fedipod 0.14.0 → 0.16.0

package/lib/admin.mjs

@@ -27,7 +27,7 @@ import { identityHomes, rootOf, tildify, defaultProfile, writeJsonAtomic } from
 import { copyPrivateHalf, isCurrent, CURRENT_LAYOUT } from './migrate.mjs';
 import { normalizeImport, IMPORT_KINDS } from './import.mjs';
 import { insecureUrlReason } from './safefetch.mjs';
-import { newRun, preflight, runSetup, setupInputError, hasCredential } from './setup.mjs';
+import { newRun, preflight, runSetup, setupInputError, hasCredential, credentialPath } from './setup.mjs';
 import { portFree, freePortFrom } from './ports.mjs';
 import { claimDirectory, yieldDirectory } from './directory.mjs';
 import { localFetch } from './localapi.mjs';
@@ -112,7 +112,7 @@ const AGENT_VERSION = JSON.parse(fs.readFileSync(path.join(projectRoot, 'package
 // /shutdown is here because stopping an agent that was never set up is exactly
 // the case it exists for; it is in LOCAL_ONLY_POSTS below, so it still answers
 // only to this machine.
-const OPEN_POSTS = new Set(['/block', '/unblock', '/setup', '/setup/check', '/shutdown']);
+const OPEN_POSTS = new Set(['/block', '/unblock', '/setup', '/setup/check', '/setup/reset', '/shutdown']);
 
 // The page the other server's redirect lands on. Self-contained on purpose:
 // the browser arrives here from somewhere else, and nothing may load from
@@ -147,11 +147,11 @@ function callbackPage(ok, msg) {
 // server there is no such process and no such machine: identities come from
 // the server's own configuration, so these are not there to be found.
 const EMBEDDED_CUT = new Set(['/profiles', '/shutdown', '/new-actor', '/start-actor',
-  '/state-move', '/setup', '/setup/check']);
+  '/state-move', '/setup', '/setup/check', '/setup/reset']);
 // AP_ALLOWED_HOSTS may name a tailnet host or a reverse-proxy domain. The
 // fediverse is welcome there; creating accounts and editing the record is for
 // whoever is sitting at the machine.
-const LOCAL_ONLY_POSTS = new Set(['/setup', '/setup/check', '/config', '/new-actor', '/start-actor', '/shutdown', '/state-move', '/atproto/connect', '/fediacct/connect', '/fediacct/disconnect', '/fediacct', '/gateway', '/alias', '/import', '/update']);
+const LOCAL_ONLY_POSTS = new Set(['/setup', '/setup/check', '/setup/reset', '/config', '/new-actor', '/start-actor', '/shutdown', '/state-move', '/atproto/connect', '/fediacct/connect', '/fediacct/disconnect', '/fediacct', '/gateway', '/alias', '/import', '/update']);
 // The identity itself. Changing any of these means a different actor at a
 // different address, which is a new setup, not an edit.
 const PERMANENT_CONFIG = ['handle', 'remotePod', 'issuer', 'root', 'kind'];
@@ -848,6 +848,34 @@ export function buildAdminSurface({ agent, gate, allowed, log = console.log,
         }
         // ---- setup, driven by the page at /admin/setup/ ----
         case '/setup/check': return json(res, 200, preflight(body));
+        // Discard a credential that never finished setup, so the account and
+        // pod can be entered again. The credential a CSS server mints is shown
+        // once, so a setup that stops after the mint (a wrong pod answers 401
+        // to the first write) leaves the form in "finish" mode with no way to
+        // re-enter what was wrong. This removes it locally and reopens the full
+        // form. It does NOT revoke server-side — that needs the account
+        // password (`fedipod revoke-credential`); the old credential is left on
+        // the account, revocable from its dashboard.
+        case '/setup/reset': {
+          if (isCrossSiteNavigation(req)) return json(res, 403, { error: 'cross-site request' });
+          // A working identity is never swapped out this way — that is a
+          // teardown (`fedipod retire`), not a half-finished setup.
+          if (agent.configured()) {
+            return json(res, 409, { error: 'this home holds a working identity — retire it, do not reset' });
+          }
+          if (setupRun?.phase === 'running') {
+            return json(res, 409, { error: 'setup is running — let it finish or stop it first', phase: 'running' });
+          }
+          const home = agent.home;
+          if (!home) return json(res, 500, { error: 'this agent has no AP_HOME to reset' });
+          const removed = hasCredential(home);
+          if (removed) fs.rmSync(credentialPath(home), { force: true });
+          // Drop the pod handle too, so configured() cannot flicker true off a
+          // stale in-memory session while the fresh form is filled in.
+          agent.remote = null;
+          setupRun = null;
+          return json(res, 200, { ok: true, removed });
+        }
         case '/setup': {
           // A visited page must not be able to navigate this into existence.
           if (isCrossSiteNavigation(req)) return json(res, 403, { error: 'cross-site request' });

package/lib/embed.mjs

@@ -210,5 +210,10 @@ export async function startEmbeddedAgent({
     ]);
   };
 
-  return { agent, handle, home, surface, host: authorities.host, stop };
+  // podHome and actorUrl are the identity's own locations on the pod. They are
+  // returned rather than rebuilt by the caller so the root name lives here.
+  return {
+    agent, handle, home, surface, host: authorities.host,
+    podHome: urls.home, actorUrl: urls.actor, stop,
+  };
 }

package/lib/front-core.mjs

@@ -18,6 +18,7 @@
 import crypto from 'node:crypto';
 import { handleDelivery } from './gateway-core.mjs';
 import { readCapped } from './safefetch.mjs';
+import { linkTargets, REL } from './links.mjs';
 
 // The one WebFinger document, spelled out here rather than imported from
 // wire.mjs: wire drags the agent's whole HTML pipeline (sanitize-html and
@@ -48,6 +49,24 @@ async function verifyPodToken(request, pathname, verifier) {
 // Is this WebID served by the claimed pod? A pod owner's WebID lives on the pod
 // origin — that is the whole proof: a token for a WebID under podHome could
 // only be minted by someone who controls that pod's identity provider.
+// A pod that will not answer must not hold up the person opting in; without
+// an answer the older check stands on its own.
+const OWNER_LOOKUP_MS = 5_000;
+
+/**
+ * Who the pod server says owns the pod. The server that hosts it is the
+ * authority on that, so when it answers, its answer decides. A server that
+ * says nothing leaves where the WebID lives as the only evidence there is.
+ */
+async function podOwners(podBase, fetchImpl = fetch) {
+  try {
+    const res = await fetchImpl(podBase, {
+      method: 'HEAD', signal: AbortSignal.timeout(OWNER_LOOKUP_MS),
+    });
+    return linkTargets(res?.headers?.get?.('link'), REL.owner, podBase);
+  } catch { return []; }
+}
+
 function webidUnderPod(webid, podHome) {
   try { return new URL(webid).origin === new URL(podHome).origin; } catch { return false; }
 }
@@ -285,7 +304,11 @@ export async function routeFront(request, ctx) {
     } catch { return j(400, { error: 'podBase is not a URL' }); }
     const webid = await verifyPodToken(request, pathname, ctx.verifier);
     if (!webid) return j(401, { error: 'a Solid-OIDC token proving the pod is required' });
-    if (!webid.startsWith(podBase)) {
+    // The pod's own server names its owner when it can. Where it does, that is
+    // the proof; where it does not, the WebID must at least live under the pod.
+    const owners = await podOwners(podBase, ctx.fetchImpl || fetch);
+    const proven = owners.length ? owners.includes(webid) : webid.startsWith(podBase);
+    if (!proven) {
       return j(403, { error: 'the token proves a different pod than the one you listed' });
     }
     if (action === 'opt-in') {
@@ -304,9 +327,9 @@ export async function routeFront(request, ctx) {
     return j(400, { error: 'action must be opt-in or opt-out' });
   }
 
-  // The vendored Solid-OIDC browser library the signup page loads — served
-  // here because this function owns every path on the domain.
-  if (pathname === '/solid-client-authn.bundle.js') {
+  // The vendored Solid-OIDC browser library the /run and /admin pages load —
+  // served here because this function owns every path on the domain.
+  if (pathname === '/solid-oidc-client.js') {
     if (!ctx.authBundle) return notFound();
     return { status: 200, headers: { 'content-type': 'text/javascript' }, body: ctx.authBundle };
   }

package/lib/intake.mjs

@@ -18,6 +18,7 @@ import * as $rdf from 'rdflib';
 import { USER_AGENT } from './ua.mjs';
 import { PUBLIC } from './wire.mjs';
 import { HTTP_TIMEOUT_MS, readCapped } from './safefetch.mjs';
+import { linkTargets, REL } from './links.mjs';
 import { dropFollower } from './store.mjs';
 
 const RDF = $rdf.Namespace('http://www.w3.org/1999/02/22-rdf-syntax-ns#');
@@ -307,6 +308,24 @@ export class Intake {
     }
   }
 
+  /**
+   * Where this pod describes the services it offers. The pod says so on any
+   * response about one of its resources; the well-known path is only what a
+   * pod that says nothing has always used.
+   */
+  async _storageDescriptionUrl() {
+    try {
+      const head = await fetch(this.urls.base, {
+        method: 'HEAD',
+        headers: { 'user-agent': USER_AGENT },
+        signal: AbortSignal.timeout(HTTP_TIMEOUT_MS),
+      });
+      const [found] = linkTargets(head.headers.get('link'), REL.storageDescription, this.urls.base);
+      if (found) return found;
+    } catch { /* the well-known path below */ }
+    return this.urls.base + '.well-known/solid';
+  }
+
   async _subscribeOnce() {
     // Reuse a channel we already have rather than asking for another one.
     const saved = this.store.read(CHANNEL_DOC, null);
@@ -314,13 +333,13 @@ export class Intake {
       this._openSocket(saved.receiveFrom, true);
       return;
     }
-    const descRes = await fetch(this.urls.base + '.well-known/solid', {
+    const descUrl = await this._storageDescriptionUrl();
+    const descRes = await fetch(descUrl, {
       headers: { accept: 'text/turtle', 'user-agent': USER_AGENT },
       signal: AbortSignal.timeout(HTTP_TIMEOUT_MS),
     });
     // The service description is RDF; ask rdflib which subject is the
     // WebSocketChannel2023 service rather than pattern-matching the document.
-    const descUrl = this.urls.base + '.well-known/solid';
     const g = $rdf.graph();
     try { $rdf.parse(await readCapped(descRes), g, descUrl, 'text/turtle'); }
     catch (e) { this.wsState = 'unavailable'; this.log(`service description unparsable (${e.message}) — polling only`); return; }

package/lib/links.mjs

@@ -0,0 +1,35 @@
+// links.mjs — reading RFC 8288 Link headers.
+//
+// Solid says where a resource's access control lives, where a storage
+// describes itself, and who owns a storage, by putting a link on the response.
+// Working any of those out from the resource's own URL instead is exactly what
+// the specs tell clients not to do, so this is the one place that reads them.
+
+/**
+ * Every target a Link header gives for one relation, resolved against the URL
+ * the header came from. A header may carry several links, and one link may
+ * carry several relation names.
+ */
+export function linkTargets(headerValue, rel, baseUrl) {
+  if (!headerValue) return [];
+  const wanted = String(rel).toLowerCase();
+  const out = [];
+  // Split on the commas BETWEEN links: one inside a URI has its closing angle
+  // bracket still ahead of it, and is left alone.
+  for (const part of String(headerValue).split(/,(?![^<]*>)/u)) {
+    const link = /^\s*<([^>]*)>\s*(.*)$/u.exec(part);
+    if (!link) continue;
+    const relParam = /(?:^|;)\s*rel\s*=\s*(?:"([^"]*)"|([^;"\s]+))/iu.exec(link[2]);
+    const names = (relParam?.[1] ?? relParam?.[2] ?? '').toLowerCase().split(/\s+/u);
+    if (!names.includes(wanted)) continue;
+    try { out.push(new URL(link[1], baseUrl).href); } catch { /* not a URL we can follow */ }
+  }
+  return out;
+}
+
+/** The relations this project follows. */
+export const REL = {
+  acl: 'acl',
+  storageDescription: 'http://www.w3.org/ns/solid/terms#storageDescription',
+  owner: 'http://www.w3.org/ns/solid/terms#owner',
+};

package/lib/remote.mjs

@@ -29,6 +29,12 @@ export { mintCredential, discoverTokenEndpoint, revokeCredentialViaAccount };
 // opened — and the callers' existing retry paths take it from there.
 // The parser is shared with the outbound path; see lib/safefetch.mjs.
 import { retryAfterMs, readCapped } from './safefetch.mjs';
+import { linkTargets, REL } from './links.mjs';
+
+// A pod whose access rules are ACP policies, not WAC authorizations. This
+// agent writes WAC; over an ACP resource that would be noise where the pod's
+// real rules used to be, so it stops instead.
+const ACP_NS = 'http://www.w3.org/ns/solid/acp#';
 
 // The inbox is public-Append, so the listing's size is in other people's
 // hands; reading it whole must still have a ceiling.
@@ -82,6 +88,11 @@ export class RemotePod {
     this.pausedUntil = 0;
     this.probeCount = 0;
     this.log = log;
+    // Where each resource's access control lives, as the pod itself said. WAC
+    // forbids working it out from the resource's own URL, so it is asked for
+    // and remembered rather than assembled.
+    this.aclUrls = new Map();
+    this.aclFlavour = null;      // null until the first write asks what this pod speaks
     // A fronted identity advertises ids on a shared domain but writes to the
     // pod. run-agent installs the fronted→pod mapping here, so every request
     // built from an advertised id lands on the pod — one choke point, and
@@ -153,9 +164,63 @@ export class RemotePod {
       method: 'PUT', headers: { 'content-type': contentType }, body,
     });
     if (res.status >= 400) throw new Error(`PUT ${url} → ${res.status}`);
+    // Writing a document is usually the step before setting its access, and
+    // the answer to the write already says where that lives. Taking it here
+    // spares the extra request the ACL write would otherwise make.
+    this.noteAclLink(url, res);
     return res;
   }
 
+  /** Remember an access-control location the pod volunteered on a response. */
+  noteAclLink(url, res) {
+    if (this.aclUrls.has(url)) return;
+    const [acl] = linkTargets(res?.headers?.get?.('link'), REL.acl, url);
+    if (acl) this.aclUrls.set(url, acl);
+  }
+
+  /**
+   * Where this resource's access control lives. The pod says so on any
+   * response about the resource; a pod that says nothing is taken to keep it
+   * at the usual suffix, which is what every server this runs against does.
+   */
+  async aclUrlFor(targetUrl) {
+    const known = this.aclUrls.get(targetUrl);
+    if (known) return known;
+    try {
+      const res = await this.fetch(targetUrl, { method: 'HEAD' });
+      this.noteAclLink(targetUrl, res);
+    } catch { /* unreachable or no such resource yet: the suffix below */ }
+    const resolved = this.aclUrls.get(targetUrl) || targetUrl + '.acl';
+    this.aclUrls.set(targetUrl, resolved);
+    return resolved;
+  }
+
+  /**
+   * Whether writing a WAC document here is meaningful. Asked once per pod, on
+   * the first access-control write. A pod that answers with ACP policies is
+   * left alone: replacing them with authorizations it does not read would take
+   * away the rules actually protecting it.
+   */
+  async aclWritable(aclUrl) {
+    if (this.aclFlavour !== null) return this.aclFlavour;
+    this.aclFlavour = true;
+    try {
+      const res = await this.fetch(aclUrl, { headers: { accept: 'text/turtle' } });
+      if (res.status < 300) {
+        const g = $rdf.graph();
+        $rdf.parse(await res.text(), g, aclUrl, 'text/turtle');
+        const acp = g.statements.some(st => st.predicate.value.startsWith(ACP_NS)
+          || st.object.value.startsWith(ACP_NS));
+        if (acp) {
+          this.aclFlavour = false;
+          this.log('this pod states access as ACP policies, which this agent does not write — '
+            + 'its access rules are left exactly as they are, and nothing here is published private');
+        }
+      }
+    } catch { /* absent, unreadable or unparsable: WAC is what we write */ }
+    return this.aclFlavour;
+  }
+
   async putJson(url, obj, contentType = 'application/activity+json') {
     return this.put(url, JSON.stringify(obj), contentType);
   }
@@ -173,6 +238,11 @@ export class RemotePod {
 
   async delete(url) {
     protectedFromDeletion(url);
+    // The pattern list above knows the usual name for an access-control
+    // document. One the pod named itself is just as fatal to remove.
+    for (const acl of this.aclUrls.values()) {
+      if (acl === url) throw new Error(`refusing to DELETE an access-control document: ${url}`);
+    }
     const res = await this.fetch(url, { method: 'DELETE' });
     return res.status < 400 || res.status === 404;
   }
@@ -238,8 +308,8 @@ export class RemotePod {
   // $rdf.sym() also throws on an illegal IRI, so a pod URL with something odd
   // in it fails here rather than silently producing a document that means
   // something else.
-  aclDoc(targetUrl, publicModes, { appendAgents = [] } = {}) {
-    const url = targetUrl + '.acl';
+  aclDoc(targetUrl, publicModes, { appendAgents = [], aclUrl = null } = {}) {
+    const url = aclUrl || targetUrl + '.acl';
     const doc = $rdf.sym(url);
     const target = $rdf.sym(targetUrl);
     const g = $rdf.graph();
@@ -263,7 +333,9 @@ export class RemotePod {
   }
 
   async setAcl(targetUrl, publicModes, opts = {}) {
-    return this.put(targetUrl + '.acl', this.aclDoc(targetUrl, publicModes, opts), 'text/turtle');
+    const url = await this.aclUrlFor(targetUrl);
+    if (!await this.aclWritable(url)) return null;
+    return this.put(url, this.aclDoc(targetUrl, publicModes, { ...opts, aclUrl: url }), 'text/turtle');
   }
 
   // The WebID profile advertises the actor as an account:
@@ -295,9 +367,53 @@ export class RemotePod {
     const stale = g.statementsMatching(actor, FOAF('accountName'), null, doc)
       .filter(st => st.object.value !== accountName);
     if (!missing.length && !stale.length) return false;
+    // A patch touches these statements and nothing else. Rewriting the whole
+    // profile re-serialises statements that are not ours — the OIDC issuer
+    // among them — and a server is entitled to refuse a write that would.
+    const deletes = stale.map(st => [ st.subject, st.predicate, st.object ]);
+    if (await this.patchDocument(docUrl, missing, deletes)) return true;
     for (const st of stale) g.remove(st);
     for (const [s, p, o] of missing) g.add(s, p, o, doc);
     await this.put(docUrl, $rdf.serialize(doc, g, docUrl, 'text/turtle'), 'text/turtle');
     return true;
   }
+
+  /**
+   * An N3 Patch of exactly these statements, or false when the pod will not
+   * take one and the caller should write the document instead.
+   *
+   * The statements are serialised by rdflib; only the wrapper naming what is
+   * being patched is assembled here, because N3's braces have no rdflib form.
+   */
+  n3Patch(docUrl, inserts, deletes) {
+    const block = (triples) => {
+      const g = $rdf.graph();
+      for (const [s, p, o] of triples) g.add(s, p, o);
+      return $rdf.serialize(null, g, docUrl, 'application/n-triples').trim();
+    };
+    const clauses = [];
+    if (deletes.length) clauses.push(`  solid:deletes { ${block(deletes)} }`);
+    if (inserts.length) clauses.push(`  solid:inserts { ${block(inserts)} }`);
+    return `@prefix solid: <http://www.w3.org/ns/solid/terms#>.\n`
+      + `<> a solid:InsertDeletePatch;\n${clauses.join(';\n')}.\n`;
+  }
+
+  async patchDocument(docUrl, inserts, deletes) {
+    let res;
+    try {
+      res = await this.fetch(docUrl, {
+        method: 'PATCH',
+        headers: { 'content-type': 'text/n3' },
+        body: this.n3Patch(docUrl, inserts, deletes),
+      });
+    } catch {
+      return false;   // no PATCH on this transport at all
+    }
+    if (res.status < 300) return true;
+    // The pod cannot patch. Anything else — a 409 saying what we meant to
+    // remove is not there any more — is a real answer, and rewriting the whole
+    // document over the top of it would destroy whatever changed it.
+    if (res.status === 405 || res.status === 415 || res.status === 501) return false;
+    throw new Error(`PATCH ${docUrl} → ${res.status}`);
+  }
 }

package/lib/setup.mjs

@@ -11,6 +11,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { pathToFileURL } from 'node:url';
+import * as $rdf from 'rdflib';
 
 import { createAccountWithPod as realCreateAccount } from './account.mjs';
 import { mintCredential as realMint } from './remote.mjs';
@@ -20,8 +21,48 @@ import { rootOf, recordLastUsed, writeJsonAtomic } from './home.mjs';
 import { insecureUrlReason } from './safefetch.mjs';
 import { CURRENT_LAYOUT, isCurrent } from './migrate.mjs';
 
+const SOLID = $rdf.Namespace('http://www.w3.org/ns/solid/terms#');
+
 export const STEPS = ['account', 'credential', 'bootstrap', 'connect', 'publish', 'verify'];
 
+// Read-only pre-check on the pod behind an existing-pod setup, before a
+// credential is minted or the first write is attempted. Two failures it turns
+// from a bare "PUT … → 401" into a plain sentence:
+//   1. the pod host is unreachable — no account should be built on a pod that
+//      is not there;
+//   2. the pod's WebID document declares no OIDC issuer. A pod verifies a token
+//      by dereferencing its WebID and looking for solid:oidcIssuer; an empty or
+//      issuer-less profile makes it reject every write with 401, so setup would
+//      stall on the first one. Only judged when the document is publicly
+//      readable — a protected one cannot be read here and is left to bootstrap.
+export async function checkPodUsable(pod, { webId, fetch: doFetch = globalThis.fetch } = {}) {
+  const base = pod.endsWith('/') ? pod : pod + '/';
+  const wid = webId || new URL('profile/card#me', base).href;
+  const cardUrl = wid.split('#')[0];
+
+  let root;
+  try { root = await doFetch(base, { headers: { accept: 'text/turtle' } }); }
+  catch (e) { return { ok: false, error: `${base} could not be reached (${e.message}). Check the address and that the server is running.` }; }
+  if (root.status === 404) return { ok: false, error: `there is no pod at ${base} — the server answered 404.` };
+  if (root.status >= 500) return { ok: false, error: `the pod host at ${base} is not responding (HTTP ${root.status}).` };
+
+  let card;
+  try { card = await doFetch(cardUrl, { headers: { accept: 'text/turtle' } }); }
+  catch (e) { return { ok: false, error: `the pod's WebID document ${cardUrl} could not be read (${e.message}).` }; }
+  if (card.status === 404) return { ok: false, error: `the pod has no WebID document at ${cardUrl} — the identity it needs is missing.` };
+  if (card.status >= 500) return { ok: false, error: `the pod host is not serving ${cardUrl} (HTTP ${card.status}).` };
+  if (card.status === 401 || card.status === 403) return { ok: true };   // cannot read unauthenticated; leave it to bootstrap
+
+  const body = await card.text().catch(() => '');
+  const g = $rdf.graph();
+  try { $rdf.parse(body, g, cardUrl, (card.headers.get('content-type') || 'text/turtle').split(';')[0].trim()); }
+  catch { return { ok: false, error: `the pod's WebID document ${cardUrl} could not be parsed as RDF.` }; }
+  if (!g.each($rdf.sym(wid), SOLID('oidcIssuer'), null).length) {
+    return { ok: false, error: `the pod's WebID document ${cardUrl} declares no OIDC issuer, so the pod will reject every write. It looks empty or incomplete — restore it, or set up with a fresh pod.` };
+  }
+  return { ok: true };
+}
+
 export const credentialPath = (home) => path.join(home, 'credential.json');
 export const hasCredential = (home) => fs.existsSync(credentialPath(home));
 
@@ -118,6 +159,7 @@ export function preflight({ mode, pod, issuer, podName, handle, kind }) {
 export async function runSetup({ home, agent, answers, run, deps = {}, log = () => {} }) {
   const createAccount = deps.createAccountWithPod || realCreateAccount;
   const mint = deps.mintCredential || realMint;
+  const checkPod = deps.checkPodUsable || checkPodUsable;
 
   const at = (key) => run.steps.find(s => s.key === key);
   const begin = (key) => { at(key).state = 'running'; };
@@ -166,14 +208,21 @@ export async function runSetup({ home, agent, answers, run, deps = {}, log = ()
       }
       done('account', pod);
     } else {
+      // A pod you bring must be there and carry a usable WebID before a
+      // credential is minted against it — no account on a pod that is not
+      // reachable, and no silent 401 later on a pod whose profile is empty.
+      const usable = await checkPod(pod);
+      if (!usable.ok) throw new Error(usable.error);
       skip('account', 'using the pod you already have');
     }
 
     // --- credential: the point of no return, and the durability boundary ---
+    let resumeWebId = null;
     if (resuming) {
       const rec = JSON.parse(fs.readFileSync(credPath, 'utf8'));
       pod = rec.remotePod;
       root = rec.root;
+      resumeWebId = rec.webId || null;
       skip('credential', `already minted — ${credPath}`);
     } else {
       begin('credential');
@@ -212,6 +261,13 @@ export async function runSetup({ home, agent, answers, run, deps = {}, log = ()
 
     // --- provision the pod and bring federation up ---
     begin('bootstrap');
+    // Resuming skipped the checks the fresh paths ran, and the credential it
+    // carries may be the one bound to a pod whose profile is empty — the write
+    // below would 401. Catch it here, as this step, with a sentence.
+    if (resuming) {
+      const ready = await checkPod(pod, { webId: resumeWebId || undefined });
+      if (!ready.ok) throw new Error(ready.error);
+    }
     await agent.bootstrap({ handle, name: name || handle, root, kind, approveJoins, summary, icon, gateway });
     done('bootstrap');
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fedipod",
-  "version": "0.14.0",
+  "version": "0.16.0",
   "description": "Standalone single-actor ActivityPub agent whose wire face, RDF truth and state all live on a Solid pod (CSS). Bundles a Phanpy UI and a Mastodon client-API facade.",
   "type": "module",
   "license": "MIT",

package/scripts/pin-solid-oidc.mjs

@@ -0,0 +1,68 @@
+#!/usr/bin/env node
+// pin-solid-oidc.mjs — vendor a pinned copy of the browser Solid-OIDC client
+// for the front pages (run.html, admin.html).
+//
+// Downloads the exact npm tarball, verifies its sha512 against the pin below,
+// extracts the worker-free CORE build (SessionCore — no SharedWorker, right for
+// these one-shot sign-in pages), strips the trailing sourceMappingURL, prepends
+// a provenance banner, and writes web/front/solid-oidc-client.js.
+//
+// Re-pin: bump VERSION + INTEGRITY (from `npm view @uvdsl/solid-oidc-client-browser@<v> dist.integrity`)
+// and re-run. The output filename stays unversioned so routes/tests don't churn.
+
+import { createHash } from 'node:crypto';
+import { writeFileSync, mkdirSync } from 'node:fs';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { gunzipSync } from 'node:zlib';
+
+const NAME = '@uvdsl/solid-oidc-client-browser';
+const VERSION = '0.2.3';
+const INTEGRITY = 'sha512-WzVlxv46EUSoqm7ovsWJRZq8KEI/CdpA9O1fXoiP8bihs2cNxPnet3YcqvIYWYMsTrf0zsR031l5s/BzQ9MEgA==';
+const TARBALL = `https://registry.npmjs.org/@uvdsl/solid-oidc-client-browser/-/solid-oidc-client-browser-${VERSION}.tgz`;
+const ENTRY = 'package/dist/esm/core/index.min.js';
+
+const here = dirname(fileURLToPath(import.meta.url));
+const outFile = resolve(here, '..', 'web', 'front', 'solid-oidc-client.js');
+
+function verifyIntegrity(buf, integrity) {
+  const [alg, expected] = integrity.split('-', 2);
+  const actual = createHash(alg).update(buf).digest('base64');
+  if (actual !== expected) {
+    throw new Error(`integrity mismatch: expected ${alg}-${expected}, got ${alg}-${actual}`);
+  }
+}
+
+// Minimal ustar tar reader — enough to pull one file out of the npm tarball.
+function readTarEntry(tar, wanted) {
+  let off = 0;
+  while (off + 512 <= tar.length) {
+    const name = tar.toString('utf8', off, off + 100).replace(/\0.*$/, '');
+    if (!name) break;
+    const size = parseInt(tar.toString('utf8', off + 124, off + 136).replace(/\0.*$/, '').trim() || '0', 8);
+    const start = off + 512;
+    if (name === wanted) return tar.subarray(start, start + size);
+    off = start + Math.ceil(size / 512) * 512;
+  }
+  return null;
+}
+
+const res = await fetch(TARBALL);
+if (!res.ok) throw new Error(`download failed: HTTP ${res.status}`);
+const gz = Buffer.from(await res.arrayBuffer());
+verifyIntegrity(gz, INTEGRITY);
+
+const tar = gunzipSync(gz);
+const entry = readTarEntry(tar, ENTRY);
+if (!entry) throw new Error(`entry not found in tarball: ${ENTRY}`);
+
+let code = entry.toString('utf8').replace(/\n?\/\/# sourceMappingURL=.*$/m, '');
+const banner =
+  `// ${NAME}@${VERSION} — vendored worker-free Solid-OIDC client (core build).\n` +
+  `// tarball ${INTEGRITY}\n` +
+  `// license MIT — https://github.com/uvdsl/solid-oidc-client-browser\n` +
+  `// Regenerate with: node scripts/pin-solid-oidc.mjs\n`;
+
+mkdirSync(dirname(outFile), { recursive: true });
+writeFileSync(outFile, banner + code + '\n');
+console.log(`[pin-solid-oidc] wrote ${outFile} (${(code.length / 1024).toFixed(1)} KB)`);

package/web/admin/setup/index.html

@@ -20,7 +20,7 @@ fieldset { border: 1px solid #bbb; border-radius: .4rem; margin: 1rem 0; padding
 legend { padding: 0 .3rem; font-weight: 600; }
 label { display: block; margin: .75rem 0 .2rem; }
 .hint { color: #666; font-size: .9rem; margin: .15rem 0 0; }
-input[type=text], input[type=email], input[type=url], input[type=password], textarea {
+input[type=text], input[type=email], input[type=url], input[type=password], select, textarea {
   font: inherit; width: 100%; padding: .5rem; box-sizing: border-box;
   border: 1px solid #767676; border-radius: .3rem; background: Field; color: FieldText;
 }
@@ -94,7 +94,8 @@ button:disabled { opacity: .5; cursor: default; }
   <ul class="steps" id="run-steps"></ul>
   <p class="sr-only" id="run-say" role="status"></p>
   <p class="err" id="run-error" role="alert"></p>
-  <p><button id="run-again" title="   Try the step that failed again" hidden>Try again</button></p>
+  <p><button id="run-again" title="   Try the step that failed again" hidden>Try again</button>
+    <button id="run-reenter" title="   Discard the credential and enter the account and pod again" hidden>Re-enter credentials</button></p>
 </section>
 
 <section id="pane-form" hidden>
@@ -124,8 +125,19 @@ button:disabled { opacity: .5; cursor: default; }
       <label class="choice"><input type="radio" name="mode" value="existing">
         Use a pod I already have</label>
 
-      <label for="issuer">Solid identity provider</label>
-      <input type="url" id="issuer" name="issuer" value="https://solidcommunity.net" autocomplete="url">
+      <div id="row-issuer-new">
+        <label for="issuer-new">Solid pod provider</label>
+        <select id="issuer-new" name="issuerNew" aria-describedby="issuer-new-hint">
+          <option value="https://solidcommunity.net">solidcommunity.net</option>
+        </select>
+        <p class="hint" id="issuer-new-hint">Providers that give each pod its own subdomain, so the
+          Fediverse address works everywhere.</p>
+      </div>
+
+      <div id="row-issuer-existing" hidden>
+        <label for="issuer">Solid identity provider</label>
+        <input type="url" id="issuer" name="issuer" value="https://solidcommunity.net" autocomplete="url">
+      </div>
 
       <label for="email">Solid Account email/username</label>
       <input type="email" id="email" name="email" autocomplete="email" placeholder="you@example.org">
@@ -153,6 +165,10 @@ button:disabled { opacity: .5; cursor: default; }
       </div>
     </fieldset>
 
+    <p id="row-reenter" class="warn" hidden>Finishing a setup that already has an account credential.
+      Wrong account or pod?
+      <button type="button" id="form-reenter" title="   Discard the credential and enter the account and pod again">Re-enter credentials</button></p>
+
     <h2>You will be</h2>
     <p class="address" id="preview">…</p>
     <div id="preview-notes"></div>