origin, taken from the request, not the pod's host. An instance document
-  // that leaves it empty is not merely unhelpful — clients read it without a
-  // guard and fall over, and every one of them loses live updates.
-  streamingUrl(req) {
-    if (!this.streaming) return null;   // fetch-only facade: no WebSocket, no wss://localhost prompt
-    const host = req?.headers?.host || `localhost:${this.port || ''}`;
-    const secure = this.scheme
-      ? this.scheme.startsWith('https')
-      : req?.headers?.['x-forwarded-proto'] === 'https' || !!req?.socket?.encrypted;
-    return `${secure ? 'wss' : 'ws'}://${host}/api/v1/streaming`;
-  }
-
-  static scopeFor(...a) { return oauth.scopeFor(...a); }
-  static scopeAllows(...a) { return oauth.scopeAllows(...a); }
-  static redirectMatches(...a) { return oauth.redirectMatches(...a); }
-  static provesCode(...a) { return oauth.provesCode(...a); }
-
-  // ---- request handling; returns true when handled ----
-  async handle(req, res, pathname, url) {
-    const send = (status, obj, headers = {}) => {
-      const body = JSON.stringify(obj);
-      res.writeHead(status, { 'content-type': 'application/json', ...headers });
-      res.end(body);
-      return true;
-    };
-    // The address the client reached, so every self-URL handed back — the
-    // pagination links above all — names it rather than the pod's host.
-    const scheme = String(this.scheme
-      || (req.headers?.['x-forwarded-proto'] === 'https' || req.socket?.encrypted ? 'https' : 'http')).replace(/:.*$/, '');
-    let self = url;
-    try {
-      self = new URL(`${scheme}://${req.headers?.host || 'localhost'}${this.mount || ''}${pathname}${url.search || ''}`);
-    } catch { /* a Host nothing can parse: the links keep the placeholder origin */ }
-    const ctx = { req, res, pathname, url: self, send };
-
-    if (await oauth.handle(this, ctx)) return true;
-    if (!pathname.startsWith('/api/')) return false;
-    if (await instance.handle(this, ctx)) return true;
-
-    // --- everything below needs a bearer token + a configured agent ---
-    const bearer = this.tokenOf(req);
-    if (!bearer) return send(401, { error: 'The access token is invalid' });
-    // One gate for every client route below, rather than a check in each of
-    // the fifty-odd branches — which is how the scope came to be recorded and
-    // never consulted in the first place.
-    const need = MastoApi.scopeFor(req.method, pathname);
-    if (!MastoApi.scopeAllows(bearer.scope, need)) {
-      this.log(`refused ${req.method} ${pathname}: token has "${bearer.scope}", needs "${need}"`);
-      return send(403, { error: `This action is outside the authorized scopes (needs ${need})` });
-    }
-    if (!this.agent.configured()) return send(503, { error: 'agent not configured' });
-    // A viewer-mode agent (another agent holds the drain lease) may not act —
-    // but a user acting HERE outranks the idle active agent elsewhere, so a
-    // write attempt claims the lease and proceeds. Only a failed claim 503s.
-    if (this.agent.viewer && req.method !== 'GET' && req.method !== 'HEAD') {
-      const took = await this.agent.requestTakeover?.();
-      if (!took) return send(503, { error: 'another agent is active for this pod — takeover failed, try again' });
-    }
-
-    for (const area of [accounts, timelines, statuses, media]) {
-      if (await area.handle(this, ctx)) return true;
-    }
-
-    this.log(`mastoapi: unhandled ${req.method} ${pathname} — punch list`);
-    return send(404, { error: `Unimplemented: ${req.method} ${pathname}` });
-  }
-
-  // oauth.mjs
-  tokenRecords(...a) { return oauth.tokenRecords(this, ...a); }
-  tokens(...a) { return oauth.tokens(this, ...a); }
-  mintToken(...a) { return oauth.mintToken(this, ...a); }
-  apps(...a) { return oauth.apps(this, ...a); }
-  authorizationServerMetadata(...a) { return oauth.authorizationServerMetadata(this, ...a); }
-  findApp(...a) { return oauth.findApp(this, ...a); }
-  resolveClientDocument(...a) { return oauth.resolveClientDocument(this, ...a); }
-  registerApp(...a) { return oauth.registerApp(this, ...a); }
-  mintCode(...a) { return oauth.mintCode(this, ...a); }
-  consumeCode(...a) { return oauth.consumeCode(this, ...a); }
-  tokenOf(...a) { return oauth.tokenOf(this, ...a); }
-  authed(...a) { return oauth.authed(this, ...a); }
-  redirectAllowed(...a) { return oauth.redirectAllowed(this, ...a); }
-  rateLimited(...a) { return oauth.rateLimited(this, ...a); }
-
-  // render.mjs
-  selfAccount(...a) { return render.selfAccount(this, ...a); }
-  account(...a) { return render.account(this, ...a); }
-  page(...a) { return render.page(this, ...a); }
-  bskyReply(...a) { return render.bskyReply(this, ...a); }
-  acctAction(...a) { return render.acctAction(this, ...a); }
-  acctReply(...a) { return render.acctReply(this, ...a); }
-  status(...a) { return render.status(this, ...a); }
-  quoteApproval(...a) { return render.quoteApproval(this, ...a); }
-  filtersFor(...a) { return render.filtersFor(this, ...a); }
-  lookup(...a) { return render.lookup(this, ...a); }
-  statusOrBoost(...a) { return render.statusOrBoost(this, ...a); }
-  pushNotify(...a) { return render.pushNotify(this, ...a); }
-  scheduledJson(...a) { return render.scheduledJson(this, ...a); }
-  pollJson(...a) { return render.pollJson(this, ...a); }
-  mediaJson(...a) { return render.mediaJson(this, ...a); }
-  relationship(...a) { return render.relationship(this, ...a); }
-  notificationType(...a) { return render.notificationType(this, ...a); }
-  notification(...a) { return render.notification(this, ...a); }
-  accountSearch(...a) { return render.accountSearch(this, ...a); }
-
-  // instance.mjs
-  instanceTitle(...a) { return instance.instanceTitle(this, ...a); }
-  tagObject(...a) { return instance.tagObject(this, ...a); }
-  instanceBlurb(...a) { return instance.instanceBlurb(this, ...a); }
-}

package/lib/client/masto/instance.mjs

@@ -1,112 +0,0 @@
-// instance.mjs — what the instance says about itself: the v1 and v2 instance
-// documents, the limits a client reads from them, the title and blurb, the
-// tag object, and the empty-collection stubs for endpoints a single-actor
-// instance has nothing to say to.
-
-import { TRANSPARENT_PNG } from './render.mjs';
-import {
-  MAX_OPTIONS as POLL_MAX_OPTIONS, MAX_OPTION_CHARS as POLL_MAX_OPTION_CHARS,
-  MIN_SECONDS as POLL_MIN_SECONDS, MAX_SECONDS as POLL_MAX_SECONDS,
-} from '../../core/polls.mjs';
-
-const STUBS = new Map(Object.entries({
-  '/api/v1/filters': [],
-  '/api/v1/custom_emojis': [],
-  '/api/v1/announcements': [],
-  '/api/v1/instance/peers': [],
-  '/api/v1/trends/links': [],
-  '/api/v2/suggestions': [],
-  '/api/v1/preferences': {},
-}));   // followed_tags is served live from the tag feed, not stubbed
-
-export function instanceConfig() {
-  return {
-    statuses: { max_characters: 5000, max_media_attachments: 4, characters_reserved_per_url: 23 },
-    media_attachments: {
-      supported_mime_types: ['image/jpeg', 'image/png', 'image/gif', 'image/webp',
-        'video/mp4', 'video/webm', 'audio/mpeg', 'audio/ogg'],
-      image_size_limit: 10 * 1024 * 1024, video_size_limit: 40 * 1024 * 1024,
-      image_matrix_limit: 16777216, video_matrix_limit: 2304000,
-    },
-    polls: {
-      max_options: POLL_MAX_OPTIONS,
-      max_characters_per_option: POLL_MAX_OPTION_CHARS,
-      min_expiration: POLL_MIN_SECONDS,
-      max_expiration: POLL_MAX_SECONDS,
-    },
-    accounts: { max_featured_tags: 0 },
-  };
-}
-
-// Every agent used to report title 'solid-activitypub', so a client holding two
-// of them showed two identical instances and you had to read the acct to tell
-// them apart. The title is free text no client parses — make it say who.
-export function instanceTitle(api) {
-  const cfg = api.store.getConfig();
-  return cfg?.handle ? `@${cfg.handle}@${api.host}` : 'FediPod';
-}
-
-// A Mastodon Tag object. The client reads `following` in its Followed
-// Hashtags view and toggles it with the follow/unfollow endpoints. No usage
-// history — a single-actor instance has no firehose stats to report.
-export function tagObject(api, name, following, req, history = []) {
-  const host = req?.headers?.host || api.host;
-  return { name, url: `https://${host}/tags/${name}`, history, following: !!following };
-}
-
-export function instanceBlurb(api) {
-  const kind = api.store.getConfig()?.kind === 'group' ? 'group' : 'actor';
-  return `Solid pod ActivityPub ${kind}`;
-}
-
-// The Mastodon API version this facade answers to. Clients read it for what
-// the server can do beyond the version string: grouped notifications from 2,
-// a filter's blur action from 5, quote posts from 7. Everything up to 7 is
-// served here; nothing past it is claimed.
-const API_VERSIONS = { mastodon: 7 };
-
-export async function handle(api, ctx) {
-  const { req, res, pathname, url, send } = ctx;   // eslint-disable-line no-unused-vars
-
-  // --- instance (public) ---
-  if (pathname === '/api/v1/instance') {
-    const su = api.streamingUrl(req);
-    return send(200, {
-      uri: api.host, title: api.instanceTitle(), short_description: api.instanceBlurb(),
-      description: api.instanceBlurb(), email: '', version: '4.2.0 (compatible; fedipod)',
-      api_versions: API_VERSIONS,
-      urls: su ? { streaming_api: su } : {},
-      stats: { user_count: 1, status_count: api.store.countStatuses(), domain_count: 1 },
-      languages: ['en'], registrations: false, approval_required: false, invites_enabled: false,
-      configuration: instanceConfig(),
-      contact_account: null, rules: [],
-    });
-  }
-  if (pathname === '/api/v2/instance') {
-    const su = api.streamingUrl(req);
-    return send(200, {
-      domain: api.host, title: api.instanceTitle(), version: '4.2.0 (compatible; fedipod)',
-      api_versions: API_VERSIONS,
-      source_url: 'https://github.com/jeff-zucker/FediPod', description: api.instanceBlurb(),
-      usage: { users: { active_month: 1 } },
-      thumbnail: { url: TRANSPARENT_PNG },
-      languages: ['en'],
-      // Both spellings: v2 clients read configuration.urls.streaming, older
-      // ones the top-level urls.streaming_api, and some fall back blindly.
-      // Omitted entirely when there is no streaming, so the client polls.
-      urls: su ? { streaming_api: su } : {},
-      configuration: {
-        ...instanceConfig(),
-        ...(su ? { urls: { streaming: su } } : {}),
-        ...(api.webPush ? { vapid: { public_key: api.push.publicKey() } } : {}),
-      },
-      registrations: { enabled: false, approval_required: false, message: null },
-      contact: { email: '', account: null }, rules: [],
-    });
-  }
-
-  const stub = STUBS.get(pathname);
-  if (stub !== undefined && req.method === 'GET') return send(200, stub);
-
-  return false;
-}

package/lib/client/masto/media.mjs

@@ -1,79 +0,0 @@
-// media.mjs — an upload on its way to the pod's media container: what an
-// attachment is allowed to be and the two media endpoints. The multipart
-// reader moved to body.mjs, which is where a client's body is read.
-
-import crypto from 'node:crypto';
-import * as podMedia from '../../pod/media.mjs';
-import { readBody, readMultipart } from './body.mjs';
-
-// What an attachment is allowed to BE. Anything else is stored as bytes, which
-// a browser downloads rather than runs.
-const ATTACHMENT_KINDS = new Set(['image', 'video', 'audio']);
-// image/* with an exception: an SVG is a document, it carries script, and a
-// browser renders it rather than showing it. Mastodon does not take them as
-// media either.
-const NEVER = new Set(['image/svg+xml', 'image/svg']);
-const OPAQUE = 'application/octet-stream';
-
-export function attachmentType(claimed) {
-  const t = String(claimed || '').split(';')[0].trim().toLowerCase();
-  if (!/^[a-z0-9.+-]+\/[a-z0-9.+-]+$/.test(t) || NEVER.has(t)) return OPAQUE;
-  return ATTACHMENT_KINDS.has(t.split('/')[0]) ? t : OPAQUE;
-}
-
-// From the TYPE we accepted, not from the name the client sent — an `.html`
-// suffix on a file stored as octet-stream is what a pod would serve from, and
-// a filename is the client's to choose.
-export function extensionFor(mediaType, filename = '') {
-  if (mediaType === OPAQUE) return 'bin';
-  const sub = mediaType.split('/')[1].replace(/[^a-z0-9]/g, '');
-  const given = String(filename || '').includes('.')
-    ? filename.split('.').pop().toLowerCase().replace(/[^a-z0-9]/g, '') : '';
-  // Keep the client's suffix only when it plainly belongs to the accepted type,
-  // so jpg/jpeg and mp4/m4v survive without a table of every media type.
-  return given && (given === sub || sub.startsWith(given) || given.startsWith(sub)) ? given : (sub || 'bin');
-}
-
-export async function handle(api, ctx) {
-  const { req, res, pathname, url, send } = ctx;   // eslint-disable-line no-unused-vars
-
-  // Media upload: file → remote pod /ap/media/ (public-Read), entry in the
-  // media registry so a later POST /statuses can attach it.
-  if ((pathname === '/api/v2/media' || pathname === '/api/v1/media') && req.method === 'POST') {
-    const { fields, file } = await readMultipart(req);
-    if (!file?.data?.length) return send(422, { error: 'file required' });
-    // The client said what this is, and we used to believe it. The media
-    // container is world-readable and sits on the pod's own origin — the same
-    // origin as the WebID and the ACLs — so a file stored as text/html is a
-    // page served from your identity, and script in it runs as you in any
-    // browser already logged into that pod. A bearer is not "only you": the
-    // facade exists so third-party clients can connect, tokens last 90 days,
-    // and no scope is enforced. So any client you authorize could leave that
-    // page behind.
-    const mediaType = attachmentType(file.contentType);
-    const ext = extensionFor(mediaType, file.filename);
-    const slug = new Date().toISOString().slice(0, 10) + '-' + crypto.randomBytes(4).toString('hex') + '.' + ext;
-    const mediaUrl = api.urls.media + slug;
-    await api.agent.publisher.ensureMediaContainer();
-    await podMedia.write(api.agent.remote, mediaUrl, file.data, mediaType);
-    const entry = { url: mediaUrl, mediaType, description: fields.description || '' };
-    const id = api.store.idFor(mediaUrl);
-    api.store.setMedia(id, entry);
-    return send(200, api.mediaJson({ id, ...entry }));
-  }
-  const mMedia = /^\/api\/v1\/media\/([a-f0-9]+)$/.exec(pathname);
-  if (mMedia) {
-    const entry = api.store.getMedia()[mMedia[1]];
-    if (!entry) return send(404, { error: 'Record not found' });
-    if (req.method === 'PUT') {
-      const body = await readBody(req);
-      if (typeof body.description === 'string') {
-        entry.description = body.description;
-        api.store.setMedia(mMedia[1], entry);
-      }
-    }
-    return send(200, api.mediaJson({ id: mMedia[1], ...entry }));
-  }
-
-  return false;
-}