fedipod-server 0.30.0 → 0.31.0

package/README.md

@@ -156,6 +156,11 @@ that document's address and registers nothing here. Once in, it posts to the
 outbox the actor names, and reads what the identity received at `/ap/inbox`,
 which nobody but the owner may read.
 
+A followers-only or direct post of the identity's is given, at its own
+address, to a server it was sent to when that server signs its request, the
+way Mastodon gives its own: a follower's server gets a followers-only post,
+the named person's server gets a direct one, and nobody else gets either.
+
 A subdomained pod gets an origin of its own and answers at its root; a
 suffixed pod answers under its own path (`/aisha/ap/actor`, `/aisha/api/…`,
 `/aisha/oauth/…`, its door at `/aisha/fp/`). So a host carries at most one

package/dist/claims.d.ts

@@ -5,6 +5,7 @@ export declare function claims(input: {
     pathname: string;
 }, frontHost: string, runPath?: string): boolean;
 export declare const isInboxPath: (pathname: string) => boolean;
+export declare const isPrivateReadPath: (pathname: string) => boolean;
 /**
  * True when this path belongs to an identity's client surface.
  *
@@ -18,4 +19,5 @@ export declare const isInboxPath: (pathname: string) => boolean;
 export declare function agentClaims(input: {
     pathname: string;
     method?: string;
+    signed?: boolean;
 }, uiPath?: string): boolean;

package/dist/claims.js

@@ -4,7 +4,7 @@
 // front's apex the gateway answers the fediverse routes; a pod subdomain is a
 // real Solid pod and is never claimed.
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.isInboxPath = exports.DEFAULT_RUN_PATH = void 0;
+exports.isPrivateReadPath = exports.isInboxPath = exports.DEFAULT_RUN_PATH = void 0;
 exports.claims = claims;
 exports.agentClaims = agentClaims;
 // Signing up is CSS's, untouched: a person makes an account and a pod the way
@@ -18,8 +18,8 @@ const FRONT_PATHS = new Set(['/roster',
     '/.well-known/webfinger', '/api/handle', '/api/attach', '/api/agent',
     '/api/roster', '/api/revoke',
     // What the pages that remain load: the sign-in library the opt-in and
-    // roster pages use, and the installer, which is FediPod's own to hand out.
-    '/solid-oidc-client.js', '/install',
+    // roster pages use.
+    '/solid-oidc-client.js',
     // Each page's own script, served beside it; a page without its script has
     // buttons that never wake up.
     '/new-account.js', '/run.js', '/admin.js']);
@@ -58,6 +58,10 @@ const AGENT_PREFIXES = ['/api/', '/oauth/', '/@']; // /@handle: the short profil
 // `/aisha/fedipod/ap/inbox/` arrives here already stripped to `/fedipod/ap/inbox/`.
 const isInboxPath = (pathname) => /^\/(?:[^/]+\/)+ap\/inbox\/$/u.test(pathname);
 exports.isInboxPath = isInboxPath;
+// A document in the identity's private folder — a followers-only or direct
+// post, or one of the owner's own lists — matched by shape like the inbox.
+const isPrivateReadPath = (pathname) => /^\/(?:[^/]+\/)+ap\/private\/[^/]+$/u.test(pathname);
+exports.isPrivateReadPath = isPrivateReadPath;
 /**
  * True when this path belongs to an identity's client surface.
  *
@@ -70,8 +74,13 @@ exports.isInboxPath = isInboxPath;
  */
 function agentClaims(input, uiPath = '/fp/') {
     const { pathname } = input;
+    const method = String(input.method ?? '').toUpperCase();
     if ((0, exports.isInboxPath)(pathname))
-        return String(input.method ?? '').toUpperCase() === 'POST';
+        return method === 'POST';
+    // A signed read of a private post is answered at the door, to a server the
+    // post was sent to (private-read.ts). Unsigned, the document is the pod's.
+    if ((0, exports.isPrivateReadPath)(pathname))
+        return !!input.signed && (method === 'GET' || method === 'HEAD');
     if (AGENT_PATHS.has(pathname))
         return true;
     if (AGENT_PREFIXES.some((prefix) => pathname.startsWith(prefix)))

package/dist/fedipod.d.ts

@@ -12,5 +12,4 @@ export interface FrontPages {
     noticesPage: string | null;
     authBundle: string | null;
     pageScripts: Record<string, string | null>;
-    installScript: string | null;
 }

package/dist/front.js

@@ -39,14 +39,12 @@ async function serveFront(h, request, response) {
         // The notices page renders here too, and says the server keeps none:
         // a notices store is the Netlify front's, not this component's.
         noticesPage: pages.noticesPage,
-        // The opt-in and roster pages load the sign-in library, and the installer
-        // command is handed out with it; without these the pages render but
-        // cannot be used.
+        // The opt-in and roster pages load the sign-in library; without it the
+        // pages render but cannot be used.
         authBundle: pages.authBundle,
         // Each page's own script, so the pages can be served under
         // `script-src 'self'` (see fedipod/front).
         pageScripts: pages.pageScripts,
-        installScript: pages.installScript,
         lookup: (handle) => h.dir.lookup(handle),
         putDirectory: (handle, rec) => h.dir.putDirectory(handle, rec),
         podPut: (_handle, url, body, ct) => s.podPut(url, body, ct),

package/dist/handler.js

@@ -52,6 +52,7 @@ const mounts_1 = require("./mounts");
 const identities = __importStar(require("./identities"));
 const optIn = __importStar(require("./opt-in"));
 const door_1 = require("./door");
+const private_read_1 = require("./private-read");
 const front_1 = require("./front");
 class FediPodServerHandler extends community_server_1.HttpHandler {
     args;
@@ -125,7 +126,8 @@ class FediPodServerHandler extends community_server_1.HttpHandler {
         // relative to the claim's mount, so a suffix pod's `/aisha/ap/actor` is
         // judged as `/ap/actor`.
         const c = (0, mounts_1.resolveClaim)(this, host, pathname);
-        if (c && (0, claims_1.agentClaims)({ pathname: (0, mounts_1.stripMount)(pathname, c.mount), method: request.method }, this.uiPath))
+        if (c && (0, claims_1.agentClaims)({ pathname: (0, mounts_1.stripMount)(pathname, c.mount), method: request.method,
+            signed: !!request.headers.signature }, this.uiPath))
             return;
         throw new Error('not a gateway route'); // reject → CSS's LDP handler takes it
     }
@@ -185,6 +187,13 @@ class FediPodServerHandler extends community_server_1.HttpHandler {
         if (pathname === inboxPath && String(request.method).toUpperCase() === 'POST') {
             return (0, door_1.deliverAtDoor)(this, identity, request, response);
         }
+        // A signed read of a private post — a followers-only or direct one, fetched
+        // at its address by a server it was sent to — is answered here (§3.2).
+        const privatePrefix = inboxPath.replace(/ap\/inbox\/$/u, 'ap/private/');
+        const method = String(request.method).toUpperCase();
+        if (pathname.startsWith(privatePrefix) && (method === 'GET' || method === 'HEAD') && request.headers.signature) {
+            return (0, private_read_1.readPrivateAtDoor)(this, identity, request, response);
+        }
         await identity.surface.handler(request, response);
     }
 }

package/dist/identities.d.ts

@@ -16,6 +16,15 @@ export interface EmbeddedIdentity {
             getConfig?: () => {
                 kind?: string;
             } | null | undefined;
+            getContacts?: () => {
+                followers?: {
+                    actor?: string;
+                }[];
+            };
+        };
+        urls?: {
+            followers?: string;
+            toPod?: (u: string) => string;
         };
     };
 }

package/dist/private-read.d.ts

@@ -0,0 +1,4 @@
+import type { HttpHandlerInput } from '@solid/community-server';
+import type { EmbeddedIdentity } from './identities';
+import type { FediPodServerHandler } from './handler';
+export declare function readPrivateAtDoor(h: FediPodServerHandler, identity: EmbeddedIdentity, request: HttpHandlerInput['request'], response: HttpHandlerInput['response']): Promise<void>;

package/dist/private-read.js

@@ -0,0 +1,34 @@
+"use strict";
+// private-read.ts — a signed read of a followers-only or direct post at its
+// address on this pod, answered to a server the post was sent to (ActivityPub
+// §3.2). The same rule the front applies (lib/gateway/private-read.mjs); the
+// post is read through the server's own store and the followers come from the
+// identity's live state. Anyone the post was not sent to gets 404.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readPrivateAtDoor = readPrivateAtDoor;
+const adapt_1 = require("./adapt");
+const fedipod_1 = require("./fedipod");
+async function readPrivateAtDoor(h, identity, request, response) {
+    const s = h.internals();
+    const { readPrivateForSigner } = await (0, fedipod_1.esmImport)(fedipod_1.EMBED);
+    let whatwg;
+    try {
+        // The pod's own origin: the signature covers the path and the Host header, and both are the pod's.
+        whatwg = await (0, adapt_1.nodeToWhatwg)(request, new URL(identity.podHome).origin);
+    }
+    catch (e) {
+        response.writeHead(400, { 'content-type': 'application/json' });
+        response.end(JSON.stringify({ error: e.message }));
+        return;
+    }
+    const out = await readPrivateForSigner(identity.agent, whatwg, { read: (url) => s.io.read(url) });
+    s.logger.info(`FediPod: private read for @${identity.handle} — ${out.reason} (${out.status})`);
+    const noStore = { 'cache-control': 'no-store', vary: 'Signature' };
+    if (out.status !== 200) {
+        response.writeHead(out.status, noStore);
+        response.end();
+        return;
+    }
+    response.writeHead(200, { ...noStore, 'content-type': 'application/activity+json' });
+    response.end(String(request.method).toUpperCase() === 'HEAD' ? '' : out.body);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fedipod-server",
-  "version": "0.30.0",
+  "version": "0.31.0",
   "description": "The FediPod Server: a full ActivityPub server as a Community Solid Server component.",
   "license": "MIT",
   "main": "dist/index.js",
@@ -15,16 +15,16 @@
     "@solid/community-server": "^7.0.0"
   },
   "dependencies": {
-    "fedipod": "^1.42.0"
+    "fedipod": "^1.45.0"
   },
   "devDependencies": {
-    "typescript": "^5.5.3",
-    "componentsjs-generator": "^3.1.2",
-    "@types/node": "^20.0.0",
-    "@solid/community-server": "^7.2.0",
     "@fedify/fedify": "^2.3.4",
+    "@solid/community-server": "^7.2.0",
+    "@types/node": "^20.0.0",
+    "componentsjs-generator": "^3.1.2",
     "n3": "^2.1.1",
-    "rdflib": "^2.4.0"
+    "rdflib": "^2.4.0",
+    "typescript": "^5.5.3"
   },
   "overrides": {
     "@opentelemetry/core": "^2.8.0",