fedipod-server 0.7.0 → 0.9.0

package/lib/setup.mjs

@@ -11,6 +11,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { pathToFileURL } from 'node:url';
+import * as $rdf from 'rdflib';
 
 import { createAccountWithPod as realCreateAccount } from './account.mjs';
 import { mintCredential as realMint } from './remote.mjs';
@@ -20,8 +21,48 @@ import { rootOf, recordLastUsed, writeJsonAtomic } from './home.mjs';
 import { insecureUrlReason } from './safefetch.mjs';
 import { CURRENT_LAYOUT, isCurrent } from './migrate.mjs';
 
+const SOLID = $rdf.Namespace('http://www.w3.org/ns/solid/terms#');
+
 export const STEPS = ['account', 'credential', 'bootstrap', 'connect', 'publish', 'verify'];
 
+// Read-only pre-check on the pod behind an existing-pod setup, before a
+// credential is minted or the first write is attempted. Two failures it turns
+// from a bare "PUT … → 401" into a plain sentence:
+//   1. the pod host is unreachable — no account should be built on a pod that
+//      is not there;
+//   2. the pod's WebID document declares no OIDC issuer. A pod verifies a token
+//      by dereferencing its WebID and looking for solid:oidcIssuer; an empty or
+//      issuer-less profile makes it reject every write with 401, so setup would
+//      stall on the first one. Only judged when the document is publicly
+//      readable — a protected one cannot be read here and is left to bootstrap.
+export async function checkPodUsable(pod, { webId, fetch: doFetch = globalThis.fetch } = {}) {
+  const base = pod.endsWith('/') ? pod : pod + '/';
+  const wid = webId || new URL('profile/card#me', base).href;
+  const cardUrl = wid.split('#')[0];
+
+  let root;
+  try { root = await doFetch(base, { headers: { accept: 'text/turtle' } }); }
+  catch (e) { return { ok: false, error: `${base} could not be reached (${e.message}). Check the address and that the server is running.` }; }
+  if (root.status === 404) return { ok: false, error: `there is no pod at ${base} — the server answered 404.` };
+  if (root.status >= 500) return { ok: false, error: `the pod host at ${base} is not responding (HTTP ${root.status}).` };
+
+  let card;
+  try { card = await doFetch(cardUrl, { headers: { accept: 'text/turtle' } }); }
+  catch (e) { return { ok: false, error: `the pod's WebID document ${cardUrl} could not be read (${e.message}).` }; }
+  if (card.status === 404) return { ok: false, error: `the pod has no WebID document at ${cardUrl} — the identity it needs is missing.` };
+  if (card.status >= 500) return { ok: false, error: `the pod host is not serving ${cardUrl} (HTTP ${card.status}).` };
+  if (card.status === 401 || card.status === 403) return { ok: true };   // cannot read unauthenticated; leave it to bootstrap
+
+  const body = await card.text().catch(() => '');
+  const g = $rdf.graph();
+  try { $rdf.parse(body, g, cardUrl, (card.headers.get('content-type') || 'text/turtle').split(';')[0].trim()); }
+  catch { return { ok: false, error: `the pod's WebID document ${cardUrl} could not be parsed as RDF.` }; }
+  if (!g.each($rdf.sym(wid), SOLID('oidcIssuer'), null).length) {
+    return { ok: false, error: `the pod's WebID document ${cardUrl} declares no OIDC issuer, so the pod will reject every write. It looks empty or incomplete — restore it, or set up with a fresh pod.` };
+  }
+  return { ok: true };
+}
+
 export const credentialPath = (home) => path.join(home, 'credential.json');
 export const hasCredential = (home) => fs.existsSync(credentialPath(home));
 
@@ -118,6 +159,7 @@ export function preflight({ mode, pod, issuer, podName, handle, kind }) {
 export async function runSetup({ home, agent, answers, run, deps = {}, log = () => {} }) {
   const createAccount = deps.createAccountWithPod || realCreateAccount;
   const mint = deps.mintCredential || realMint;
+  const checkPod = deps.checkPodUsable || checkPodUsable;
 
   const at = (key) => run.steps.find(s => s.key === key);
   const begin = (key) => { at(key).state = 'running'; };
@@ -166,14 +208,21 @@ export async function runSetup({ home, agent, answers, run, deps = {}, log = ()
       }
       done('account', pod);
     } else {
+      // A pod you bring must be there and carry a usable WebID before a
+      // credential is minted against it — no account on a pod that is not
+      // reachable, and no silent 401 later on a pod whose profile is empty.
+      const usable = await checkPod(pod);
+      if (!usable.ok) throw new Error(usable.error);
       skip('account', 'using the pod you already have');
     }
 
     // --- credential: the point of no return, and the durability boundary ---
+    let resumeWebId = null;
     if (resuming) {
       const rec = JSON.parse(fs.readFileSync(credPath, 'utf8'));
       pod = rec.remotePod;
       root = rec.root;
+      resumeWebId = rec.webId || null;
       skip('credential', `already minted — ${credPath}`);
     } else {
       begin('credential');
@@ -212,6 +261,13 @@ export async function runSetup({ home, agent, answers, run, deps = {}, log = ()
 
     // --- provision the pod and bring federation up ---
     begin('bootstrap');
+    // Resuming skipped the checks the fresh paths ran, and the credential it
+    // carries may be the one bound to a pod whose profile is empty — the write
+    // below would 401. Catch it here, as this step, with a sentence.
+    if (resuming) {
+      const ready = await checkPod(pod, { webId: resumeWebId || undefined });
+      if (!ready.ok) throw new Error(ready.error);
+    }
     await agent.bootstrap({ handle, name: name || handle, root, kind, approveJoins, summary, icon, gateway });
     done('bootstrap');
 

package/lib/storage.mjs

@@ -61,9 +61,15 @@ export class HttpStorage {
     return { notModified: false, names, etag: res.headers.get('etag') };
   }
 
-  async read(p, { etag } = {}) {
+  // `accept` is for callers reading something that is RDF but is wanted as it
+  // was written: asking turtle-first for a JSON-LD document gets turtle back,
+  // because the server is entitled to convert between two RDF syntaxes.
+  async read(p, { etag, accept } = {}) {
     const res = await this.fetchImpl(this._url(p), {
-      headers: { accept: 'text/turtle, application/json;q=0.9, */*;q=0.8', ...(etag ? { 'if-none-match': etag } : {}) },
+      headers: {
+        accept: accept || 'text/turtle, application/json;q=0.9, */*;q=0.8',
+        ...(etag ? { 'if-none-match': etag } : {}),
+      },
     });
     if (res.status === 304) return { ok: true, notModified: true, status: 304, body: null, etag };
     if (res.status >= 400) return { ok: false, notModified: false, status: res.status, body: null, etag: null };

package/lib/store.mjs

@@ -343,7 +343,8 @@ export class PodStore {
   }
   addStatus(s) {
     const all = this.getStatuses();
-    if (all.some(x => x.noteId === s.noteId)) return;
+    const at = all.findIndex(x => x.noteId === s.noteId);
+    if (at >= 0) return this._mergeStatus(all, at, s);
     // Same reason as cacheActor: statuses.json is serialized whole on every
     // change, and remote content is only bounded by the 5 MB fetch ceiling.
     if (typeof s.content === 'string' && s.content.length > MAX_CONTENT) {
@@ -352,6 +353,30 @@ export class PodStore {
     all.unshift(s);
     this.write('statuses.json', all.slice(0, 1000));
     this.onEvent?.('status', s);            // streaming subscribers
+    return { added: true, merged: false, status: s };
+  }
+
+  // The same post arrives twice when two of the owner's accounts follow its
+  // author, and the second arrival is the only record that the other one saw
+  // it. Merged in place — the per-kind prune tails take the tail to be the
+  // oldest — and with no stream event, which would show the post twice.
+  _mergeStatus(all, at, s) {
+    const row = all[at];
+    const known = new Set((row.sourceAccts || []).map(v => v.acct));
+    const fresh = (s.sourceAccts || []).filter(v => v && !known.has(v.acct));
+    // Only our own verified intake may raise a row's kind. A general ladder
+    // would let a source that merely SAW a post promote a stranger's mention
+    // into the home timeline, which is the route tagfeed had to close.
+    const first = (k) => k === 'post' || k === 'timeline';
+    const raise = first(s.kind) && !first(row.kind);
+    if (!fresh.length && !raise) return { added: false, merged: false, status: row };
+    all[at] = {
+      ...row,
+      ...(fresh.length ? { sourceAccts: [...(row.sourceAccts || []), ...fresh] } : {}),
+      ...(raise ? { kind: s.kind, ...(s.slug ? { slug: s.slug } : {}) } : {}),
+    };
+    this.write('statuses.json', all);
+    return { added: false, merged: true, status: all[at] };
   }
   updateStatus(noteId, patch) {
     const all = this.getStatuses();

package/lib/wire.mjs

@@ -108,7 +108,7 @@ export const assertionKeyId = (urls) => urls.actor + '#ed25519-key';
 export function actorDoc({ urls, handle, name, publicKeyPem, assertionKey = null, movedTo = null, kind = 'person',
   approveJoins = false, summary = null, icon = null, image = null, fields = [],
   webId = null, aliases = [], moderators = null, pendingFollowers = null, pendingFollowing = null,
-  blocked = null, inbox = null }) {
+  blocked = null, inbox = null, outbox = null, oauthAuthorize = null, oauthToken = null }) {
   // manuallyApprovesFollowers is NOT in the base AS2 context, so it is declared
   // inline exactly as Mastodon declares it — and only when we actually use it.
   // It is what makes a client show "Request to follow" rather than "Follow" and
@@ -188,8 +188,23 @@ export function actorDoc({ urls, handle, name, publicKeyPem, assertionKey = null
     inbox: inbox || urls.inbox,
     // Every Mastodon actor publishes one. With a single actor per pod ours is
     // just the inbox, but its absence is the non-standard thing.
-    endpoints: { sharedInbox: inbox || urls.inbox },
-    outbox: urls.outbox,
+    //
+    // The two OAuth entries are how a client-to-server client finds its way in
+    // without being told anything by hand (ActivityPub 4.1). They appear only
+    // where this identity's client surface answers on an address a stranger
+    // can reach, which is why the caller supplies them rather than this
+    // building them from the pod URL.
+    endpoints: {
+      sharedInbox: inbox || urls.inbox,
+      ...(oauthAuthorize ? { oauthAuthorizationEndpoint: oauthAuthorize } : {}),
+      ...(oauthToken ? { oauthTokenEndpoint: oauthToken } : {}),
+    },
+    // Where a client sends what this actor writes, which the protocol says is
+    // this same address. The pod holds the collection and answers reads of it;
+    // a client-to-server write has to reach the agent, and the pod cannot take
+    // one. So where the agent is reachable it is named here, and a read of it
+    // is sent straight on to the pod's own document.
+    outbox: outbox || urls.outbox,
     // The pinned posts, as the collection other servers read when they show
     // this profile. Mastodon's term, declared the way Mastodon declares it.
     featured: urls.featured,
@@ -243,8 +258,8 @@ ${icon ? `<img class="avatar" src="${esc(icon)}" alt="">` : ''}
 <h1>${esc(name)}</h1>
 <p class="address">${esc(address)}</p>
 ${summary ? `<div>${summary}</div>` : ''}
-<p>This is ${what} on the fediverse. To follow it, paste the address above
-into the search box of Mastodon or any fediverse app — or use the form.</p>
+<p>This is ${what} on the Fediverse. To follow it, paste the address above
+into the search box of Mastodon or any Fediverse app — or use the form.</p>
 <form id="follow">
   <label for="server">your server</label>
   <input id="server" type="text" placeholder="mastodon.social" autocomplete="off"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fedipod-server",
-  "version": "0.7.0",
+  "version": "0.9.0",
   "description": "The FediPod Server: a full ActivityPub server as a Community Solid Server component.",
   "license": "MIT",
   "main": "dist/index.js",