fedipod-server 0.7.0 → 0.8.0

package/lib/remote.mjs

@@ -29,6 +29,12 @@ export { mintCredential, discoverTokenEndpoint, revokeCredentialViaAccount };
 // opened — and the callers' existing retry paths take it from there.
 // The parser is shared with the outbound path; see lib/safefetch.mjs.
 import { retryAfterMs, readCapped } from './safefetch.mjs';
+import { linkTargets, REL } from './links.mjs';
+
+// A pod whose access rules are ACP policies, not WAC authorizations. This
+// agent writes WAC; over an ACP resource that would be noise where the pod's
+// real rules used to be, so it stops instead.
+const ACP_NS = 'http://www.w3.org/ns/solid/acp#';
 
 // The inbox is public-Append, so the listing's size is in other people's
 // hands; reading it whole must still have a ceiling.
@@ -82,6 +88,11 @@ export class RemotePod {
     this.pausedUntil = 0;
     this.probeCount = 0;
     this.log = log;
+    // Where each resource's access control lives, as the pod itself said. WAC
+    // forbids working it out from the resource's own URL, so it is asked for
+    // and remembered rather than assembled.
+    this.aclUrls = new Map();
+    this.aclFlavour = null;      // null until the first write asks what this pod speaks
     // A fronted identity advertises ids on a shared domain but writes to the
     // pod. run-agent installs the fronted→pod mapping here, so every request
     // built from an advertised id lands on the pod — one choke point, and
@@ -153,9 +164,63 @@ export class RemotePod {
       method: 'PUT', headers: { 'content-type': contentType }, body,
     });
     if (res.status >= 400) throw new Error(`PUT ${url} → ${res.status}`);
+    // Writing a document is usually the step before setting its access, and
+    // the answer to the write already says where that lives. Taking it here
+    // spares the extra request the ACL write would otherwise make.
+    this.noteAclLink(url, res);
     return res;
   }
 
+  /** Remember an access-control location the pod volunteered on a response. */
+  noteAclLink(url, res) {
+    if (this.aclUrls.has(url)) return;
+    const [acl] = linkTargets(res?.headers?.get?.('link'), REL.acl, url);
+    if (acl) this.aclUrls.set(url, acl);
+  }
+
+  /**
+   * Where this resource's access control lives. The pod says so on any
+   * response about the resource; a pod that says nothing is taken to keep it
+   * at the usual suffix, which is what every server this runs against does.
+   */
+  async aclUrlFor(targetUrl) {
+    const known = this.aclUrls.get(targetUrl);
+    if (known) return known;
+    try {
+      const res = await this.fetch(targetUrl, { method: 'HEAD' });
+      this.noteAclLink(targetUrl, res);
+    } catch { /* unreachable or no such resource yet: the suffix below */ }
+    const resolved = this.aclUrls.get(targetUrl) || targetUrl + '.acl';
+    this.aclUrls.set(targetUrl, resolved);
+    return resolved;
+  }
+
+  /**
+   * Whether writing a WAC document here is meaningful. Asked once per pod, on
+   * the first access-control write. A pod that answers with ACP policies is
+   * left alone: replacing them with authorizations it does not read would take
+   * away the rules actually protecting it.
+   */
+  async aclWritable(aclUrl) {
+    if (this.aclFlavour !== null) return this.aclFlavour;
+    this.aclFlavour = true;
+    try {
+      const res = await this.fetch(aclUrl, { headers: { accept: 'text/turtle' } });
+      if (res.status < 300) {
+        const g = $rdf.graph();
+        $rdf.parse(await res.text(), g, aclUrl, 'text/turtle');
+        const acp = g.statements.some(st => st.predicate.value.startsWith(ACP_NS)
+          || st.object.value.startsWith(ACP_NS));
+        if (acp) {
+          this.aclFlavour = false;
+          this.log('this pod states access as ACP policies, which this agent does not write — '
+            + 'its access rules are left exactly as they are, and nothing here is published private');
+        }
+      }
+    } catch { /* absent, unreadable or unparsable: WAC is what we write */ }
+    return this.aclFlavour;
+  }
+
   async putJson(url, obj, contentType = 'application/activity+json') {
     return this.put(url, JSON.stringify(obj), contentType);
   }
@@ -173,6 +238,11 @@ export class RemotePod {
 
   async delete(url) {
     protectedFromDeletion(url);
+    // The pattern list above knows the usual name for an access-control
+    // document. One the pod named itself is just as fatal to remove.
+    for (const acl of this.aclUrls.values()) {
+      if (acl === url) throw new Error(`refusing to DELETE an access-control document: ${url}`);
+    }
     const res = await this.fetch(url, { method: 'DELETE' });
     return res.status < 400 || res.status === 404;
   }
@@ -238,8 +308,8 @@ export class RemotePod {
   // $rdf.sym() also throws on an illegal IRI, so a pod URL with something odd
   // in it fails here rather than silently producing a document that means
   // something else.
-  aclDoc(targetUrl, publicModes, { appendAgents = [] } = {}) {
-    const url = targetUrl + '.acl';
+  aclDoc(targetUrl, publicModes, { appendAgents = [], aclUrl = null } = {}) {
+    const url = aclUrl || targetUrl + '.acl';
     const doc = $rdf.sym(url);
     const target = $rdf.sym(targetUrl);
     const g = $rdf.graph();
@@ -263,7 +333,9 @@ export class RemotePod {
   }
 
   async setAcl(targetUrl, publicModes, opts = {}) {
-    return this.put(targetUrl + '.acl', this.aclDoc(targetUrl, publicModes, opts), 'text/turtle');
+    const url = await this.aclUrlFor(targetUrl);
+    if (!await this.aclWritable(url)) return null;
+    return this.put(url, this.aclDoc(targetUrl, publicModes, { ...opts, aclUrl: url }), 'text/turtle');
   }
 
   // The WebID profile advertises the actor as an account:
@@ -295,9 +367,53 @@ export class RemotePod {
     const stale = g.statementsMatching(actor, FOAF('accountName'), null, doc)
       .filter(st => st.object.value !== accountName);
     if (!missing.length && !stale.length) return false;
+    // A patch touches these statements and nothing else. Rewriting the whole
+    // profile re-serialises statements that are not ours — the OIDC issuer
+    // among them — and a server is entitled to refuse a write that would.
+    const deletes = stale.map(st => [ st.subject, st.predicate, st.object ]);
+    if (await this.patchDocument(docUrl, missing, deletes)) return true;
     for (const st of stale) g.remove(st);
     for (const [s, p, o] of missing) g.add(s, p, o, doc);
     await this.put(docUrl, $rdf.serialize(doc, g, docUrl, 'text/turtle'), 'text/turtle');
     return true;
   }
+
+  /**
+   * An N3 Patch of exactly these statements, or false when the pod will not
+   * take one and the caller should write the document instead.
+   *
+   * The statements are serialised by rdflib; only the wrapper naming what is
+   * being patched is assembled here, because N3's braces have no rdflib form.
+   */
+  n3Patch(docUrl, inserts, deletes) {
+    const block = (triples) => {
+      const g = $rdf.graph();
+      for (const [s, p, o] of triples) g.add(s, p, o);
+      return $rdf.serialize(null, g, docUrl, 'application/n-triples').trim();
+    };
+    const clauses = [];
+    if (deletes.length) clauses.push(`  solid:deletes { ${block(deletes)} }`);
+    if (inserts.length) clauses.push(`  solid:inserts { ${block(inserts)} }`);
+    return `@prefix solid: <http://www.w3.org/ns/solid/terms#>.\n`
+      + `<> a solid:InsertDeletePatch;\n${clauses.join(';\n')}.\n`;
+  }
+
+  async patchDocument(docUrl, inserts, deletes) {
+    let res;
+    try {
+      res = await this.fetch(docUrl, {
+        method: 'PATCH',
+        headers: { 'content-type': 'text/n3' },
+        body: this.n3Patch(docUrl, inserts, deletes),
+      });
+    } catch {
+      return false;   // no PATCH on this transport at all
+    }
+    if (res.status < 300) return true;
+    // The pod cannot patch. Anything else — a 409 saying what we meant to
+    // remove is not there any more — is a real answer, and rewriting the whole
+    // document over the top of it would destroy whatever changed it.
+    if (res.status === 405 || res.status === 415 || res.status === 501) return false;
+    throw new Error(`PATCH ${docUrl} → ${res.status}`);
+  }
 }

package/lib/setup.mjs

@@ -11,6 +11,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { pathToFileURL } from 'node:url';
+import * as $rdf from 'rdflib';
 
 import { createAccountWithPod as realCreateAccount } from './account.mjs';
 import { mintCredential as realMint } from './remote.mjs';
@@ -20,8 +21,48 @@ import { rootOf, recordLastUsed, writeJsonAtomic } from './home.mjs';
 import { insecureUrlReason } from './safefetch.mjs';
 import { CURRENT_LAYOUT, isCurrent } from './migrate.mjs';
 
+const SOLID = $rdf.Namespace('http://www.w3.org/ns/solid/terms#');
+
 export const STEPS = ['account', 'credential', 'bootstrap', 'connect', 'publish', 'verify'];
 
+// Read-only pre-check on the pod behind an existing-pod setup, before a
+// credential is minted or the first write is attempted. Two failures it turns
+// from a bare "PUT … → 401" into a plain sentence:
+//   1. the pod host is unreachable — no account should be built on a pod that
+//      is not there;
+//   2. the pod's WebID document declares no OIDC issuer. A pod verifies a token
+//      by dereferencing its WebID and looking for solid:oidcIssuer; an empty or
+//      issuer-less profile makes it reject every write with 401, so setup would
+//      stall on the first one. Only judged when the document is publicly
+//      readable — a protected one cannot be read here and is left to bootstrap.
+export async function checkPodUsable(pod, { webId, fetch: doFetch = globalThis.fetch } = {}) {
+  const base = pod.endsWith('/') ? pod : pod + '/';
+  const wid = webId || new URL('profile/card#me', base).href;
+  const cardUrl = wid.split('#')[0];
+
+  let root;
+  try { root = await doFetch(base, { headers: { accept: 'text/turtle' } }); }
+  catch (e) { return { ok: false, error: `${base} could not be reached (${e.message}). Check the address and that the server is running.` }; }
+  if (root.status === 404) return { ok: false, error: `there is no pod at ${base} — the server answered 404.` };
+  if (root.status >= 500) return { ok: false, error: `the pod host at ${base} is not responding (HTTP ${root.status}).` };
+
+  let card;
+  try { card = await doFetch(cardUrl, { headers: { accept: 'text/turtle' } }); }
+  catch (e) { return { ok: false, error: `the pod's WebID document ${cardUrl} could not be read (${e.message}).` }; }
+  if (card.status === 404) return { ok: false, error: `the pod has no WebID document at ${cardUrl} — the identity it needs is missing.` };
+  if (card.status >= 500) return { ok: false, error: `the pod host is not serving ${cardUrl} (HTTP ${card.status}).` };
+  if (card.status === 401 || card.status === 403) return { ok: true };   // cannot read unauthenticated; leave it to bootstrap
+
+  const body = await card.text().catch(() => '');
+  const g = $rdf.graph();
+  try { $rdf.parse(body, g, cardUrl, (card.headers.get('content-type') || 'text/turtle').split(';')[0].trim()); }
+  catch { return { ok: false, error: `the pod's WebID document ${cardUrl} could not be parsed as RDF.` }; }
+  if (!g.each($rdf.sym(wid), SOLID('oidcIssuer'), null).length) {
+    return { ok: false, error: `the pod's WebID document ${cardUrl} declares no OIDC issuer, so the pod will reject every write. It looks empty or incomplete — restore it, or set up with a fresh pod.` };
+  }
+  return { ok: true };
+}
+
 export const credentialPath = (home) => path.join(home, 'credential.json');
 export const hasCredential = (home) => fs.existsSync(credentialPath(home));
 
@@ -118,6 +159,7 @@ export function preflight({ mode, pod, issuer, podName, handle, kind }) {
 export async function runSetup({ home, agent, answers, run, deps = {}, log = () => {} }) {
   const createAccount = deps.createAccountWithPod || realCreateAccount;
   const mint = deps.mintCredential || realMint;
+  const checkPod = deps.checkPodUsable || checkPodUsable;
 
   const at = (key) => run.steps.find(s => s.key === key);
   const begin = (key) => { at(key).state = 'running'; };
@@ -166,14 +208,21 @@ export async function runSetup({ home, agent, answers, run, deps = {}, log = ()
       }
       done('account', pod);
     } else {
+      // A pod you bring must be there and carry a usable WebID before a
+      // credential is minted against it — no account on a pod that is not
+      // reachable, and no silent 401 later on a pod whose profile is empty.
+      const usable = await checkPod(pod);
+      if (!usable.ok) throw new Error(usable.error);
       skip('account', 'using the pod you already have');
     }
 
     // --- credential: the point of no return, and the durability boundary ---
+    let resumeWebId = null;
     if (resuming) {
       const rec = JSON.parse(fs.readFileSync(credPath, 'utf8'));
       pod = rec.remotePod;
       root = rec.root;
+      resumeWebId = rec.webId || null;
       skip('credential', `already minted — ${credPath}`);
     } else {
       begin('credential');
@@ -212,6 +261,13 @@ export async function runSetup({ home, agent, answers, run, deps = {}, log = ()
 
     // --- provision the pod and bring federation up ---
     begin('bootstrap');
+    // Resuming skipped the checks the fresh paths ran, and the credential it
+    // carries may be the one bound to a pod whose profile is empty — the write
+    // below would 401. Catch it here, as this step, with a sentence.
+    if (resuming) {
+      const ready = await checkPod(pod, { webId: resumeWebId || undefined });
+      if (!ready.ok) throw new Error(ready.error);
+    }
     await agent.bootstrap({ handle, name: name || handle, root, kind, approveJoins, summary, icon, gateway });
     done('bootstrap');
 

package/lib/store.mjs

@@ -343,7 +343,8 @@ export class PodStore {
   }
   addStatus(s) {
     const all = this.getStatuses();
-    if (all.some(x => x.noteId === s.noteId)) return;
+    const at = all.findIndex(x => x.noteId === s.noteId);
+    if (at >= 0) return this._mergeStatus(all, at, s);
     // Same reason as cacheActor: statuses.json is serialized whole on every
     // change, and remote content is only bounded by the 5 MB fetch ceiling.
     if (typeof s.content === 'string' && s.content.length > MAX_CONTENT) {
@@ -352,6 +353,30 @@ export class PodStore {
     all.unshift(s);
     this.write('statuses.json', all.slice(0, 1000));
     this.onEvent?.('status', s);            // streaming subscribers
+    return { added: true, merged: false, status: s };
+  }
+
+  // The same post arrives twice when two of the owner's accounts follow its
+  // author, and the second arrival is the only record that the other one saw
+  // it. Merged in place — the per-kind prune tails take the tail to be the
+  // oldest — and with no stream event, which would show the post twice.
+  _mergeStatus(all, at, s) {
+    const row = all[at];
+    const known = new Set((row.sourceAccts || []).map(v => v.acct));
+    const fresh = (s.sourceAccts || []).filter(v => v && !known.has(v.acct));
+    // Only our own verified intake may raise a row's kind. A general ladder
+    // would let a source that merely SAW a post promote a stranger's mention
+    // into the home timeline, which is the route tagfeed had to close.
+    const first = (k) => k === 'post' || k === 'timeline';
+    const raise = first(s.kind) && !first(row.kind);
+    if (!fresh.length && !raise) return { added: false, merged: false, status: row };
+    all[at] = {
+      ...row,
+      ...(fresh.length ? { sourceAccts: [...(row.sourceAccts || []), ...fresh] } : {}),
+      ...(raise ? { kind: s.kind, ...(s.slug ? { slug: s.slug } : {}) } : {}),
+    };
+    this.write('statuses.json', all);
+    return { added: false, merged: true, status: all[at] };
   }
   updateStatus(noteId, patch) {
     const all = this.getStatuses();

package/lib/wire.mjs

@@ -243,8 +243,8 @@ ${icon ? `<img class="avatar" src="${esc(icon)}" alt="">` : ''}
 <h1>${esc(name)}</h1>
 <p class="address">${esc(address)}</p>
 ${summary ? `<div>${summary}</div>` : ''}
-<p>This is ${what} on the fediverse. To follow it, paste the address above
-into the search box of Mastodon or any fediverse app — or use the form.</p>
+<p>This is ${what} on the Fediverse. To follow it, paste the address above
+into the search box of Mastodon or any Fediverse app — or use the form.</p>
 <form id="follow">
   <label for="server">your server</label>
   <input id="server" type="text" placeholder="mastodon.social" autocomplete="off"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fedipod-server",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "description": "The FediPod Server: a full ActivityPub server as a Community Solid Server component.",
   "license": "MIT",
   "main": "dist/index.js",