fedipod-server 0.8.0 → 0.10.0

package/README.md

@@ -124,6 +124,15 @@ with the password. The authorization code is bound to the client's registered
 redirect, and only that client, holding its secret, can exchange it for a
 token.
 
+An ActivityPub client needs none of that arranged by hand. The actor says
+where to sign in, and `/.well-known/oauth-authorization-server` says the same
+thing at the address such clients look for first. An app that keeps no secret,
+which is anything running in a browser, signs in by answering a challenge it
+set at the start. An app that publishes a document about itself is known by
+that document's address and registers nothing here. Once in, it posts to the
+outbox the actor names, and reads what the identity received at `/ap/inbox`,
+which nobody but the owner may read.
+
 A client API is rooted at an origin, so each identity needs an origin of its
 own: subdomain pods, one per identity. A second identity on a host is
 refused at opt-in rather than half-working.
@@ -147,6 +156,7 @@ curl -X POST https://mei.example.org/fedipod/config \
 **Some pod paths stop being served.** On an identity's origin the paths above
 belong to the identity, so pod resources at those names — a container called
 `api`, `oauth` or `fedipod`, or documents at `ap/actor`, `ap/outbox`,
+`ap/inbox`, `.well-known/oauth-authorization-server`,
 `.well-known/nodeinfo` and `nodeinfo/2.0` — are not served over HTTP there.
 They stay in the pod and in its listings. Every other path is the pod, exactly
 as before.

package/dist/claims.js

@@ -23,7 +23,17 @@ function claims(input, frontHost) {
 // What an identity answers on its own pod's origin: the protocol routes other
 // software addresses it by, and the one path its owner's pages live under.
 // Everything else on that origin is the pod, and falls through to CSS.
-const AGENT_PATHS = new Set(['/ap/actor', '/ap/outbox', '/.well-known/nodeinfo', '/nodeinfo/2.0']);
+const AGENT_PATHS = new Set([
+    '/ap/actor', '/ap/outbox',
+    // The owner reading their own mail. Deliveries still go to the inbox
+    // container on the pod, which the actor document names; nothing about
+    // receiving changes, and nothing at this address was ever served before.
+    '/ap/inbox',
+    '/.well-known/nodeinfo', '/nodeinfo/2.0',
+    // Where a client looks first to learn how to sign in. Nothing was served
+    // at this name before, so no pod resource is displaced.
+    '/.well-known/oauth-authorization-server',
+]);
 const AGENT_PREFIXES = ['/api/', '/oauth/'];
 /**
  * True when this request belongs to an identity's client surface.

package/lib/admin.mjs

@@ -485,9 +485,19 @@ export function buildAdminSurface({ agent, gate, allowed, log = console.log,
       // C2S (ActivityPub §6) carries its own authentication — a Solid-OIDC
       // DPoP proof or the facade's bearer — so the dk-token gate does not
       // stand in front of it. The Host/Origin firewall above still does.
-      if (p === '/ap/outbox' || p === '/ap/actor') {
+      if (p === '/ap/outbox' || p === '/ap/actor' || p === '/ap/inbox') {
         if (await c2s.handle(req, res, p, url)) return;
       }
+      // Where a client looks first to find out how to sign in (RFC 8414), and
+      // in front of the door for the same reason C2S is: a client that has to
+      // be handed a secret before it can ask how to sign in cannot set itself
+      // up at all. It names endpoints and nothing else, the endpoints it names
+      // refuse without a password anyway, and the host and origin firewall
+      // above still decides who gets this far.
+      if (p === '/.well-known/oauth-authorization-server') {
+        const scheme = req.socket.encrypted || req.headers['x-forwarded-proto'] === 'https' ? 'https' : 'http';
+        return json(res, 200, masto.authorizationServerMetadata(`${scheme}://${req.headers.host}`));
+      }
       if (atDoor && gate(req, res)) return;
       if (p === '/api/v1/streaming/health') {
         res.writeHead(200, { 'content-type': 'text/plain' }); res.end('OK'); return;

package/lib/c2s.mjs

@@ -5,14 +5,26 @@
 // SAME helper the facade and admin surfaces use — this module re-implements
 // no persistence and no delivery, so one write path stays one.
 //
-// GETs are redirects: the pod's documents are the canonical actor and outbox,
-// and a second renderer here would only drift from them.
+// GETs on the actor and outbox are redirects: the pod's documents are the
+// canonical ones, and a second renderer here would only drift from them.
+//
+// The inbox is the exception, and has to be. Deliveries land in a container on
+// the pod which the drain empties as it handles each item, so reading that
+// container tells the owner only what has not been dealt with yet. What was
+// actually received is whole only in the archive, so §5.2's "the owner can
+// read their own inbox" is served from there, by this agent, to the owner
+// alone.
 
 import * as social from './social.mjs';
 import * as wire from './wire.mjs';
 
 const MAX_BODY = 512 * 1024;          // same ceiling the inbox drain enforces
 
+// How many archived items one page of the inbox will read. A page is one
+// month, and a month with more than this is served short rather than costing
+// the pod an unbounded read; the log says when that happened.
+const MAX_INBOX_PAGE = 500;
+
 // §6 names activities; anything else with a type is an object to wrap.
 const ACTIVITY_TYPES = new Set([
   'Create', 'Update', 'Delete', 'Follow', 'Like', 'Announce', 'Undo',
@@ -60,14 +72,102 @@ export class C2S {
     return iri ? this.store.getStatuses().find((s) => s.noteId === iri) : null;
   }
 
+  /** The months the archive holds, newest first. One container listing. */
+  async archiveMonths() {
+    const archive = this.agent.intake?.archive;
+    if (!archive) return [];
+    const { names } = await archive.list('');
+    return (names || [])
+      .map((n) => n.replace(/\/$/u, ''))
+      .filter((n) => /^\d{4}-\d{2}$/u.test(n))
+      .sort()
+      .reverse();
+  }
+
+  /**
+   * The owner's own inbox, §5.2. Paged by month because that is how the
+   * archive is stored, so a page costs one listing and a read per item and no
+   * page is dearer for another month being large.
+   */
+  async sendInbox(res, url) {
+    const id = `${this.urls.base}ap/inbox`;
+    const page = url?.searchParams?.get('page') || null;
+    let months;
+    try {
+      months = await this.archiveMonths();
+    } catch (e) {
+      return this.send(res, 502, { error: `the archive could not be read: ${e.message}` });
+    }
+
+    if (!page) {
+      if (!months.length && this.store.getConfig()?.archiveInbox === false) {
+        this.log('inbox read: nothing to show — this identity does not keep what it receives');
+      }
+      return this.send(res, 200, {
+        '@context': wire.AS_CTX, id, type: 'OrderedCollection',
+        ...(months.length ? { first: `${id}?page=${months[0]}` } : { orderedItems: [] }),
+      });
+    }
+    if (!/^\d{4}-\d{2}$/u.test(page)) {
+      return this.send(res, 400, { error: 'page names a month, written 2026-09' });
+    }
+
+    const archive = this.agent.intake?.archive;
+    let names = [];
+    try {
+      // The trailing slash matters: without it this names a document, not the
+      // container, and a pod answers about the wrong thing.
+      ({ names } = await archive.list(`${page}/`));
+    } catch (e) {
+      return this.send(res, 502, { error: `the archive could not be read: ${e.message}` });
+    }
+    const files = (names || []).filter((n) => n.endsWith('.json')).sort();
+    if (files.length > MAX_INBOX_PAGE) {
+      this.log(`inbox read: ${page} holds ${files.length} items; serving the first ${MAX_INBOX_PAGE}`);
+    }
+    const kept = [];
+    for (const file of files.slice(0, MAX_INBOX_PAGE)) {
+      // Read as written: these records are JSON-LD, and the default read asks
+      // turtle-first, which a server is free to answer with turtle.
+      const read = await archive.read(`${page}/${file}`, { accept: '*/*' });
+      if (!read?.ok || !read.body) continue;
+      try {
+        const record = JSON.parse(read.body);
+        // The record wraps the bytes as they arrived; the activity is those
+        // bytes, not a retelling of them.
+        kept.push({ at: record.receivedAt || '', activity: JSON.parse(record.raw) });
+      } catch { /* a record that will not parse is not one that can be served */ }
+    }
+    kept.sort((a, b) => String(b.at).localeCompare(String(a.at)));
+    const older = months.filter((m) => m < page)[0] || null;
+    return this.send(res, 200, {
+      '@context': wire.AS_CTX,
+      id: `${id}?page=${page}`,
+      type: 'OrderedCollectionPage',
+      partOf: id,
+      ...(older ? { next: `${id}?page=${older}` } : {}),
+      orderedItems: kept.map((k) => k.activity),
+    });
+  }
+
   async handle(req, res, pathname, url) {   // eslint-disable-line no-unused-vars
-    if (pathname !== '/ap/outbox' && pathname !== '/ap/actor') return false;
+    if (pathname !== '/ap/outbox' && pathname !== '/ap/actor' && pathname !== '/ap/inbox') return false;
     if (req.method === 'OPTIONS') {
-      res.writeHead(204, { allow: 'GET, POST, OPTIONS' }); res.end(); return true;
+      res.writeHead(204, { allow: pathname === '/ap/inbox' ? 'GET, OPTIONS' : 'GET, POST, OPTIONS' });
+      res.end(); return true;
     }
     if (!this.agent.configured() || !this.urls) {
       return this.send(res, 409, { error: 'agent not configured' });
     }
+    if (pathname === '/ap/inbox') {
+      if (req.method !== 'GET' && req.method !== 'HEAD') {
+        return this.send(res, 405, { error: "deliveries go to this actor's inbox on the pod, which the "
+          + 'actor document names; this address is the owner reading their own' });
+      }
+      const reader = await this.auth(req, pathname);
+      if (!reader.ok) return this.send(res, reader.status, { error: reader.error });
+      return this.sendInbox(res, url);
+    }
     if (req.method === 'GET' || req.method === 'HEAD') {
       // The pod's copy is the document; send the reader there.
       const target = pathname === '/ap/actor' ? this.urls.actor : this.urls.outbox;
@@ -134,8 +234,9 @@ export class C2S {
 
     switch (activity.type) {
       case 'Create': {
-        if (!object || (object.type && object.type !== 'Note')) {
-          return this.send(res, 422, { error: 'only a Note (or a bare Note) can be created here' });
+        const makes = object?.type || 'Note';
+        if (!object || (makes !== 'Note' && makes !== 'Question')) {
+          return this.send(res, 422, { error: 'only a Note or a Question (or a bare Note) can be created here' });
         }
         const visibility = this.visibilityOf(activity, object);
         if (!visibility) {
@@ -146,6 +247,30 @@ export class C2S {
         // visible characters rather than as markup. Documented v1 limit.
         const text = String(object.source?.content ?? object.content ?? '');
         if (!text.trim()) return this.send(res, 422, { error: 'the note has no content' });
+
+        // A Question is a poll: the choices are in oneOf (pick one) or anyOf
+        // (pick several), each naming itself, and endTime is when it shuts.
+        if (makes === 'Question') {
+          const one = arr(object.oneOf);
+          const many = arr(object.anyOf);
+          const titles = (one.length ? one : many).map((c) => String(c?.name ?? '').trim()).filter(Boolean);
+          try {
+            const question = await agent.publisher.publishQuestion(text, {
+              options: titles,
+              multiple: !one.length && many.length > 0,
+              expiresAt: object.endTime || null,
+              inReplyTo: idOf(object.inReplyTo) || undefined,
+              visibility,
+              spoilerText: object.summary || null,
+            });
+            return this.send(res, 201,
+              { id: wire.createActivityId(question.id), object: question.id },
+              { location: wire.createActivityId(question.id) });
+          } catch (e) {
+            return this.send(res, 422, { error: e.message });
+          }
+        }
+
         const attachments = arr(object.attachment).map((a) => ({
           url: a?.url, mediaType: a?.mediaType,
           ...(a?.name ? { description: a.name } : {}),

package/lib/embed.mjs

@@ -202,6 +202,7 @@ export async function startEmbeddedAgent({
     agent.importer?.stop();
     clearInterval(agent.schedTimer);
     clearInterval(agent.refreshTimer);
+    agent.publisher?.stopPolls();
     // Same order the standalone agent's shutdown uses: write what is pending,
     // then let go of the lease so the next agent need not wait out the TTL.
     await Promise.allSettled([

package/lib/intake.mjs

@@ -19,6 +19,7 @@ import { USER_AGENT } from './ua.mjs';
 import { PUBLIC } from './wire.mjs';
 import { HTTP_TIMEOUT_MS, readCapped } from './safefetch.mjs';
 import { linkTargets, REL } from './links.mjs';
+import * as polls from './polls.mjs';
 import { dropFollower } from './store.mjs';
 
 const RDF = $rdf.Namespace('http://www.w3.org/1999/02/22-rdf-syntax-ns#');
@@ -349,13 +350,18 @@ export class Intake {
       || g.each(null, NOTIFY('channelType'), NOTIFY('WebSocketChannel2023'), null)
         .map(n => n.value).find(Boolean);
     if (!channel) { this.wsState = 'unavailable'; this.log('no WebSocketChannel2023 service — polling only'); return; }
+    // The topic is a POD resource, and it travels in the BODY — so the url map
+    // RemotePod applies to the request line never reaches it. A fronted
+    // identity's inbox url names the front, which the pod cannot grant read on,
+    // and the subscription came back 403. A no-op when unfronted.
+    const topic = this.urls.toPod ? this.urls.toPod(this.urls.inbox) : this.urls.inbox;
     const sub = await this.remote.fetch(channel, {
       method: 'POST',
       headers: { 'content-type': 'application/ld+json' },
       body: JSON.stringify({
         '@context': ['https://www.w3.org/ns/solid/notification/v1'],
         type: 'http://www.w3.org/ns/solid/notifications#WebSocketChannel2023',
-        topic: this.urls.inbox,
+        topic,
       }),
     });
     const body = await readCapped(sub).then(JSON.parse).catch(() => null);
@@ -1426,6 +1432,22 @@ export class Intake {
     // somebody else's boost, or through a hashtag feed.
     if (this.store.isBlocked(author)) return `blocked author (${author})`;
 
+    // An answer to one of our polls is a number on a document, not a post. It
+    // arrives as an ordinary reply naming an option and carrying nothing else,
+    // so filing it as one would put a blank entry in the thread and ring the
+    // owner once per voter. Counted or refused — a second answer, an option we
+    // do not offer, a poll already shut — it stops here either way.
+    const asked = note.inReplyTo && this.store.getStatuses()
+      .find(x => x.noteId === String(note.inReplyTo) && x.kind === 'post' && x.poll);
+    if (asked && polls.isVoteShape(note)) {
+      const counted = await this.publisher.recordVote(asked.noteId, author, note.name)
+        .catch(e => { this.log(`vote on ${asked.noteId}: ${e.message}`); return false; });
+      this.log(counted
+        ? `vote counted (${note.name}): ${asked.noteId}`
+        : `vote not counted (${note.name}) from ${author}: ${asked.noteId}`);
+      return;
+    }
+
     // Anyone can Append to a public inbox, so arriving is not the same as
     // belonging in the home timeline. Follow Mastodon's split: people you
     // follow (and their boosts) are HOME; anyone else is a MENTION — kept,