fedipod 0.13.0 → 0.14.0

package/lib/fediacct.mjs

@@ -0,0 +1,257 @@
+// fediacct.mjs — the agent's connections to fediverse accounts the owner holds
+// on OTHER servers. The agent is an API client of an existing Mastodon-API
+// account, the same relationship a Mastodon app has to this agent, and the same
+// one atproto.mjs has to a Bluesky account. Nothing here is a second identity:
+// no key, no pod, nothing published.
+//
+// One credential per account at AP_HOME/fediaccts/<id>.json (0600, atomic,
+// stamped with the actor it was connected for — the keys.json rules). A file
+// stamped for someone else is skipped rather than fatal, so one stray record
+// cannot cost the owner the whole roster.
+//
+// An access token here is full access to that account on that server, so it
+// never reaches pod state: config.json gets the handle and the host, nothing
+// more.
+
+import fs from 'node:fs';
+import path from 'node:path';
+import crypto from 'node:crypto';
+import { writeJsonAtomic } from './home.mjs';
+import { safeFetch, retryAfterMs } from './safefetch.mjs';
+
+const DIR = 'fediaccts';
+const APPS = '_apps';
+const SCOPES = 'read write';
+const STATE_TTL_MS = 10 * 60_000;
+const CLIENT_NAME = 'FediPod';
+
+// The id becomes a file name, and both halves come from a remote server's own
+// answer. `--handle ../escape` is the shape of bug this project has already
+// paid for once, so the result is checked rather than trusted.
+export function safeId(user, host) {
+  const id = `${String(user || '').trim()}@${String(host || '').trim()}`
+    .toLowerCase().replace(/[^a-z0-9.@_-]/g, '-');
+  if (!/^[a-z0-9][a-z0-9.@_-]{0,80}$/.test(id) || id.includes('..')) return null;
+  return id;
+}
+
+// A host as we will address it: bare authority, no scheme, no path, no case.
+export function cleanHost(host) {
+  const raw = String(host || '').trim().replace(/^https?:\/\//i, '').replace(/\/.*$/, '');
+  return /^[a-z0-9.-]+(:\d+)?$/i.test(raw) ? raw.toLowerCase() : null;
+}
+
+export class FediAccounts {
+  constructor({ localDir, actorId = null, log = console.log, fetcher = null }) {
+    this.dir = path.join(localDir, DIR);
+    this.actorId = actorId;
+    this.log = log;
+    // Injectable for tests; the default is the politeness stack, which also
+    // refuses private addresses — a connected account is on the public web.
+    this.fetcher = fetcher || ((url, init) => safeFetch(url, init));
+    this.pausedUntil = new Map();          // host → epoch ms
+    this.pending = new Map();              // state nonce → { host, redirectUri, at }
+  }
+
+  // ---- records ----
+
+  _path(id) { return path.join(this.dir, `${id}.json`); }
+
+  ids() {
+    let names = [];
+    try { names = fs.readdirSync(this.dir); } catch { return []; }
+    return names.filter(n => n.endsWith('.json') && !n.startsWith('_')).map(n => n.slice(0, -5));
+  }
+
+  read(id) {
+    let rec;
+    try { rec = JSON.parse(fs.readFileSync(this._path(id), 'utf8')); } catch { return null; }
+    if (rec?.mintedFor && this.actorId && rec.mintedFor !== this.actorId) {
+      this.log(`fediaccts/${id}.json belongs to ${rec.mintedFor} — not reusing it for ${this.actorId}`);
+      return null;
+    }
+    return rec;
+  }
+
+  write(rec) {
+    fs.mkdirSync(this.dir, { recursive: true, mode: 0o700 });
+    writeJsonAtomic(this._path(rec.id), rec);
+  }
+
+  list() { return this.ids().map(id => this.read(id)).filter(Boolean); }
+
+  connected() { return this.list().some(r => r.token && r.enabled !== false); }
+
+  // What may be written to pod state: who, where, and whether it is polled.
+  roster() {
+    return this.list().map(r => ({
+      id: r.id, handle: r.handle, host: r.host,
+      addedAt: r.addedAt || null, enabled: r.enabled !== false,
+    }));
+  }
+
+  status() {
+    return this.list().map(r => ({
+      id: r.id, handle: r.handle, host: r.host,
+      enabled: r.enabled !== false,
+      needsReconnect: !!r.needsReconnect,
+      cooldownFor: Math.max(0, Math.round(((this.pausedUntil.get(r.host) || 0) - Date.now()) / 1000)),
+    }));
+  }
+
+  setEnabled(id, on) {
+    const rec = this.read(id);
+    if (!rec) return null;
+    this.write({ ...rec, enabled: !!on });
+    return this.roster().find(r => r.id === id) || null;
+  }
+
+  remove(id) {
+    if (!this.read(id)) return false;
+    try { fs.rmSync(this._path(id)); } catch { return false; }
+    this.log(`Fediverse account disconnected: ${id}`);
+    return true;
+  }
+
+  // ---- HTTP ----
+
+  async _fetch(host, url, init) {
+    const left = (this.pausedUntil.get(host) || 0) - Date.now();
+    if (left > 0) throw new Error(`${host} asked us to back off — ${Math.ceil(left / 1000)}s left`);
+    const res = await this.fetcher(url, init);
+    if (res.status === 429 || res.status === 503) {
+      const ms = retryAfterMs(res) ?? 60_000;
+      this.pausedUntil.set(host, Date.now() + ms);
+      this.log(`${host} answered ${res.status} — pausing for ${Math.round(ms / 1000)}s`);
+    }
+    return res;
+  }
+
+  async _json(res, host) {
+    const body = await res.json().catch(() => ({}));
+    if (res.status >= 400) {
+      const err = new Error(body.error_description || body.error || `${host} answered ${res.status}`);
+      err.status = res.status;
+      throw err;
+    }
+    return body;
+  }
+
+  // ---- the OAuth dance, as the client ----
+
+  // One app registration per host, remembered. The redirect_uri is part of what
+  // was registered, so an agent that moved to another port re-registers rather
+  // than sending the server a redirect it will refuse.
+  async appFor(host, redirectUri) {
+    const file = path.join(this.dir, APPS, `${host}.json`);
+    try {
+      const app = JSON.parse(fs.readFileSync(file, 'utf8'));
+      if (app.redirectUri === redirectUri && app.clientId && app.clientSecret) return app;
+    } catch { /* not registered here yet */ }
+    const res = await this._fetch(host, `https://${host}/api/v1/apps`, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({
+        client_name: CLIENT_NAME, redirect_uris: redirectUri,
+        scopes: SCOPES, website: 'https://github.com/jeff-zucker/FediPod',
+      }),
+    });
+    const body = await this._json(res, host);
+    if (!body.client_id || !body.client_secret) throw new Error(`${host} registered no client`);
+    const app = { host, redirectUri, clientId: body.client_id, clientSecret: body.client_secret };
+    fs.mkdirSync(path.join(this.dir, APPS), { recursive: true, mode: 0o700 });
+    writeJsonAtomic(file, app);
+    return app;
+  }
+
+  // Step one: where to send the browser. The state nonce is single-use and
+  // short-lived — without one, any page the owner visits could hand our
+  // callback somebody else's authorization code and bind THEIR account here.
+  async begin({ host, redirectUri }) {
+    const h = cleanHost(host);
+    if (!h) throw new Error('that is not a server address');
+    const app = await this.appFor(h, redirectUri);
+    const state = crypto.randomBytes(24).toString('hex');
+    const now = Date.now();
+    for (const [k, v] of this.pending) if (now - v.at > STATE_TTL_MS) this.pending.delete(k);
+    this.pending.set(state, { host: h, redirectUri, at: now });
+    const u = new URL(`https://${h}/oauth/authorize`);
+    u.searchParams.set('client_id', app.clientId);
+    u.searchParams.set('redirect_uri', redirectUri);
+    u.searchParams.set('response_type', 'code');
+    u.searchParams.set('scope', SCOPES);
+    u.searchParams.set('state', state);
+    return { url: u.href, state, host: h };
+  }
+
+  // Step two: the code comes back. Exchange it, ask the server who we now are,
+  // and only then write anything.
+  async complete({ state, code }) {
+    const pend = this.pending.get(state);
+    if (!pend || Date.now() - pend.at > STATE_TTL_MS) throw new Error('that sign-in has expired — start again');
+    this.pending.delete(state);
+    const { host, redirectUri } = pend;
+    const app = await this.appFor(host, redirectUri);
+    const res = await this._fetch(host, `https://${host}/oauth/token`, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({
+        grant_type: 'authorization_code', code, redirect_uri: redirectUri,
+        client_id: app.clientId, client_secret: app.clientSecret, scope: SCOPES,
+      }),
+    });
+    const tok = await this._json(res, host);
+    if (!tok.access_token) throw new Error(`${host} returned no token`);
+    const me = await this.whoami(host, tok.access_token);
+    const id = safeId(me.username, host);
+    if (!id) throw new Error(`${host} answered with a name we cannot file safely`);
+    this.write({
+      id, host, token: tok.access_token, scope: tok.scope || SCOPES,
+      handle: `@${me.username}@${host}`, acct: me.acct || me.username,
+      accountId: String(me.id), actorUrl: me.url || null,
+      name: me.display_name || me.username, icon: me.avatar || null,
+      addedAt: new Date().toISOString(), enabled: true,
+      ...(this.actorId ? { mintedFor: this.actorId } : {}),
+    });
+    this.log(`Fediverse account connected: @${me.username}@${host}`);
+    return this.roster().find(r => r.id === id);
+  }
+
+  async whoami(host, token) {
+    const res = await this._fetch(host, `https://${host}/api/v1/accounts/verify_credentials`, {
+      headers: { authorization: `Bearer ${token}` },
+    });
+    const me = await this._json(res, host);
+    if (!me.username) throw new Error(`${host} did not say who we are`);
+    return me;
+  }
+
+  // ---- authenticated calls on behalf of one connected account ----
+
+  // Returns the Response, so a caller can read rate-limit headers. A 401 means
+  // the token was revoked on the far side: the account is marked rather than
+  // deleted, because the owner should be told rather than quietly dropped.
+  async api(id, pathname, init = {}) {
+    const rec = this.read(id);
+    if (!rec?.token) throw new Error(`no connected account ${id}`);
+    const url = pathname.startsWith('https://') ? pathname : `https://${rec.host}${pathname}`;
+    const res = await this._fetch(rec.host, url, {
+      ...init,
+      headers: { ...(init.headers || {}), authorization: `Bearer ${rec.token}` },
+    });
+    if (res.status === 401) {
+      if (!rec.needsReconnect) this.write({ ...rec, needsReconnect: true });
+      const err = new Error(`${rec.handle} no longer accepts our token — reconnect it`);
+      err.status = 401;
+      throw err;
+    }
+    if (rec.needsReconnect && res.status < 400) this.write({ ...rec, needsReconnect: false });
+    return res;
+  }
+
+  async apiJson(id, pathname, init = {}) {
+    const rec = this.read(id);
+    const res = await this.api(id, pathname, init);
+    return this._json(res, rec?.host || id);
+  }
+}

package/lib/mastoapi.mjs

@@ -327,6 +327,76 @@ export class MastoApi {
     } catch (e) { return send(422, { error: e.message }); }
   }
 
+  // Which account acts: the one that saw the post, and the first of them when
+  // several did. Undo inverts that — a like fans IN to one account, an unlike
+  // fans OUT to every account holding one, because a stray like left behind
+  // after the owner asked for it to go is the worse failure.
+  async acctAction(send, s, verb) {
+    const accounts = this.agent.fediaccts;
+    const held = s.sourceAccts || [];
+    if (!accounts || !held.length) {
+      return send(422, { error: 'this post came from a connected account, and none is connected now' });
+    }
+    const flag = verb.endsWith('favourite') ? 'favourited' : 'reblogged';
+    const undo = verb.startsWith('un');
+    const targets = (undo ? held.filter(v => v[flag]) : [held[0]]).filter(v => v?.remoteId);
+    if (!targets.length) return send(200, this.status(s));
+    try {
+      const acted = new Set();
+      for (const v of targets) {
+        await accounts.api(v.acct,
+          `/api/v1/statuses/${encodeURIComponent(v.remoteId)}/${verb}`, { method: 'POST' });
+        acted.add(v.acct);
+      }
+      const next = held.map(v => (acted.has(v.acct) ? { ...v, [flag]: !undo } : v));
+      return send(200, this.status(this.store.updateStatus(s.noteId, { sourceAccts: next }) || s));
+    } catch (e) { return send(e.status === 401 ? 401 : 422, { error: e.message }); }
+  }
+
+  // The reply exists only on that account's server, so the row added here is
+  // its one local copy — the same shape bskyReply uses for the same reason.
+  async acctReply(send, body, parent, visibility) {
+    const accounts = this.agent.fediaccts;
+    const held = (parent.sourceAccts || [])[0];
+    if (!accounts || !held?.remoteId) {
+      return send(422, { error: 'this post came from a connected account, and none is connected now' });
+    }
+    if (visibility !== 'public' && visibility !== 'unlisted') {
+      return send(422, { error: 'a reply from a connected account is public — pick public or unlisted' });
+    }
+    if (body.scheduled_at) return send(422, { error: 'a reply from a connected account cannot be scheduled' });
+    if ([].concat(body.media_ids || body['media_ids[]'] || []).filter(Boolean).length) {
+      return send(422, { error: 'images on a reply from a connected account are not supported' });
+    }
+    try {
+      const out = await accounts.apiJson(held.acct, '/api/v1/statuses', {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({
+          status: body.status, in_reply_to_id: held.remoteId, visibility,
+          ...(body.spoiler_text ? { spoiler_text: String(body.spoiler_text) } : {}),
+        }),
+      });
+      if (!out?.uri) return send(502, { error: 'that server accepted the reply but did not say where it is' });
+      const rec = accounts.read(held.acct);
+      const actor = out.account?.uri || out.account?.url || rec?.actorUrl;
+      if (actor && !this.store.getActors()[actor]) {
+        this.store.cacheActor(actor, {
+          name: out.account?.display_name || rec?.name,
+          preferredUsername: out.account?.username || rec?.acct, type: 'Person',
+        });
+      }
+      this.store.addStatus({
+        noteId: out.uri, actor, inReplyTo: parent.noteId,
+        content: sanitizeHtml(out.content || ''),
+        published: out.created_at || new Date().toISOString(), kind: 'acct',
+        sourceAccts: [{ acct: held.acct, remoteId: String(out.id) }],
+        ...(out.url && out.url !== out.uri ? { link: out.url } : {}),
+      });
+      return send(200, this.status(this.store.getStatuses().find(x => x.noteId === out.uri)));
+    } catch (e) { return send(422, { error: e.message }); }
+  }
+
   status(s, { all } = {}) {
     const replies = (all || this.store.getStatuses()).filter(x => x.inReplyTo === s.noteId).length;
     return {
@@ -339,7 +409,11 @@ export class MastoApi {
       edited_at: s.editedAt || null,
       uri: s.noteId, url: s.link || s.noteId,
       replies_count: replies, reblogs_count: 0, favourites_count: 0,
-      favourited: !!s.favourited, reblogged: !!s.reblogged,
+      // True when ANY of the owner's accounts holds it. The flag is really
+      // what the next tap will do: an empty star on a post one account has
+      // already liked invites a second outward like from a second identity.
+      favourited: !!s.favourited || (s.sourceAccts || []).some(v => v.favourited),
+      reblogged: !!s.reblogged || (s.sourceAccts || []).some(v => v.reblogged),
       muted: false, bookmarked: !!s.bookmarked, pinned: !!s.pinned,
       content: s.content || '',
       reblog: null, application: null,
@@ -807,6 +881,10 @@ export class MastoApi {
       // — the parent is not an AP object, so there is no AP note to make.
       const bskyParent = inReplyTo && this.store.getStatuses().find(x => x.noteId === inReplyTo && x.kind === 'bsky');
       if (bskyParent) return this.bskyReply(send, body, bskyParent, visibility);
+      // A reply to a post a connected account brought us goes out from that
+      // account, where the conversation already is.
+      const acctParent = inReplyTo && this.store.getStatuses().find(x => x.noteId === inReplyTo && x.kind === 'acct');
+      if (acctParent) return this.acctReply(send, body, acctParent, visibility);
       // Private and direct posts live in an owner-only pod container — and
       // only on a pod that provably enforces it.
       if (visibility === 'private' || visibility === 'direct') {
@@ -888,8 +966,24 @@ export class MastoApi {
       const noteUrl = this.store.urlFor(mStatus[1]);
       const s = noteUrl && this.store.getStatuses().find(x => x.noteId === noteUrl);
       if (!s) return send(404, { error: 'Record not found' });
-      if (s.actor !== this.urls.actor) return send(403, { error: 'not your status' });
+      // A post the owner wrote on a connected account is theirs to delete too.
+      // It is deleted where it lives — an AP Delete of ours would address an
+      // object that was never ours to speak for.
+      const onAcct = s.actor !== this.urls.actor
+        ? (this.agent.fediaccts?.list() || []).find(r => r.actorUrl && r.actorUrl === s.actor)
+        : null;
+      if (s.actor !== this.urls.actor && !onAcct) return send(403, { error: 'not your status' });
       const rendered = this.status(s);
+      if (onAcct) {
+        const held = (s.sourceAccts || []).find(v => v.acct === onAcct.id);
+        if (!held?.remoteId) return send(422, { error: `we do not know where ${onAcct.handle} keeps that post` });
+        try {
+          await this.agent.fediaccts.api(onAcct.id,
+            `/api/v1/statuses/${encodeURIComponent(held.remoteId)}`, { method: 'DELETE' });
+        } catch (e) { return send(502, { error: e.message }); }
+        this.store.removeStatus(s.noteId);
+        return send(200, { ...rendered, text: s.content || '' });
+      }
       // 502, because the refusal is the pod's: the client asked correctly and
       // the post is still up. Reporting 200 here is what let a deleted post
       // stay publicly readable with nothing to show for it.
@@ -1172,6 +1266,11 @@ export class MastoApi {
           return send(200, this.status(patch ? (this.store.updateStatus(s.noteId, patch) || s) : s));
         } catch (e) { return send(422, { error: e.message }); }
       }
+      // A post that reached us through a connected account is not ours to
+      // address as the pod actor. Our own posts and our own inbox's timeline
+      // keep the AP path even when a connected account also saw them: where
+      // the pod identity has standing, it is the one that acts.
+      if (s.kind === 'acct') return this.acctAction(send, s, mAction[2]);
       const updated = await social[mAction[2]](this.agent, s);
       return send(200, this.status(updated || s));
     }

package/lib/store.mjs

@@ -343,7 +343,8 @@ export class PodStore {
   }
   addStatus(s) {
     const all = this.getStatuses();
-    if (all.some(x => x.noteId === s.noteId)) return;
+    const at = all.findIndex(x => x.noteId === s.noteId);
+    if (at >= 0) return this._mergeStatus(all, at, s);
     // Same reason as cacheActor: statuses.json is serialized whole on every
     // change, and remote content is only bounded by the 5 MB fetch ceiling.
     if (typeof s.content === 'string' && s.content.length > MAX_CONTENT) {
@@ -352,6 +353,30 @@ export class PodStore {
     all.unshift(s);
     this.write('statuses.json', all.slice(0, 1000));
     this.onEvent?.('status', s);            // streaming subscribers
+    return { added: true, merged: false, status: s };
+  }
+
+  // The same post arrives twice when two of the owner's accounts follow its
+  // author, and the second arrival is the only record that the other one saw
+  // it. Merged in place — the per-kind prune tails take the tail to be the
+  // oldest — and with no stream event, which would show the post twice.
+  _mergeStatus(all, at, s) {
+    const row = all[at];
+    const known = new Set((row.sourceAccts || []).map(v => v.acct));
+    const fresh = (s.sourceAccts || []).filter(v => v && !known.has(v.acct));
+    // Only our own verified intake may raise a row's kind. A general ladder
+    // would let a source that merely SAW a post promote a stranger's mention
+    // into the home timeline, which is the route tagfeed had to close.
+    const first = (k) => k === 'post' || k === 'timeline';
+    const raise = first(s.kind) && !first(row.kind);
+    if (!fresh.length && !raise) return { added: false, merged: false, status: row };
+    all[at] = {
+      ...row,
+      ...(fresh.length ? { sourceAccts: [...(row.sourceAccts || []), ...fresh] } : {}),
+      ...(raise ? { kind: s.kind, ...(s.slug ? { slug: s.slug } : {}) } : {}),
+    };
+    this.write('statuses.json', all);
+    return { added: false, merged: true, status: all[at] };
   }
   updateStatus(noteId, patch) {
     const all = this.getStatuses();

package/lib/wire.mjs

@@ -243,8 +243,8 @@ ${icon ? `<img class="avatar" src="${esc(icon)}" alt="">` : ''}
 <h1>${esc(name)}</h1>
 <p class="address">${esc(address)}</p>
 ${summary ? `<div>${summary}</div>` : ''}
-<p>This is ${what} on the fediverse. To follow it, paste the address above
-into the search box of Mastodon or any fediverse app — or use the form.</p>
+<p>This is ${what} on the Fediverse. To follow it, paste the address above
+into the search box of Mastodon or any Fediverse app — or use the form.</p>
 <form id="follow">
   <label for="server">your server</label>
   <input id="server" type="text" placeholder="mastodon.social" autocomplete="off"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fedipod",
-  "version": "0.13.0",
+  "version": "0.14.0",
   "description": "Standalone single-actor ActivityPub agent whose wire face, RDF truth and state all live on a Solid pod (CSS). Bundles a Phanpy UI and a Mastodon client-API facade.",
   "type": "module",
   "license": "MIT",