fedipod 0.16.0 → 0.17.0

package/lib/admin.mjs

@@ -485,9 +485,19 @@ export function buildAdminSurface({ agent, gate, allowed, log = console.log,
       // C2S (ActivityPub §6) carries its own authentication — a Solid-OIDC
       // DPoP proof or the facade's bearer — so the dk-token gate does not
       // stand in front of it. The Host/Origin firewall above still does.
-      if (p === '/ap/outbox' || p === '/ap/actor') {
+      if (p === '/ap/outbox' || p === '/ap/actor' || p === '/ap/inbox') {
         if (await c2s.handle(req, res, p, url)) return;
       }
+      // Where a client looks first to find out how to sign in (RFC 8414), and
+      // in front of the door for the same reason C2S is: a client that has to
+      // be handed a secret before it can ask how to sign in cannot set itself
+      // up at all. It names endpoints and nothing else, the endpoints it names
+      // refuse without a password anyway, and the host and origin firewall
+      // above still decides who gets this far.
+      if (p === '/.well-known/oauth-authorization-server') {
+        const scheme = req.socket.encrypted || req.headers['x-forwarded-proto'] === 'https' ? 'https' : 'http';
+        return json(res, 200, masto.authorizationServerMetadata(`${scheme}://${req.headers.host}`));
+      }
       if (atDoor && gate(req, res)) return;
       if (p === '/api/v1/streaming/health') {
         res.writeHead(200, { 'content-type': 'text/plain' }); res.end('OK'); return;

package/lib/c2s.mjs

@@ -5,14 +5,26 @@
 // SAME helper the facade and admin surfaces use — this module re-implements
 // no persistence and no delivery, so one write path stays one.
 //
-// GETs are redirects: the pod's documents are the canonical actor and outbox,
-// and a second renderer here would only drift from them.
+// GETs on the actor and outbox are redirects: the pod's documents are the
+// canonical ones, and a second renderer here would only drift from them.
+//
+// The inbox is the exception, and has to be. Deliveries land in a container on
+// the pod which the drain empties as it handles each item, so reading that
+// container tells the owner only what has not been dealt with yet. What was
+// actually received is whole only in the archive, so §5.2's "the owner can
+// read their own inbox" is served from there, by this agent, to the owner
+// alone.
 
 import * as social from './social.mjs';
 import * as wire from './wire.mjs';
 
 const MAX_BODY = 512 * 1024;          // same ceiling the inbox drain enforces
 
+// How many archived items one page of the inbox will read. A page is one
+// month, and a month with more than this is served short rather than costing
+// the pod an unbounded read; the log says when that happened.
+const MAX_INBOX_PAGE = 500;
+
 // §6 names activities; anything else with a type is an object to wrap.
 const ACTIVITY_TYPES = new Set([
   'Create', 'Update', 'Delete', 'Follow', 'Like', 'Announce', 'Undo',
@@ -60,14 +72,102 @@ export class C2S {
     return iri ? this.store.getStatuses().find((s) => s.noteId === iri) : null;
   }
 
+  /** The months the archive holds, newest first. One container listing. */
+  async archiveMonths() {
+    const archive = this.agent.intake?.archive;
+    if (!archive) return [];
+    const { names } = await archive.list('');
+    return (names || [])
+      .map((n) => n.replace(/\/$/u, ''))
+      .filter((n) => /^\d{4}-\d{2}$/u.test(n))
+      .sort()
+      .reverse();
+  }
+
+  /**
+   * The owner's own inbox, §5.2. Paged by month because that is how the
+   * archive is stored, so a page costs one listing and a read per item and no
+   * page is dearer for another month being large.
+   */
+  async sendInbox(res, url) {
+    const id = `${this.urls.base}ap/inbox`;
+    const page = url?.searchParams?.get('page') || null;
+    let months;
+    try {
+      months = await this.archiveMonths();
+    } catch (e) {
+      return this.send(res, 502, { error: `the archive could not be read: ${e.message}` });
+    }
+
+    if (!page) {
+      if (!months.length && this.store.getConfig()?.archiveInbox === false) {
+        this.log('inbox read: nothing to show — this identity does not keep what it receives');
+      }
+      return this.send(res, 200, {
+        '@context': wire.AS_CTX, id, type: 'OrderedCollection',
+        ...(months.length ? { first: `${id}?page=${months[0]}` } : { orderedItems: [] }),
+      });
+    }
+    if (!/^\d{4}-\d{2}$/u.test(page)) {
+      return this.send(res, 400, { error: 'page names a month, written 2026-09' });
+    }
+
+    const archive = this.agent.intake?.archive;
+    let names = [];
+    try {
+      // The trailing slash matters: without it this names a document, not the
+      // container, and a pod answers about the wrong thing.
+      ({ names } = await archive.list(`${page}/`));
+    } catch (e) {
+      return this.send(res, 502, { error: `the archive could not be read: ${e.message}` });
+    }
+    const files = (names || []).filter((n) => n.endsWith('.json')).sort();
+    if (files.length > MAX_INBOX_PAGE) {
+      this.log(`inbox read: ${page} holds ${files.length} items; serving the first ${MAX_INBOX_PAGE}`);
+    }
+    const kept = [];
+    for (const file of files.slice(0, MAX_INBOX_PAGE)) {
+      // Read as written: these records are JSON-LD, and the default read asks
+      // turtle-first, which a server is free to answer with turtle.
+      const read = await archive.read(`${page}/${file}`, { accept: '*/*' });
+      if (!read?.ok || !read.body) continue;
+      try {
+        const record = JSON.parse(read.body);
+        // The record wraps the bytes as they arrived; the activity is those
+        // bytes, not a retelling of them.
+        kept.push({ at: record.receivedAt || '', activity: JSON.parse(record.raw) });
+      } catch { /* a record that will not parse is not one that can be served */ }
+    }
+    kept.sort((a, b) => String(b.at).localeCompare(String(a.at)));
+    const older = months.filter((m) => m < page)[0] || null;
+    return this.send(res, 200, {
+      '@context': wire.AS_CTX,
+      id: `${id}?page=${page}`,
+      type: 'OrderedCollectionPage',
+      partOf: id,
+      ...(older ? { next: `${id}?page=${older}` } : {}),
+      orderedItems: kept.map((k) => k.activity),
+    });
+  }
+
   async handle(req, res, pathname, url) {   // eslint-disable-line no-unused-vars
-    if (pathname !== '/ap/outbox' && pathname !== '/ap/actor') return false;
+    if (pathname !== '/ap/outbox' && pathname !== '/ap/actor' && pathname !== '/ap/inbox') return false;
     if (req.method === 'OPTIONS') {
-      res.writeHead(204, { allow: 'GET, POST, OPTIONS' }); res.end(); return true;
+      res.writeHead(204, { allow: pathname === '/ap/inbox' ? 'GET, OPTIONS' : 'GET, POST, OPTIONS' });
+      res.end(); return true;
     }
     if (!this.agent.configured() || !this.urls) {
       return this.send(res, 409, { error: 'agent not configured' });
     }
+    if (pathname === '/ap/inbox') {
+      if (req.method !== 'GET' && req.method !== 'HEAD') {
+        return this.send(res, 405, { error: "deliveries go to this actor's inbox on the pod, which the "
+          + 'actor document names; this address is the owner reading their own' });
+      }
+      const reader = await this.auth(req, pathname);
+      if (!reader.ok) return this.send(res, reader.status, { error: reader.error });
+      return this.sendInbox(res, url);
+    }
     if (req.method === 'GET' || req.method === 'HEAD') {
       // The pod's copy is the document; send the reader there.
       const target = pathname === '/ap/actor' ? this.urls.actor : this.urls.outbox;

package/lib/mastoapi.mjs

@@ -16,6 +16,7 @@ import { sanitizeHtml, followsNeedApproval, publicHandle } from './wire.mjs';
 import { authorOf } from './intake.mjs';
 import { profileUrl, postUrl } from './bskyfeed.mjs';
 import { Push } from './webpush.mjs';
+import { safeFetch, readCapped } from './safefetch.mjs';
 
 // What an attachment is allowed to BE. Anything else is stored as bytes, which
 // a browser downloads rather than runs.
@@ -62,6 +63,8 @@ const AUTHZ_WINDOW_MS = 60_000;
 const AUTHZ_MAX_ATTEMPTS = 5;
 const CODE_TTL_MS = 5 * 60_000;                  // an authorization code is short-lived
 const MAX_APPS = 200;                            // registered third-party clients, capped
+const CLIENT_DOC_TTL_MS = 10 * 60_000;           // how long a fetched client document is trusted
+const CLIENT_DOC_MAX = 64 * 1024;                // it names a client; it is not a payload
 
 export class MastoApi {
   constructor({ agent, log = console.log, allowed = null, scheme = null, embedded = false }) {
@@ -127,7 +130,91 @@ export class MastoApi {
   // said, and only that client, presenting its secret, can exchange it for a
   // bearer. A redirect back to this agent's own origin keeps the local flow.
   apps() { return this.store.read('oauth-apps.json', []); }
+  /**
+   * What a client needs to know before it can sign in, at the address RFC 8414
+   * puts it. The actor carries the same two endpoints; a client that looks
+   * here first finds everything rather than the minimum.
+   *
+   * `none` among the authentication methods is what says a client keeping no
+   * secret is welcome, which is the whole of what a browser app needs to hear.
+   */
+  authorizationServerMetadata(origin) {
+    const at = (p) => `${origin.replace(/\/$/u, '')}${p}`;
+    return {
+      issuer: origin.replace(/\/$/u, ''),
+      authorization_endpoint: at('/oauth/authorize'),
+      token_endpoint: at('/oauth/token'),
+      revocation_endpoint: at('/oauth/revoke'),
+      registration_endpoint: at('/api/v1/apps'),
+      response_types_supported: [ 'code' ],
+      grant_types_supported: [ 'authorization_code' ],
+      code_challenge_methods_supported: [ 'S256', 'plain' ],
+      token_endpoint_auth_methods_supported: [ 'client_secret_post', 'none' ],
+      scopes_supported: [ 'read', 'write', 'follow', 'push' ],
+    };
+  }
+
   findApp(clientId) { return clientId ? this.apps().find(a => a.clientId === clientId) || null : null; }
+
+  /**
+   * A client that publishes its own metadata document is named by that
+   * document's URL and registers nothing here: the document says who it is
+   * and where it may be sent back to. Such a client keeps no secret, so it
+   * always proves itself with a challenge instead.
+   *
+   * The fetch is the guarded one — a client id is a URL a stranger chose, and
+   * an unguarded fetch of it would ask this machine to reach wherever they
+   * pointed.
+   */
+  async resolveClientDocument(clientId) {
+    if (!/^https:\/\//iu.test(String(clientId || ''))) return null;   // cleartext is refused
+    this.clientDocs = this.clientDocs || new Map();
+    const seen = this.clientDocs.get(clientId);
+    if (seen && Date.now() - seen.at < CLIENT_DOC_TTL_MS) return seen.client;
+    let doc;
+    try {
+      const res = await safeFetch(clientId, { headers: { accept: 'application/json' } });
+      if (res.status >= 400) { this.log(`client document ${clientId} → ${res.status}`); return null; }
+      doc = JSON.parse(await readCapped(res, CLIENT_DOC_MAX));
+    } catch (e) {
+      this.log(`client document ${clientId} could not be read: ${e.message}`);
+      return null;
+    }
+    // It must claim to be itself: a document naming some other id would let
+    // one client borrow another's name.
+    if (doc?.client_id !== clientId) {
+      this.log(`client document ${clientId} names ${doc?.client_id ?? 'nothing'} — refused`);
+      return null;
+    }
+    const redirectUris = [].concat(doc.redirect_uris || []).filter((u) => typeof u === 'string');
+    if (!redirectUris.length) { this.log(`client document ${clientId} names no redirect — refused`); return null; }
+    const client = {
+      clientId, redirectUris,
+      name: String(doc.client_name || clientId).slice(0, 200),
+      scopes: 'read write follow',
+    };
+    this.clientDocs.set(clientId, { at: Date.now(), client });
+    return client;
+  }
+
+  /**
+   * Whether a redirect the client asked for is one it published.
+   *
+   * A native client listens on whatever port the machine gave it, so it can
+   * only publish the loopback address without one (RFC 8252). The port is
+   * therefore not part of the match there, and nowhere else.
+   */
+  static redirectMatches(published, asked) {
+    if (published === asked) return true;
+    try {
+      const a = new URL(published);
+      const b = new URL(asked);
+      const loopback = (h) => h === '127.0.0.1' || h === '[::1]' || h === 'localhost';
+      if (!loopback(a.hostname) || a.hostname !== b.hostname) return false;
+      return a.protocol === b.protocol
+        && a.pathname.replace(/\/$/u, '') === b.pathname.replace(/\/$/u, '');
+    } catch { return false; }
+  }
   registerApp({ name, website, redirectUris, scopes }) {
     const app = {
       clientId: crypto.randomBytes(16).toString('hex'),
@@ -143,13 +230,39 @@ export class MastoApi {
   // A short-lived, single-use authorization code for a registered client, kept
   // apart from masto-tokens.json so the code is NOT a bearer until it is
   // exchanged with the client secret.
-  mintCode({ clientId, redirectUri, scope }) {
+  mintCode({ clientId, redirectUri, scope, challenge = null, challengeMethod = null }) {
     const code = crypto.randomBytes(24).toString('hex');
     const now = Date.now();
     const kept = this.store.read('oauth-codes.json', []).filter(c => now - c.createdAt < CODE_TTL_MS);
-    this.store.write('oauth-codes.json', [...kept, { code, clientId, redirectUri, scope, createdAt: now }].slice(-50));
+    this.store.write('oauth-codes.json', [ ...kept, {
+      code, clientId, redirectUri, scope, createdAt: now,
+      // What the client promised to prove when it comes back for the token.
+      // A client that cannot keep a secret — anything running in a browser —
+      // has this instead, and it is the only thing standing between a stolen
+      // code and a token.
+      ...(challenge ? { challenge, challengeMethod: challengeMethod || 'plain' } : {}),
+    } ].slice(-50));
     return code;
   }
+  /**
+   * Whether this verifier is the one the challenge was made from (RFC 7636).
+   * Length is checked because a short verifier is guessable, which is the
+   * whole thing this is here to prevent.
+   */
+  static provesCode(rec, verifier) {
+    const v = String(verifier || '');
+    if (v.length < 43 || v.length > 128) return false;
+    if ((rec.challengeMethod || 'plain') === 'S256') {
+      const made = crypto.createHash('sha256').update(v).digest('base64url');
+      const given = Buffer.from(made);
+      const known = Buffer.from(String(rec.challenge));
+      return given.length === known.length && crypto.timingSafeEqual(given, known);
+    }
+    const given = Buffer.from(v);
+    const known = Buffer.from(String(rec.challenge));
+    return given.length === known.length && crypto.timingSafeEqual(given, known);
+  }
+
   consumeCode(code) {
     const now = Date.now();
     const all = this.store.read('oauth-codes.json', []);
@@ -620,19 +733,35 @@ export class MastoApi {
       if (req.method === 'POST') { body = await readBody(req); params = new URLSearchParams(body); }
       const redirect = params.get('redirect_uri') || '';
       const app = this.findApp(params.get('client_id') || '');
+      // A client that published its own metadata document needs no
+      // registration here: the document is its name and says where it may be
+      // sent back to.
+      const doc = app ? null : await this.resolveClientDocument(params.get('client_id') || '');
       // A REGISTERED client is always the third-party flow — its code is
       // bound to it and exchanged with its secret — even when its redirect
       // points back at this very agent (a web client served from our own
       // origin registers itself exactly like a phone app does). The local
       // code-is-the-token flow is only for the built-in client, which never
       // registers.
-      const external = !!app;
-      const client = { name: app?.name || null, redirect, scope: params.get('scope') || 'read' };
-      if (external) {
+      const external = !!app || !!doc;
+      const client = { name: app?.name || doc?.name || null, redirect, scope: params.get('scope') || 'read' };
+      if (app) {
         if (!app.redirectUris.includes(redirect)) {
           this.log(`authorize refused: redirect_uri "${redirect}" not registered for ${app.clientId}`);
           return send(400, { error: 'redirect_uri was not registered by this client' });
         }
+      } else if (doc) {
+        if (!doc.redirectUris.some((u) => MastoApi.redirectMatches(u, redirect))) {
+          this.log(`authorize refused: redirect_uri "${redirect}" is not one ${doc.clientId} published`);
+          return send(400, { error: 'redirect_uri is not one this client published' });
+        }
+        // It keeps no secret, so the challenge is the only thing that will
+        // stand between its code and a token. Refuse now rather than mint a
+        // code nothing can prove.
+        if (!params.get('code_challenge')) {
+          this.log(`authorize refused: ${doc.clientId} keeps no secret and offered no challenge`);
+          return send(400, { error: 'a client identified by its own document must send a code_challenge' });
+        }
       } else if (!this.redirectAllowed(redirect)) {
         this.log(`authorize refused: redirect_uri "${redirect}" is not this agent`);
         return send(400, { error: 'redirect_uri must be an address of this agent' });
@@ -640,7 +769,11 @@ export class MastoApi {
       if (req.method === 'POST') {
         if (this.rateLimited()) {
           this.log('authorize rate limited');
-          return sendLoginForm(res, params, 'too many attempts — wait a minute', client);
+          // 429, not 401: a client that reads this as a wrong password will
+          // ask the person to type it again, which is the one thing that
+          // cannot help. Retry-After says how long the wait actually is.
+          return sendLoginForm(res, params, 'too many attempts — wait a minute', client,
+            429, { 'retry-after': String(Math.ceil(AUTHZ_WINDOW_MS / 1000)) });
         }
         if (!pw || !checkPassword(pw, body.password || '')) {
           return sendLoginForm(res, params, 'wrong password — try again', client);
@@ -670,7 +803,9 @@ export class MastoApi {
       }
       // External clients get a bound code; the local flow keeps code==token.
       const code = external
-        ? this.mintCode({ clientId: app.clientId, redirectUri: redirect, scope: client.scope })
+        ? this.mintCode({ clientId: (app || doc).clientId, redirectUri: redirect, scope: client.scope,
+          challenge: params.get('code_challenge') || null,
+          challengeMethod: params.get('code_challenge_method') || null })
         : this.mintToken();
       if (!redirect || redirect === 'urn:ietf:wg:oauth:2.0:oob') return send(200, { code });
       const target = new URL(redirect);
@@ -685,6 +820,44 @@ export class MastoApi {
       // A registered third-party client exchanges its bound code, proving its
       // secret, for a real bearer — the code alone is not a token.
       const app = this.findApp(body.client_id || '');
+      // A client named by its own document keeps no secret at all, so the
+      // challenge is the whole of its proof. The code carries the document's
+      // URL as the client it was bound to.
+      if (!app && body.code_verifier && /^https:\/\//iu.test(String(body.client_id || ''))) {
+        const rec = this.consumeCode(body.code || '');
+        if (!rec || rec.clientId !== body.client_id
+          || (body.redirect_uri && rec.redirectUri !== body.redirect_uri)) {
+          this.log('token refused: code is not a live authorization for that client document');
+          return send(400, { error: 'invalid_grant' });
+        }
+        if (!rec.challenge || !MastoApi.provesCode(rec, body.code_verifier)) {
+          this.log('token refused: the verifier does not answer the challenge this code was made with');
+          return send(400, { error: 'invalid_grant' });
+        }
+        return send(200, { access_token: this.mintToken(), token_type: 'Bearer',
+          scope: rec.scope || 'read', created_at: Math.floor(Date.now() / 1000),
+          ...(this.urls?.actor ? { activitypub_actor_id: this.urls.actor } : {}) });
+      }
+      // A client that runs in a browser cannot keep a secret, so it proves it
+      // is the same caller that asked instead: it sends the verifier for the
+      // challenge it presented at authorize (RFC 7636). Sending a verifier is
+      // what says which of the two flows this is.
+      if (app && body.code_verifier) {
+        const rec = this.consumeCode(body.code || '');
+        if (!rec || rec.clientId !== app.clientId || (body.redirect_uri && rec.redirectUri !== body.redirect_uri)) {
+          this.log('token refused: code is not a live authorization for this client');
+          return send(400, { error: 'invalid_grant' });
+        }
+        // A code minted without a challenge cannot be redeemed with one: that
+        // would let anyone holding a stolen code invent the proof for it.
+        if (!rec.challenge || !MastoApi.provesCode(rec, body.code_verifier)) {
+          this.log('token refused: the verifier does not answer the challenge this code was made with');
+          return send(400, { error: 'invalid_grant' });
+        }
+        return send(200, { access_token: this.mintToken(), token_type: 'Bearer',
+          scope: rec.scope || 'read', created_at: Math.floor(Date.now() / 1000),
+          ...(this.urls?.actor ? { activitypub_actor_id: this.urls.actor } : {}) });
+      }
       if (app && body.client_secret) {
         const given = Buffer.from(String(body.client_secret));
         const known = Buffer.from(app.clientSecret);
@@ -695,8 +868,18 @@ export class MastoApi {
           this.log('token refused: code is not a live authorization for this client');
           return send(400, { error: 'invalid_grant' });
         }
+        // A challenge, once made, is not optional: without this a client could
+        // present one and then skip past it with the secret alone.
+        if (rec.challenge && !MastoApi.provesCode(rec, body.code_verifier)) {
+          this.log('token refused: this code was made with a challenge and the verifier does not answer it');
+          return send(400, { error: 'invalid_grant' });
+        }
         return send(200, { access_token: this.mintToken(), token_type: 'Bearer',
-          scope: rec.scope || 'read', created_at: Math.floor(Date.now() / 1000) });
+          scope: rec.scope || 'read', created_at: Math.floor(Date.now() / 1000),
+          // Which actor the token acts for. A Mastodon client ignores it; an
+          // ActivityPub API client needs it, and asking for it separately
+          // would mean a second round trip before it knows who it is.
+          ...(this.urls?.actor ? { activitypub_actor_id: this.urls.actor } : {}) });
       }
       // Local flow: the code IS the token, minted by /oauth/authorize after the
       // password gate. Minting one here for an unrecognised code handed a
@@ -707,7 +890,9 @@ export class MastoApi {
         this.log('token refused: code is not a live authorization');
         return send(400, { error: 'invalid_grant' });
       }
-      return send(200, { access_token: body.code, token_type: 'Bearer', scope: body.scope || 'read write follow push', created_at: Math.floor(Date.now() / 1000) });
+      return send(200, { access_token: body.code, token_type: 'Bearer',
+        scope: body.scope || 'read write follow push', created_at: Math.floor(Date.now() / 1000),
+        ...(this.urls?.actor ? { activitypub_actor_id: this.urls.actor } : {}) });
     }
     if (pathname === '/oauth/revoke' && req.method === 'POST') {
       // It used to answer 200 and keep the token, so logging out of a client
@@ -1554,7 +1739,7 @@ const escapeHtml = (s) => String(s).replace(/[&<>"']/g, c =>
 const parseRedirects = (v) => (Array.isArray(v) ? v : String(v || '').split(/\s+/))
   .map(s => s.trim()).filter(Boolean);
 
-function sendLoginForm(res, params, error = '', client = null) {
+function sendLoginForm(res, params, error = '', client = null, status = null, headers = {}) {
   const hidden = [...params.entries()].filter(([k]) => k !== 'password')
     .map(([k, v]) => `<input type="hidden" name="${escapeHtml(k)}" value="${escapeHtml(v)}">`).join('\n');
   // Name what is asking, so the owner approves a client they can see rather
@@ -1569,7 +1754,8 @@ function sendLoginForm(res, params, error = '', client = null) {
       + `${where ? `, sending the authorization to <code>${escapeHtml(where)}</code>` : ''}.</p>`
       + `<p>Scope: <code>${escapeHtml(client.scope || 'read')}</code>. Enter the agent password to allow it.</p>`;
   }
-  res.writeHead(error ? 401 : 200, { 'content-type': 'text/html; charset=utf-8' });
+  res.writeHead(status || (error ? 401 : 200),
+    { 'content-type': 'text/html; charset=utf-8', ...headers });
   res.end(`<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">
 <title>FediPod — authorize</title>
 <style>:root{color-scheme:light dark;font-size:125%;--heading:#1a4f8a}

package/lib/publisher.mjs

@@ -23,7 +23,7 @@ const AGENT_VERSION = JSON.parse(fs.readFileSync(
 
 export class Publisher {
   constructor({ config, remote, local, store, deliverer, publicKeyPem, assertionKey = null, log = console.log,
-    probeFetch = null, resolveMention = null, privateOnPod = true,
+    probeFetch = null, resolveMention = null, privateOnPod = true, clientOrigin = null,
   }) {
     this.config = config;
     this.remote = remote;
@@ -32,6 +32,10 @@ export class Publisher {
     this.deliverer = deliverer;
     this.publicKeyPem = publicKeyPem;
     this.assertionKey = assertionKey;      // Ed25519 public half, multibase; null = no proofs
+    // Where this identity's client surface answers, when that is an address a
+    // stranger can reach. Null on a laptop, where the surface is on loopback
+    // and advertising it to the world would name somewhere nobody can go.
+    this.clientOrigin = clientOrigin;
     // A fronted identity (config.gateway.frontActor) advertises its ids on a
     // shared domain; the map tells RemotePod where each writes on the pod.
     const publicBase = config.gateway?.frontActor
@@ -88,6 +92,13 @@ export class Publisher {
       pendingFollowing: priv ? urls.pendingFollowing : null,
       blocked: priv ? urls.blocked : null,
       inbox: gwActive ? gw.url : null,
+      // The agent's own outbox endpoint, where it is reachable: a client
+      // following the actor must arrive somewhere that will take a write.
+      outbox: this.clientOrigin ? `${this.clientOrigin}ap/outbox` : null,
+      // How a client-to-server client finds the way in with nothing configured
+      // by hand. Advertised only where the surface is publicly reachable.
+      oauthAuthorize: this.clientOrigin ? `${this.clientOrigin}oauth/authorize` : null,
+      oauthToken: this.clientOrigin ? `${this.clientOrigin}oauth/token` : null,
     });
     const surface = crypto.createHash('sha256').update(JSON.stringify({
       actor: actorDoc, handle: this.config.handle, host,

package/lib/storage.mjs

@@ -61,9 +61,15 @@ export class HttpStorage {
     return { notModified: false, names, etag: res.headers.get('etag') };
   }
 
-  async read(p, { etag } = {}) {
+  // `accept` is for callers reading something that is RDF but is wanted as it
+  // was written: asking turtle-first for a JSON-LD document gets turtle back,
+  // because the server is entitled to convert between two RDF syntaxes.
+  async read(p, { etag, accept } = {}) {
     const res = await this.fetchImpl(this._url(p), {
-      headers: { accept: 'text/turtle, application/json;q=0.9, */*;q=0.8', ...(etag ? { 'if-none-match': etag } : {}) },
+      headers: {
+        accept: accept || 'text/turtle, application/json;q=0.9, */*;q=0.8',
+        ...(etag ? { 'if-none-match': etag } : {}),
+      },
     });
     if (res.status === 304) return { ok: true, notModified: true, status: 304, body: null, etag };
     if (res.status >= 400) return { ok: false, notModified: false, status: res.status, body: null, etag: null };

package/lib/wire.mjs

@@ -108,7 +108,7 @@ export const assertionKeyId = (urls) => urls.actor + '#ed25519-key';
 export function actorDoc({ urls, handle, name, publicKeyPem, assertionKey = null, movedTo = null, kind = 'person',
   approveJoins = false, summary = null, icon = null, image = null, fields = [],
   webId = null, aliases = [], moderators = null, pendingFollowers = null, pendingFollowing = null,
-  blocked = null, inbox = null }) {
+  blocked = null, inbox = null, outbox = null, oauthAuthorize = null, oauthToken = null }) {
   // manuallyApprovesFollowers is NOT in the base AS2 context, so it is declared
   // inline exactly as Mastodon declares it — and only when we actually use it.
   // It is what makes a client show "Request to follow" rather than "Follow" and
@@ -188,8 +188,23 @@ export function actorDoc({ urls, handle, name, publicKeyPem, assertionKey = null
     inbox: inbox || urls.inbox,
     // Every Mastodon actor publishes one. With a single actor per pod ours is
     // just the inbox, but its absence is the non-standard thing.
-    endpoints: { sharedInbox: inbox || urls.inbox },
-    outbox: urls.outbox,
+    //
+    // The two OAuth entries are how a client-to-server client finds its way in
+    // without being told anything by hand (ActivityPub 4.1). They appear only
+    // where this identity's client surface answers on an address a stranger
+    // can reach, which is why the caller supplies them rather than this
+    // building them from the pod URL.
+    endpoints: {
+      sharedInbox: inbox || urls.inbox,
+      ...(oauthAuthorize ? { oauthAuthorizationEndpoint: oauthAuthorize } : {}),
+      ...(oauthToken ? { oauthTokenEndpoint: oauthToken } : {}),
+    },
+    // Where a client sends what this actor writes, which the protocol says is
+    // this same address. The pod holds the collection and answers reads of it;
+    // a client-to-server write has to reach the agent, and the pod cannot take
+    // one. So where the agent is reachable it is named here, and a read of it
+    // is sent straight on to the pod's own document.
+    outbox: outbox || urls.outbox,
     // The pinned posts, as the collection other servers read when they show
     // this profile. Mastodon's term, declared the way Mastodon declares it.
     featured: urls.featured,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fedipod",
-  "version": "0.16.0",
+  "version": "0.17.0",
   "description": "Standalone single-actor ActivityPub agent whose wire face, RDF truth and state all live on a Solid pod (CSS). Bundles a Phanpy UI and a Mastodon client-API facade.",
   "type": "module",
   "license": "MIT",

package/run-agent.mjs

@@ -338,6 +338,10 @@ export class Agent {
       // Whether the fediverse tree is on the pod at all, so the ACL check does
       // not probe for something the default layout keeps on local disk.
       privateOnPod: !cred.privateRoot,
+      // Inside a pod server the client surface answers on the pod's own
+      // origin, so it can be advertised. Standalone it is on loopback, and
+      // naming it in a world-readable actor would send clients nowhere.
+      clientOrigin: this.embedded ? this.urls.base : null,
     });
     // Intake is constructed even for viewers — its signed fetchAP powers
     // search/deref; start() (draining) is active-only.