fedipod-server 0.6.0 → 0.8.0

package/lib/bskygroup.mjs

@@ -30,7 +30,7 @@ export class BskyGroup {
   // ONE reply ever: tell an unbridged joiner how to reach the fediverse side.
   async nudge({ did, handle }) {
     const text = `@${handle} welcome! Follow @ap.brid.gy and your posts will reach `
-      + 'the fediverse side of this group too.';
+      + 'the Fediverse side of this group too.';
     const start = 0;
     const rec = this.atproto.read();
     await this.atproto.xrpc('com.atproto.repo.createRecord', {

package/lib/embed.mjs

@@ -210,5 +210,10 @@ export async function startEmbeddedAgent({
     ]);
   };
 
-  return { agent, handle, home, surface, host: authorities.host, stop };
+  // podHome and actorUrl are the identity's own locations on the pod. They are
+  // returned rather than rebuilt by the caller so the root name lives here.
+  return {
+    agent, handle, home, surface, host: authorities.host,
+    podHome: urls.home, actorUrl: urls.actor, stop,
+  };
 }

package/lib/fediacct.mjs

@@ -0,0 +1,257 @@
+// fediacct.mjs — the agent's connections to fediverse accounts the owner holds
+// on OTHER servers. The agent is an API client of an existing Mastodon-API
+// account, the same relationship a Mastodon app has to this agent, and the same
+// one atproto.mjs has to a Bluesky account. Nothing here is a second identity:
+// no key, no pod, nothing published.
+//
+// One credential per account at AP_HOME/fediaccts/<id>.json (0600, atomic,
+// stamped with the actor it was connected for — the keys.json rules). A file
+// stamped for someone else is skipped rather than fatal, so one stray record
+// cannot cost the owner the whole roster.
+//
+// An access token here is full access to that account on that server, so it
+// never reaches pod state: config.json gets the handle and the host, nothing
+// more.
+
+import fs from 'node:fs';
+import path from 'node:path';
+import crypto from 'node:crypto';
+import { writeJsonAtomic } from './home.mjs';
+import { safeFetch, retryAfterMs } from './safefetch.mjs';
+
+const DIR = 'fediaccts';
+const APPS = '_apps';
+const SCOPES = 'read write';
+const STATE_TTL_MS = 10 * 60_000;
+const CLIENT_NAME = 'FediPod';
+
+// The id becomes a file name, and both halves come from a remote server's own
+// answer. `--handle ../escape` is the shape of bug this project has already
+// paid for once, so the result is checked rather than trusted.
+export function safeId(user, host) {
+  const id = `${String(user || '').trim()}@${String(host || '').trim()}`
+    .toLowerCase().replace(/[^a-z0-9.@_-]/g, '-');
+  if (!/^[a-z0-9][a-z0-9.@_-]{0,80}$/.test(id) || id.includes('..')) return null;
+  return id;
+}
+
+// A host as we will address it: bare authority, no scheme, no path, no case.
+export function cleanHost(host) {
+  const raw = String(host || '').trim().replace(/^https?:\/\//i, '').replace(/\/.*$/, '');
+  return /^[a-z0-9.-]+(:\d+)?$/i.test(raw) ? raw.toLowerCase() : null;
+}
+
+export class FediAccounts {
+  constructor({ localDir, actorId = null, log = console.log, fetcher = null }) {
+    this.dir = path.join(localDir, DIR);
+    this.actorId = actorId;
+    this.log = log;
+    // Injectable for tests; the default is the politeness stack, which also
+    // refuses private addresses — a connected account is on the public web.
+    this.fetcher = fetcher || ((url, init) => safeFetch(url, init));
+    this.pausedUntil = new Map();          // host → epoch ms
+    this.pending = new Map();              // state nonce → { host, redirectUri, at }
+  }
+
+  // ---- records ----
+
+  _path(id) { return path.join(this.dir, `${id}.json`); }
+
+  ids() {
+    let names = [];
+    try { names = fs.readdirSync(this.dir); } catch { return []; }
+    return names.filter(n => n.endsWith('.json') && !n.startsWith('_')).map(n => n.slice(0, -5));
+  }
+
+  read(id) {
+    let rec;
+    try { rec = JSON.parse(fs.readFileSync(this._path(id), 'utf8')); } catch { return null; }
+    if (rec?.mintedFor && this.actorId && rec.mintedFor !== this.actorId) {
+      this.log(`fediaccts/${id}.json belongs to ${rec.mintedFor} — not reusing it for ${this.actorId}`);
+      return null;
+    }
+    return rec;
+  }
+
+  write(rec) {
+    fs.mkdirSync(this.dir, { recursive: true, mode: 0o700 });
+    writeJsonAtomic(this._path(rec.id), rec);
+  }
+
+  list() { return this.ids().map(id => this.read(id)).filter(Boolean); }
+
+  connected() { return this.list().some(r => r.token && r.enabled !== false); }
+
+  // What may be written to pod state: who, where, and whether it is polled.
+  roster() {
+    return this.list().map(r => ({
+      id: r.id, handle: r.handle, host: r.host,
+      addedAt: r.addedAt || null, enabled: r.enabled !== false,
+    }));
+  }
+
+  status() {
+    return this.list().map(r => ({
+      id: r.id, handle: r.handle, host: r.host,
+      enabled: r.enabled !== false,
+      needsReconnect: !!r.needsReconnect,
+      cooldownFor: Math.max(0, Math.round(((this.pausedUntil.get(r.host) || 0) - Date.now()) / 1000)),
+    }));
+  }
+
+  setEnabled(id, on) {
+    const rec = this.read(id);
+    if (!rec) return null;
+    this.write({ ...rec, enabled: !!on });
+    return this.roster().find(r => r.id === id) || null;
+  }
+
+  remove(id) {
+    if (!this.read(id)) return false;
+    try { fs.rmSync(this._path(id)); } catch { return false; }
+    this.log(`Fediverse account disconnected: ${id}`);
+    return true;
+  }
+
+  // ---- HTTP ----
+
+  async _fetch(host, url, init) {
+    const left = (this.pausedUntil.get(host) || 0) - Date.now();
+    if (left > 0) throw new Error(`${host} asked us to back off — ${Math.ceil(left / 1000)}s left`);
+    const res = await this.fetcher(url, init);
+    if (res.status === 429 || res.status === 503) {
+      const ms = retryAfterMs(res) ?? 60_000;
+      this.pausedUntil.set(host, Date.now() + ms);
+      this.log(`${host} answered ${res.status} — pausing for ${Math.round(ms / 1000)}s`);
+    }
+    return res;
+  }
+
+  async _json(res, host) {
+    const body = await res.json().catch(() => ({}));
+    if (res.status >= 400) {
+      const err = new Error(body.error_description || body.error || `${host} answered ${res.status}`);
+      err.status = res.status;
+      throw err;
+    }
+    return body;
+  }
+
+  // ---- the OAuth dance, as the client ----
+
+  // One app registration per host, remembered. The redirect_uri is part of what
+  // was registered, so an agent that moved to another port re-registers rather
+  // than sending the server a redirect it will refuse.
+  async appFor(host, redirectUri) {
+    const file = path.join(this.dir, APPS, `${host}.json`);
+    try {
+      const app = JSON.parse(fs.readFileSync(file, 'utf8'));
+      if (app.redirectUri === redirectUri && app.clientId && app.clientSecret) return app;
+    } catch { /* not registered here yet */ }
+    const res = await this._fetch(host, `https://${host}/api/v1/apps`, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({
+        client_name: CLIENT_NAME, redirect_uris: redirectUri,
+        scopes: SCOPES, website: 'https://github.com/jeff-zucker/FediPod',
+      }),
+    });
+    const body = await this._json(res, host);
+    if (!body.client_id || !body.client_secret) throw new Error(`${host} registered no client`);
+    const app = { host, redirectUri, clientId: body.client_id, clientSecret: body.client_secret };
+    fs.mkdirSync(path.join(this.dir, APPS), { recursive: true, mode: 0o700 });
+    writeJsonAtomic(file, app);
+    return app;
+  }
+
+  // Step one: where to send the browser. The state nonce is single-use and
+  // short-lived — without one, any page the owner visits could hand our
+  // callback somebody else's authorization code and bind THEIR account here.
+  async begin({ host, redirectUri }) {
+    const h = cleanHost(host);
+    if (!h) throw new Error('that is not a server address');
+    const app = await this.appFor(h, redirectUri);
+    const state = crypto.randomBytes(24).toString('hex');
+    const now = Date.now();
+    for (const [k, v] of this.pending) if (now - v.at > STATE_TTL_MS) this.pending.delete(k);
+    this.pending.set(state, { host: h, redirectUri, at: now });
+    const u = new URL(`https://${h}/oauth/authorize`);
+    u.searchParams.set('client_id', app.clientId);
+    u.searchParams.set('redirect_uri', redirectUri);
+    u.searchParams.set('response_type', 'code');
+    u.searchParams.set('scope', SCOPES);
+    u.searchParams.set('state', state);
+    return { url: u.href, state, host: h };
+  }
+
+  // Step two: the code comes back. Exchange it, ask the server who we now are,
+  // and only then write anything.
+  async complete({ state, code }) {
+    const pend = this.pending.get(state);
+    if (!pend || Date.now() - pend.at > STATE_TTL_MS) throw new Error('that sign-in has expired — start again');
+    this.pending.delete(state);
+    const { host, redirectUri } = pend;
+    const app = await this.appFor(host, redirectUri);
+    const res = await this._fetch(host, `https://${host}/oauth/token`, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({
+        grant_type: 'authorization_code', code, redirect_uri: redirectUri,
+        client_id: app.clientId, client_secret: app.clientSecret, scope: SCOPES,
+      }),
+    });
+    const tok = await this._json(res, host);
+    if (!tok.access_token) throw new Error(`${host} returned no token`);
+    const me = await this.whoami(host, tok.access_token);
+    const id = safeId(me.username, host);
+    if (!id) throw new Error(`${host} answered with a name we cannot file safely`);
+    this.write({
+      id, host, token: tok.access_token, scope: tok.scope || SCOPES,
+      handle: `@${me.username}@${host}`, acct: me.acct || me.username,
+      accountId: String(me.id), actorUrl: me.url || null,
+      name: me.display_name || me.username, icon: me.avatar || null,
+      addedAt: new Date().toISOString(), enabled: true,
+      ...(this.actorId ? { mintedFor: this.actorId } : {}),
+    });
+    this.log(`Fediverse account connected: @${me.username}@${host}`);
+    return this.roster().find(r => r.id === id);
+  }
+
+  async whoami(host, token) {
+    const res = await this._fetch(host, `https://${host}/api/v1/accounts/verify_credentials`, {
+      headers: { authorization: `Bearer ${token}` },
+    });
+    const me = await this._json(res, host);
+    if (!me.username) throw new Error(`${host} did not say who we are`);
+    return me;
+  }
+
+  // ---- authenticated calls on behalf of one connected account ----
+
+  // Returns the Response, so a caller can read rate-limit headers. A 401 means
+  // the token was revoked on the far side: the account is marked rather than
+  // deleted, because the owner should be told rather than quietly dropped.
+  async api(id, pathname, init = {}) {
+    const rec = this.read(id);
+    if (!rec?.token) throw new Error(`no connected account ${id}`);
+    const url = pathname.startsWith('https://') ? pathname : `https://${rec.host}${pathname}`;
+    const res = await this._fetch(rec.host, url, {
+      ...init,
+      headers: { ...(init.headers || {}), authorization: `Bearer ${rec.token}` },
+    });
+    if (res.status === 401) {
+      if (!rec.needsReconnect) this.write({ ...rec, needsReconnect: true });
+      const err = new Error(`${rec.handle} no longer accepts our token — reconnect it`);
+      err.status = 401;
+      throw err;
+    }
+    if (rec.needsReconnect && res.status < 400) this.write({ ...rec, needsReconnect: false });
+    return res;
+  }
+
+  async apiJson(id, pathname, init = {}) {
+    const rec = this.read(id);
+    const res = await this.api(id, pathname, init);
+    return this._json(res, rec?.host || id);
+  }
+}

package/lib/front-core.mjs

@@ -18,6 +18,7 @@
 import crypto from 'node:crypto';
 import { handleDelivery } from './gateway-core.mjs';
 import { readCapped } from './safefetch.mjs';
+import { linkTargets, REL } from './links.mjs';
 
 // The one WebFinger document, spelled out here rather than imported from
 // wire.mjs: wire drags the agent's whole HTML pipeline (sanitize-html and
@@ -48,6 +49,24 @@ async function verifyPodToken(request, pathname, verifier) {
 // Is this WebID served by the claimed pod? A pod owner's WebID lives on the pod
 // origin — that is the whole proof: a token for a WebID under podHome could
 // only be minted by someone who controls that pod's identity provider.
+// A pod that will not answer must not hold up the person opting in; without
+// an answer the older check stands on its own.
+const OWNER_LOOKUP_MS = 5_000;
+
+/**
+ * Who the pod server says owns the pod. The server that hosts it is the
+ * authority on that, so when it answers, its answer decides. A server that
+ * says nothing leaves where the WebID lives as the only evidence there is.
+ */
+async function podOwners(podBase, fetchImpl = fetch) {
+  try {
+    const res = await fetchImpl(podBase, {
+      method: 'HEAD', signal: AbortSignal.timeout(OWNER_LOOKUP_MS),
+    });
+    return linkTargets(res?.headers?.get?.('link'), REL.owner, podBase);
+  } catch { return []; }
+}
+
 function webidUnderPod(webid, podHome) {
   try { return new URL(webid).origin === new URL(podHome).origin; } catch { return false; }
 }
@@ -130,6 +149,8 @@ function identFor(rec, policy = null) {
 //   host        the front's own host, e.g. "fedipod.net" (for WebFinger subjects)
 //   frontOrigin "https://fedipod.net"
 //   lookup(handle) -> record | null       the directory
+//   listDirectory() -> { handle: record }  every row, for the admin roster
+//   removeDirectory(handle) -> boolean     drop a row; false when a seeded row remains
 //   podPut(url, body, ct) -> boolean      append to a user's pod (per-user cred inside)
 //   podGet(url) -> Response                read a user's pod (public reads; plain fetch is fine)
 export async function routeFront(request, ctx) {
@@ -155,6 +176,51 @@ export async function routeFront(request, ctx) {
     return { status: 200, headers: { 'content-type': 'text/html; charset=utf-8' }, body: ctx.runPage };
   }
 
+  // The admin page: the host reading who has accounts here. The page signs in
+  // and calls the roster API below; a deploy with no admin supplies no page.
+  if (pathname === '/admin') {
+    if (request.method !== 'GET' && request.method !== 'HEAD') return { status: 405, headers: {}, body: '' };
+    if (!ctx.adminPage) return notFound();
+    return { status: 200, headers: { 'content-type': 'text/html; charset=utf-8' }, body: ctx.adminPage };
+  }
+
+  // The roster: every directory row, secrets stripped, for the host's own
+  // eyes. The reader proves themself the way attach proves a pod — a
+  // Solid-OIDC token — and must be the WebID the deploy names as admin.
+  if (pathname === '/api/roster') {
+    if (!ctx.listDirectory || !ctx.adminWebId) return j(501, { error: 'this front has no roster to offer' });
+    const webid = await verifyPodToken(request, pathname, ctx.verifier);
+    if (!webid) return j(401, { error: 'a Solid-OIDC token is required' });
+    if (webid !== ctx.adminWebId) return j(403, { error: 'that WebID is not the admin of this front' });
+    const rows = await ctx.listDirectory();
+    const accounts = Object.values(rows)
+      .map((r) => ({
+        handle: r.handle, kind: r.kind || 'person', fronted: !r.inboxOnly,
+        podHome: r.podHome, webId: r.webId || null, actorUrl: r.actorUrl,
+        address: `@${r.handle}@${ctx.host}`,
+      }))
+      .sort((a, b) => a.handle.localeCompare(b.handle));
+    return j(200, { host: ctx.host, accounts });
+  }
+
+  // Revoke: the admin removes an account's row, so the server stops answering
+  // for the name. Nothing on the user's pod is touched. Attach-created rows go
+  // for good; a row seeded in the deploy's environment can only be removed there.
+  if (pathname === '/api/revoke' && request.method === 'POST') {
+    if (!ctx.removeDirectory || !ctx.adminWebId) return j(501, { error: 'this front cannot revoke accounts' });
+    const webid = await verifyPodToken(request, pathname, ctx.verifier);
+    if (!webid) return j(401, { error: 'a Solid-OIDC token is required' });
+    if (webid !== ctx.adminWebId) return j(403, { error: 'that WebID is not the admin of this front' });
+    let body;
+    try { body = JSON.parse(await request.clone().text()); } catch { return j(400, { error: 'bad JSON' }); }
+    const handle = String(body.handle || '').toLowerCase();
+    if (!(await ctx.lookup(handle))) return j(404, { error: 'no such account' });
+    const removed = (await ctx.removeDirectory(handle)) === true;
+    return j(200, removed ? { handle, removed }
+      : { handle, removed: false,
+          reason: 'this row is seeded in the deploy environment (FEDIPOD_DIRECTORY_JSON) — remove it there and redeploy' });
+  }
+
   // Live handle check for the page: valid shape AND not already in the
   // directory. Also tells the page whether this host offers pods.
   if (pathname === '/api/handle') {
@@ -238,7 +304,11 @@ export async function routeFront(request, ctx) {
     } catch { return j(400, { error: 'podBase is not a URL' }); }
     const webid = await verifyPodToken(request, pathname, ctx.verifier);
     if (!webid) return j(401, { error: 'a Solid-OIDC token proving the pod is required' });
-    if (!webid.startsWith(podBase)) {
+    // The pod's own server names its owner when it can. Where it does, that is
+    // the proof; where it does not, the WebID must at least live under the pod.
+    const owners = await podOwners(podBase, ctx.fetchImpl || fetch);
+    const proven = owners.length ? owners.includes(webid) : webid.startsWith(podBase);
+    if (!proven) {
       return j(403, { error: 'the token proves a different pod than the one you listed' });
     }
     if (action === 'opt-in') {
@@ -257,9 +327,9 @@ export async function routeFront(request, ctx) {
     return j(400, { error: 'action must be opt-in or opt-out' });
   }
 
-  // The vendored Solid-OIDC browser library the signup page loads — served
-  // here because this function owns every path on the domain.
-  if (pathname === '/solid-client-authn.bundle.js') {
+  // The vendored Solid-OIDC browser library the /run and /admin pages load —
+  // served here because this function owns every path on the domain.
+  if (pathname === '/solid-oidc-client.js') {
     if (!ctx.authBundle) return notFound();
     return { status: 200, headers: { 'content-type': 'text/javascript' }, body: ctx.authBundle };
   }

package/lib/intake.mjs

@@ -18,6 +18,7 @@ import * as $rdf from 'rdflib';
 import { USER_AGENT } from './ua.mjs';
 import { PUBLIC } from './wire.mjs';
 import { HTTP_TIMEOUT_MS, readCapped } from './safefetch.mjs';
+import { linkTargets, REL } from './links.mjs';
 import { dropFollower } from './store.mjs';
 
 const RDF = $rdf.Namespace('http://www.w3.org/1999/02/22-rdf-syntax-ns#');
@@ -307,6 +308,24 @@ export class Intake {
     }
   }
 
+  /**
+   * Where this pod describes the services it offers. The pod says so on any
+   * response about one of its resources; the well-known path is only what a
+   * pod that says nothing has always used.
+   */
+  async _storageDescriptionUrl() {
+    try {
+      const head = await fetch(this.urls.base, {
+        method: 'HEAD',
+        headers: { 'user-agent': USER_AGENT },
+        signal: AbortSignal.timeout(HTTP_TIMEOUT_MS),
+      });
+      const [found] = linkTargets(head.headers.get('link'), REL.storageDescription, this.urls.base);
+      if (found) return found;
+    } catch { /* the well-known path below */ }
+    return this.urls.base + '.well-known/solid';
+  }
+
   async _subscribeOnce() {
     // Reuse a channel we already have rather than asking for another one.
     const saved = this.store.read(CHANNEL_DOC, null);
@@ -314,13 +333,13 @@ export class Intake {
       this._openSocket(saved.receiveFrom, true);
       return;
     }
-    const descRes = await fetch(this.urls.base + '.well-known/solid', {
+    const descUrl = await this._storageDescriptionUrl();
+    const descRes = await fetch(descUrl, {
       headers: { accept: 'text/turtle', 'user-agent': USER_AGENT },
       signal: AbortSignal.timeout(HTTP_TIMEOUT_MS),
     });
     // The service description is RDF; ask rdflib which subject is the
     // WebSocketChannel2023 service rather than pattern-matching the document.
-    const descUrl = this.urls.base + '.well-known/solid';
     const g = $rdf.graph();
     try { $rdf.parse(await readCapped(descRes), g, descUrl, 'text/turtle'); }
     catch (e) { this.wsState = 'unavailable'; this.log(`service description unparsable (${e.message}) — polling only`); return; }

package/lib/links.mjs

@@ -0,0 +1,35 @@
+// links.mjs — reading RFC 8288 Link headers.
+//
+// Solid says where a resource's access control lives, where a storage
+// describes itself, and who owns a storage, by putting a link on the response.
+// Working any of those out from the resource's own URL instead is exactly what
+// the specs tell clients not to do, so this is the one place that reads them.
+
+/**
+ * Every target a Link header gives for one relation, resolved against the URL
+ * the header came from. A header may carry several links, and one link may
+ * carry several relation names.
+ */
+export function linkTargets(headerValue, rel, baseUrl) {
+  if (!headerValue) return [];
+  const wanted = String(rel).toLowerCase();
+  const out = [];
+  // Split on the commas BETWEEN links: one inside a URI has its closing angle
+  // bracket still ahead of it, and is left alone.
+  for (const part of String(headerValue).split(/,(?![^<]*>)/u)) {
+    const link = /^\s*<([^>]*)>\s*(.*)$/u.exec(part);
+    if (!link) continue;
+    const relParam = /(?:^|;)\s*rel\s*=\s*(?:"([^"]*)"|([^;"\s]+))/iu.exec(link[2]);
+    const names = (relParam?.[1] ?? relParam?.[2] ?? '').toLowerCase().split(/\s+/u);
+    if (!names.includes(wanted)) continue;
+    try { out.push(new URL(link[1], baseUrl).href); } catch { /* not a URL we can follow */ }
+  }
+  return out;
+}
+
+/** The relations this project follows. */
+export const REL = {
+  acl: 'acl',
+  storageDescription: 'http://www.w3.org/ns/solid/terms#storageDescription',
+  owner: 'http://www.w3.org/ns/solid/terms#owner',
+};

package/lib/mastoapi.mjs

@@ -12,7 +12,7 @@
 
 import crypto from 'node:crypto';
 import * as social from './social.mjs';
-import { sanitizeHtml, followsNeedApproval } from './wire.mjs';
+import { sanitizeHtml, followsNeedApproval, publicHandle } from './wire.mjs';
 import { authorOf } from './intake.mjs';
 import { profileUrl, postUrl } from './bskyfeed.mjs';
 import { Push } from './webpush.mjs';
@@ -201,7 +201,7 @@ export class MastoApi {
     // No fallback handle. `account()` already reads config for self, so a
     // literal here only ever supplies a name that is not this actor's — and it
     // was a real person's, so every install with no handle called itself jeff.
-    return this.account(this.urls.actor, { selfAcct: this.store.getConfig()?.handle || null });
+    return this.account(this.urls.actor, { selfAcct: publicHandle(this.store.getConfig()) });
   }
 
   account(actorUrl, { selfAcct } = {}) {
@@ -209,7 +209,7 @@ export class MastoApi {
     let host = '', user = cached.preferredUsername || '';
     try { host = new URL(actorUrl).host; if (!user) user = new URL(actorUrl).pathname.split('/').pop(); } catch {}
     const self = actorUrl === this.urls?.actor;
-    if (self) user = selfAcct || this.store.getConfig()?.handle || user;
+    if (self) user = selfAcct || publicHandle(this.store.getConfig()) || user;
     return {
       id: this.store.idFor(actorUrl),
       username: user,
@@ -327,6 +327,76 @@ export class MastoApi {
     } catch (e) { return send(422, { error: e.message }); }
   }
 
+  // Which account acts: the one that saw the post, and the first of them when
+  // several did. Undo inverts that — a like fans IN to one account, an unlike
+  // fans OUT to every account holding one, because a stray like left behind
+  // after the owner asked for it to go is the worse failure.
+  async acctAction(send, s, verb) {
+    const accounts = this.agent.fediaccts;
+    const held = s.sourceAccts || [];
+    if (!accounts || !held.length) {
+      return send(422, { error: 'this post came from a connected account, and none is connected now' });
+    }
+    const flag = verb.endsWith('favourite') ? 'favourited' : 'reblogged';
+    const undo = verb.startsWith('un');
+    const targets = (undo ? held.filter(v => v[flag]) : [held[0]]).filter(v => v?.remoteId);
+    if (!targets.length) return send(200, this.status(s));
+    try {
+      const acted = new Set();
+      for (const v of targets) {
+        await accounts.api(v.acct,
+          `/api/v1/statuses/${encodeURIComponent(v.remoteId)}/${verb}`, { method: 'POST' });
+        acted.add(v.acct);
+      }
+      const next = held.map(v => (acted.has(v.acct) ? { ...v, [flag]: !undo } : v));
+      return send(200, this.status(this.store.updateStatus(s.noteId, { sourceAccts: next }) || s));
+    } catch (e) { return send(e.status === 401 ? 401 : 422, { error: e.message }); }
+  }
+
+  // The reply exists only on that account's server, so the row added here is
+  // its one local copy — the same shape bskyReply uses for the same reason.
+  async acctReply(send, body, parent, visibility) {
+    const accounts = this.agent.fediaccts;
+    const held = (parent.sourceAccts || [])[0];
+    if (!accounts || !held?.remoteId) {
+      return send(422, { error: 'this post came from a connected account, and none is connected now' });
+    }
+    if (visibility !== 'public' && visibility !== 'unlisted') {
+      return send(422, { error: 'a reply from a connected account is public — pick public or unlisted' });
+    }
+    if (body.scheduled_at) return send(422, { error: 'a reply from a connected account cannot be scheduled' });
+    if ([].concat(body.media_ids || body['media_ids[]'] || []).filter(Boolean).length) {
+      return send(422, { error: 'images on a reply from a connected account are not supported' });
+    }
+    try {
+      const out = await accounts.apiJson(held.acct, '/api/v1/statuses', {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({
+          status: body.status, in_reply_to_id: held.remoteId, visibility,
+          ...(body.spoiler_text ? { spoiler_text: String(body.spoiler_text) } : {}),
+        }),
+      });
+      if (!out?.uri) return send(502, { error: 'that server accepted the reply but did not say where it is' });
+      const rec = accounts.read(held.acct);
+      const actor = out.account?.uri || out.account?.url || rec?.actorUrl;
+      if (actor && !this.store.getActors()[actor]) {
+        this.store.cacheActor(actor, {
+          name: out.account?.display_name || rec?.name,
+          preferredUsername: out.account?.username || rec?.acct, type: 'Person',
+        });
+      }
+      this.store.addStatus({
+        noteId: out.uri, actor, inReplyTo: parent.noteId,
+        content: sanitizeHtml(out.content || ''),
+        published: out.created_at || new Date().toISOString(), kind: 'acct',
+        sourceAccts: [{ acct: held.acct, remoteId: String(out.id) }],
+        ...(out.url && out.url !== out.uri ? { link: out.url } : {}),
+      });
+      return send(200, this.status(this.store.getStatuses().find(x => x.noteId === out.uri)));
+    } catch (e) { return send(422, { error: e.message }); }
+  }
+
   status(s, { all } = {}) {
     const replies = (all || this.store.getStatuses()).filter(x => x.inReplyTo === s.noteId).length;
     return {
@@ -339,7 +409,11 @@ export class MastoApi {
       edited_at: s.editedAt || null,
       uri: s.noteId, url: s.link || s.noteId,
       replies_count: replies, reblogs_count: 0, favourites_count: 0,
-      favourited: !!s.favourited, reblogged: !!s.reblogged,
+      // True when ANY of the owner's accounts holds it. The flag is really
+      // what the next tap will do: an empty star on a post one account has
+      // already liked invites a second outward like from a second identity.
+      favourited: !!s.favourited || (s.sourceAccts || []).some(v => v.favourited),
+      reblogged: !!s.reblogged || (s.sourceAccts || []).some(v => v.reblogged),
       muted: false, bookmarked: !!s.bookmarked, pinned: !!s.pinned,
       content: s.content || '',
       reblog: null, application: null,
@@ -807,6 +881,10 @@ export class MastoApi {
       // — the parent is not an AP object, so there is no AP note to make.
       const bskyParent = inReplyTo && this.store.getStatuses().find(x => x.noteId === inReplyTo && x.kind === 'bsky');
       if (bskyParent) return this.bskyReply(send, body, bskyParent, visibility);
+      // A reply to a post a connected account brought us goes out from that
+      // account, where the conversation already is.
+      const acctParent = inReplyTo && this.store.getStatuses().find(x => x.noteId === inReplyTo && x.kind === 'acct');
+      if (acctParent) return this.acctReply(send, body, acctParent, visibility);
       // Private and direct posts live in an owner-only pod container — and
       // only on a pod that provably enforces it.
       if (visibility === 'private' || visibility === 'direct') {
@@ -888,8 +966,24 @@ export class MastoApi {
       const noteUrl = this.store.urlFor(mStatus[1]);
       const s = noteUrl && this.store.getStatuses().find(x => x.noteId === noteUrl);
       if (!s) return send(404, { error: 'Record not found' });
-      if (s.actor !== this.urls.actor) return send(403, { error: 'not your status' });
+      // A post the owner wrote on a connected account is theirs to delete too.
+      // It is deleted where it lives — an AP Delete of ours would address an
+      // object that was never ours to speak for.
+      const onAcct = s.actor !== this.urls.actor
+        ? (this.agent.fediaccts?.list() || []).find(r => r.actorUrl && r.actorUrl === s.actor)
+        : null;
+      if (s.actor !== this.urls.actor && !onAcct) return send(403, { error: 'not your status' });
       const rendered = this.status(s);
+      if (onAcct) {
+        const held = (s.sourceAccts || []).find(v => v.acct === onAcct.id);
+        if (!held?.remoteId) return send(422, { error: `we do not know where ${onAcct.handle} keeps that post` });
+        try {
+          await this.agent.fediaccts.api(onAcct.id,
+            `/api/v1/statuses/${encodeURIComponent(held.remoteId)}`, { method: 'DELETE' });
+        } catch (e) { return send(502, { error: e.message }); }
+        this.store.removeStatus(s.noteId);
+        return send(200, { ...rendered, text: s.content || '' });
+      }
       // 502, because the refusal is the pod's: the client asked correctly and
       // the post is still up. Reporting 200 here is what let a deleted post
       // stay publicly readable with nothing to show for it.
@@ -1172,6 +1266,11 @@ export class MastoApi {
           return send(200, this.status(patch ? (this.store.updateStatus(s.noteId, patch) || s) : s));
         } catch (e) { return send(422, { error: e.message }); }
       }
+      // A post that reached us through a connected account is not ours to
+      // address as the pod actor. Our own posts and our own inbox's timeline
+      // keep the AP path even when a connected account also saw them: where
+      // the pod identity has standing, it is the one that acts.
+      if (s.kind === 'acct') return this.acctAction(send, s, mAction[2]);
       const updated = await social[mAction[2]](this.agent, s);
       return send(200, this.status(updated || s));
     }