fedipod-server 0.9.0 → 0.11.0

package/web/front/run.js

@@ -0,0 +1,107 @@
+// run.js — the opt-in / opt-out page's script, in a file of its own.
+//
+// It lived inline in run.html until 2026-09-09. Out here the page can be served
+// under `script-src 'self'`, which is what stops a stray bit of markup from
+// becoming running code; inline script cannot be told apart from injected
+// script by any policy. Served by the front at /run.js.
+//
+// A module, because it awaits an import of /solid-oidc-client.js at the top
+// level — which is itself the proof this mechanism works: that file has been
+// loaded from a route by this page all along.
+const $ = (id) => document.getElementById(id);
+
+// The Solid-OIDC client for the sign-in round trip. Constructed once; the
+// redirect state (PKCE, csrf) lives in this tab's sessionStorage, so the same
+// session finishes the login on the way back.
+let session = null;
+try {
+  const { SessionCore } = await import('/solid-oidc-client.js');
+  session = new SessionCore({ redirect_uris: [location.origin + '/run'], client_name: 'FediPod gateway' });
+} catch { /* leave null — the "did not load" notes below fire */ }
+
+// Offered only where this server actually runs identities. An
+// unauthenticated probe tells the two apart: 501 = not offered here,
+// anything else = offered (a real opt-in still needs the signed-in proof).
+let offered = true;
+(async () => {
+  const res = await fetch('/api/agent', { method: 'POST',
+    headers: { 'content-type': 'application/json' }, body: '{}' }).catch(() => null);
+  if (!res || res.status === 501) {
+    offered = false;
+    const n = $('run-note');
+    n.hidden = false;
+    n.textContent = 'This server does not run identities. Your agent stays where it is.';
+    runFormCheck();
+  }
+})();
+
+function runFormCheck() {
+  let ok = false;
+  try { ok = /^https?:$/.test(new URL($('run-pod-url').value.trim()).protocol); } catch { /* not yet */ }
+  const issuerOk = /^https?:\/\/\S+/.test($('run-issuer').value.trim());
+  $('run-continue').disabled = !(offered && ok && issuerOk);
+  $('run-leave').disabled = !(offered && ok && issuerOk);
+}
+$('run-pod-url').addEventListener('input', () => {
+  runFormCheck();
+  // The identity provider is usually the server itself — still editable.
+  try {
+    const u = new URL($('run-pod-url').value.trim());
+    const apex = u.hostname.split('.').slice(1).join('.');
+    if (!$('run-issuer').value && apex) $('run-issuer').value = `${u.protocol}//${apex}${u.port ? ':' + u.port : ''}`;
+  } catch { /* not a URL yet */ }
+  runFormCheck();
+});
+$('run-issuer').addEventListener('input', runFormCheck);
+
+const runStart = (action) => {
+  const n = $('run-note');
+  if (!session) { n.hidden = false; n.textContent = 'the sign-in library did not load — reload and try again'; return; }
+  const u = new URL($('run-pod-url').value.trim());
+  if (u.pathname === '') u.pathname = '/';
+  if (!u.pathname.endsWith('/')) u.pathname += '/';
+  u.search = ''; u.hash = '';
+  sessionStorage.setItem('fp-run', JSON.stringify({ podBase: u.href, action }));
+  session.login($('run-issuer').value.trim(), location.origin + '/run')
+    .catch((e) => { n.hidden = false; n.textContent = 'sign-in failed to start: ' + e.message; });
+};
+$('run-continue').onclick = () => runStart('opt-in');
+$('run-leave').onclick = () => runStart('opt-out');
+
+// Back from the identity provider: finish the opt-in with the proven login.
+(async () => {
+  if (!session) return;
+  await session.handleRedirectFromLogin().catch(() => {});
+  const pending = sessionStorage.getItem('fp-run');
+  if (!session.isActive || !pending) return;
+  sessionStorage.removeItem('fp-run');
+  const p = JSON.parse(pending);
+  const n = $('run-note');
+  n.hidden = false;
+  n.textContent = 'signed in as ' + session.webId + ' — asking the server…';
+  // The signed fetch builds a DPoP proof from the URL, so it must be absolute.
+  const res = await session.authFetch(location.origin + '/api/agent', {
+    method: 'POST', headers: { 'content-type': 'application/json' },
+    body: JSON.stringify({ action: p.action, podBase: p.podBase }),
+  }).catch(() => null);
+  const d = res ? await res.json().catch(() => ({})) : {};
+  if (res && res.status === 201 && d.doorSecret) {
+    // Built as nodes, not as a string of HTML. Three of the pieces below come
+    // back from the server and one comes from sessionStorage, and pasting any
+    // of them into innerHTML means whatever markup they contain is rendered.
+    // Only the fixed wording is markup here; everything variable is text.
+    const say = (tag, text) => { const e = document.createElement(tag); e.textContent = text; return e; };
+    n.textContent = 'Your identity runs here now. This is your door secret — ';
+    n.append(say('b', 'save it now'));
+    n.append(', it is shown only this once. It opens your admin pages at ');
+    n.append(say('code', p.podBase.replace(/\/$/, '') + d.doorPath));
+    n.append(':', say('pre', d.doorSecret));
+    n.append('To check it works:', say('pre', d.command));
+    n.append('Lost it? Opt in again — that mints a fresh one and retires this one.');
+  } else if (res && res.status === 200) {
+    n.textContent = 'Done — this server no longer runs that identity. Your pod and its data are untouched.';
+  } else {
+    n.textContent = (p.action === 'opt-in' ? 'opt-in' : 'opt-out') + ' failed: '
+      + (d.error || (res ? 'HTTP ' + res.status : 'no response'));
+  }
+})();

package/lib/podrdf.mjs

@@ -1,132 +0,0 @@
-// podrdf.mjs — the RDF source of truth under /activitypods-js/fediverse/:
-// settings, contacts, and one document per note. Same documents and AS2
-// vocabulary as dk's local.mjs (plan: ap-pod-mapping.md).
-//
-// Parsed and serialised by rdflib, never by hand. Escaping, encoding and shape
-// are exactly what a regex gets wrong quietly — a tab inside a literal, a '%'
-// in a slug, a triple laid out in a form the pattern did not anticipate — and
-// a hand-built serialiser writes the documents the hand-built parser reads
-// back, so the two bugs cover for each other. See claude/plans/no-regex-rdf.md.
-//
-// The container it lives in is a Storage (lib/storage.mjs): a pod over HTTP or
-// a directory. Callers still speak in absolute URLs, which is what the rest of
-// the agent has.
-
-import * as $rdf from 'rdflib';
-
-const AS = $rdf.Namespace('https://www.w3.org/ns/activitystreams#');
-const RDF = $rdf.Namespace('http://www.w3.org/1999/02/22-rdf-syntax-ns#');
-const XSD = $rdf.Namespace('http://www.w3.org/2001/XMLSchema#');
-const TURTLE = 'text/turtle';
-
-export class PodRdf {
-  constructor({ storage }) {
-    this.storage = storage;
-    this.base = storage.base;
-    this.fedi = this.base;
-  }
-
-  // Callers hold absolute URLs; the storage works in paths under its base.
-  _rel(url) {
-    if (!url.startsWith(this.fedi)) throw new Error(`${url} is not under ${this.fedi}`);
-    return url.slice(this.fedi.length);
-  }
-
-  async get(url) {
-    const r = await this.storage.read(this._rel(url));
-    if (!r.ok) throw new Error(`pod GET ${url} → ${r.status}`);
-    return r.body;
-  }
-
-  async put(url, body, contentType = TURTLE) {
-    const r = await this.storage.write(this._rel(url), body, contentType);
-    if (!r.ok) throw new Error(`pod PUT ${url} → ${r.why}`);
-  }
-
-  async delete(url) {
-    if (!await this.storage.remove(this._rel(url))) throw new Error(`pod DELETE ${url} failed`);
-  }
-
-  // Child resource URLs of {fedi}{kind}/ (empty when the container is absent).
-  async listNotes(kind) {
-    const { names } = await this.storage.list(`${kind}/`);
-    return names
-      // `.<pid>.tmp` is what FileStorage.write leaves if it is interrupted
-      // between the write and the rename. It is not a note, and handing one to
-      // the parser produces a failure that reads like a corrupt document.
-      .filter(n => !n.endsWith('/') && !/\.(acl|meta)$/.test(n) && !/\.\d+\.tmp$/.test(n))
-      .map(n => `${this.fedi}${kind}/${n}`);
-  }
-
-  _graph(url, ttl) {
-    const g = $rdf.graph();
-    $rdf.parse(ttl, g, url, TURTLE);
-    return g;
-  }
-
-  // Inverse of writeNote for one resource.
-  async readNote(url) {
-    const g = this._graph(url, await this.get(url));
-    const doc = $rdf.sym(url);
-    const iri = (p) => g.any(doc, AS(p), null, doc)?.value;
-    const str = (p) => g.any(doc, AS(p), null, doc)?.value;
-    const attachments = g.each(doc, AS('attachment'), null, doc).map((a) => {
-      const mediaType = g.any(a, AS('mediaType'), null, doc)?.value;
-      const description = g.any(a, AS('name'), null, doc)?.value;
-      return { url: a.value, mediaType: mediaType || '', ...(description ? { description } : {}) };
-    });
-    return {
-      noteId: iri('url'), actor: iri('attributedTo'),
-      published: str('published'), inReplyTo: iri('inReplyTo'), content: str('content'),
-      ...(attachments.length ? { attachments } : {}),
-    };
-  }
-
-  // Incoming or own post → one RDF resource. kind: 'timeline' | 'posts'
-  async writeNote(kind, slug, { noteId, actor, published, content, inReplyTo, attachments }) {
-    const url = `${this.fedi}${kind}/${slug}`;
-    const doc = $rdf.sym(url);
-    const g = $rdf.graph();
-    g.add(doc, RDF('type'), AS('Note'), doc);
-    g.add(doc, AS('url'), $rdf.sym(noteId), doc);
-    g.add(doc, AS('attributedTo'), $rdf.sym(actor), doc);
-    // Two-arg with a NamedNode is how rdflib takes a datatype; passing it
-    // third silently yields an xsd:string, which would drop ^^xsd:dateTime
-    // from every note published from here on.
-    if (published) g.add(doc, AS('published'), $rdf.literal(published, XSD('dateTime')), doc);
-    if (inReplyTo) g.add(doc, AS('inReplyTo'), $rdf.sym(inReplyTo), doc);
-    g.add(doc, AS('content'), $rdf.literal(content || ''), doc);
-    for (const a of attachments || []) {
-      const at = $rdf.sym(a.url);
-      g.add(doc, AS('attachment'), at, doc);
-      g.add(at, RDF('type'), AS('Document'), doc);
-      if (a.mediaType) g.add(at, AS('mediaType'), $rdf.literal(a.mediaType), doc);
-      if (a.description) g.add(at, AS('name'), $rdf.literal(a.description), doc);
-    }
-    await this.put(url, $rdf.serialize(doc, g, url, TURTLE));
-  }
-
-  // Contacts doc — the followers/following truth, rebuilt whole each change.
-  async writeContacts({ followers, following }) {
-    const url = this.fedi + 'contacts';
-    const doc = $rdf.sym(url);
-    const me = $rdf.sym(url + '#me');
-    const g = $rdf.graph();
-    g.add(me, RDF('type'), AS('Person'), doc);
-    for (const f of followers) g.add(me, AS('followers'), $rdf.sym(f.actor), doc);
-    for (const f of following) g.add(me, AS('following'), $rdf.sym(f.actor), doc);
-    await this.put(url, $rdf.serialize(doc, g, url, TURTLE));
-  }
-
-  // Settings doc — handle + pointer to the public face.
-  async writeSettings({ handle, actorUrl }) {
-    const url = this.fedi + 'settings';
-    const doc = $rdf.sym(url);
-    const me = $rdf.sym(url + '#me');
-    const g = $rdf.graph();
-    g.add(me, RDF('type'), AS('Person'), doc);
-    g.add(me, AS('preferredUsername'), $rdf.literal(handle), doc);
-    g.add(me, AS('url'), $rdf.sym(actorUrl), doc);
-    await this.put(url, $rdf.serialize(doc, g, url, TURTLE));
-  }
-}