fedipod 0.8.0 → 0.10.0

package/lib/proof.mjs

@@ -0,0 +1,79 @@
+// proof.mjs — FEP-8b32 object integrity proofs (Data Integrity, eddsa-jcs-2022).
+//
+// An HTTP signature covers one delivery and says nothing about who wrote what
+// was inside it. A proof travels with the activity, so a server that receives
+// one of ours second-hand — carried by a group, or forwarded by a follower's
+// server — can tell it is ours without asking us.
+//
+// The RSA `#main-key` and its HTTP signatures are untouched; this is a second
+// key alongside, which is what the Data Integrity suites require.
+
+import crypto from 'node:crypto';
+import serialize from 'json-canon';
+
+// multicodec: an Ed25519 public key is its 32 raw bytes behind 0xed 0x01.
+const ED25519_PREFIX = Buffer.from([0xed, 0x01]);
+const B58 = '123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz';
+
+export function base58btc(bytes) {
+  const b = Buffer.from(bytes);
+  let n = 0n;
+  for (const byte of b) n = (n << 8n) + BigInt(byte);
+  let out = '';
+  while (n > 0n) { out = B58[Number(n % 58n)] + out; n /= 58n; }
+  for (const byte of b) { if (byte !== 0) break; out = B58[0] + out; }
+  return out;
+}
+
+/** The `publicKeyMultibase` form of an Ed25519 public key in PEM. */
+export function multibaseEd25519(publicPem) {
+  const raw = Buffer.from(crypto.createPublicKey(publicPem).export({ format: 'jwk' }).x, 'base64url');
+  return 'z' + base58btc(Buffer.concat([ED25519_PREFIX, raw]));
+}
+
+/** The signing key, as WebCrypto wants it. */
+export function edPrivateKey(privatePem) {
+  const jwk = crypto.createPrivateKey(privatePem).export({ format: 'jwk' });
+  return crypto.subtle.importKey('jwk', { ...jwk, key_ops: ['sign'] }, { name: 'Ed25519' }, true, ['sign']);
+}
+
+const sha256 = (s) => crypto.createHash('sha256').update(s).digest();
+
+// The proof's own terms have to be declared in the document that carries it,
+// or a receiver that processes JSON-LD expands the proof away before it ever
+// looks at it. Declared BEFORE signing, because the proof covers the document
+// exactly as sent, `@context` included.
+export const DI_CTX = 'https://w3id.org/security/data-integrity/v1';
+
+function withProofContext(doc) {
+  const ctx = doc['@context'];
+  const list = Array.isArray(ctx) ? ctx : ctx ? [ctx] : [];
+  if (list.includes(DI_CTX)) return doc;
+  return { ...doc, '@context': [...list, DI_CTX] };
+}
+
+/**
+ * Return the activity with a `proof` attached. The proof covers the activity
+ * exactly as it goes on the wire, minus the proof itself — so it must be the
+ * last thing added, and nothing may edit the activity afterwards.
+ *
+ * Whole seconds on `created`: a verifier re-serializes the timestamp it was
+ * given, and a fractional one has more than one spelling.
+ */
+export async function attachProof(activity, { privateKey, verificationMethod, created = new Date() } = {}) {
+  if (!privateKey || !verificationMethod || !activity || typeof activity !== 'object') return activity;
+  const { proof: _existing, ...bare } = activity;
+  const doc = withProofContext(bare);
+  const config = {
+    '@context': doc['@context'],
+    type: 'DataIntegrityProof',
+    cryptosuite: 'eddsa-jcs-2022',
+    verificationMethod,
+    proofPurpose: 'assertionMethod',
+    created: new Date(created).toISOString().replace(/\.\d+Z$/, 'Z'),
+  };
+  const digest = Buffer.concat([sha256(serialize(config)), sha256(serialize(doc))]);
+  const sig = await crypto.subtle.sign('Ed25519', privateKey, digest);
+  const { '@context': _ctx, ...emitted } = config;
+  return { ...doc, proof: { ...emitted, proofValue: 'z' + base58btc(Buffer.from(sig)) } };
+}

package/lib/publisher.mjs

@@ -22,7 +22,7 @@ const AGENT_VERSION = JSON.parse(fs.readFileSync(
   path.join(path.dirname(fileURLToPath(import.meta.url)), '../package.json'), 'utf8')).version;
 
 export class Publisher {
-  constructor({ config, remote, local, store, deliverer, publicKeyPem, log = console.log,
+  constructor({ config, remote, local, store, deliverer, publicKeyPem, assertionKey = null, log = console.log,
     probeFetch = null, resolveMention = null, privateOnPod = true,
   }) {
     this.config = config;
@@ -31,6 +31,7 @@ export class Publisher {
     this.store = store;
     this.deliverer = deliverer;
     this.publicKeyPem = publicKeyPem;
+    this.assertionKey = assertionKey;      // Ed25519 public half, multibase; null = no proofs
     // A fronted identity (config.gateway.frontActor) advertises its ids on a
     // shared domain; the map tells RemotePod where each writes on the pod.
     const publicBase = config.gateway?.frontActor
@@ -76,7 +77,8 @@ export class Publisher {
     const actorDoc = wire.actorDoc({
       urls, handle: this.config.handle, name: this.config.name, publicKeyPem: this.publicKeyPem,
       movedTo: this.config.movedTo || null, kind: this.config.kind,
-      approveJoins: !!this.config.approveJoins,
+      approveJoins: wire.followsNeedApproval(this.config),
+      assertionKey: this.assertionKey,
       summary: this.config.summary || null, icon: this.config.icon || null,
       image: this.config.image || null, fields: this.config.fields || [],
       webId: this.remote.webId || null,
@@ -350,7 +352,8 @@ export class Publisher {
     await this.remote.putJson(urls.actor, wire.actorDoc({
       urls, handle: this.config.handle, name: this.config.name,
       publicKeyPem: this.publicKeyPem, movedTo: target, kind: this.config.kind,
-      approveJoins: !!this.config.approveJoins,
+      approveJoins: wire.followsNeedApproval(this.config),
+      assertionKey: this.assertionKey,
       summary: this.config.summary || null, icon: this.config.icon || null,
       image: this.config.image || null, fields: this.config.fields || [],
       webId: this.remote.webId || null,

package/lib/tagfeed.mjs

@@ -135,10 +135,10 @@ export class TagFeed {
         if (!this.store.getActors()[author]) {
           await this.intake.fetchAP(author).catch(() => {});   // warm name+avatar
         }
-        const { attachmentsOf, sanitizeHtml } = await import('./wire.mjs');
+        const { attachmentsOf, titledContent } = await import('./wire.mjs');
         const attachments = attachmentsOf(note);
         this.store.addStatus({
-          noteId, actor: author, content: sanitizeHtml(note.content),
+          noteId, actor: author, content: titledContent(note),
           published: note.published, inReplyTo: note.inReplyTo, kind: 'tag', tag,
           ...(attachments.length ? { attachments } : {}),
         });

package/lib/update.mjs

@@ -42,16 +42,21 @@ export async function checkLatest({ current = localVersion(), fetchImpl = fetch
   } catch { return null; }
 }
 
+// The npm half, injectable — a test asking what runUpdate DOES must never be
+// able to install software on the machine running it.
+const npmInstallLatest = () =>
+  execFileSync('npm', ['install', '-g', 'fedipod@latest'], { stdio: 'pipe' });
+
 // Fast-forward only: a checkout with local changes is somebody's work, and an
 // update must refuse rather than eat it.
-export function runUpdate({ root = repoRoot(), log = () => {} } = {}) {
+export function runUpdate({ root = repoRoot(), log = () => {}, install = npmInstallLatest } = {}) {
   // The ordinary install comes from npm, where updating is npm's job and the
   // files under us are not ours to move. A checkout is somebody working on it,
   // and gets the fast-forward below.
   if (!fs.existsSync(path.join(root, '.git'))) {
     try {
       log('updating from npm…');
-      execFileSync('npm', ['install', '-g', 'fedipod@latest'], { stdio: 'pipe' });
+      install();
       return { ok: true, note: 'updated from npm — restart the agent to serve it' };
     } catch (e) {
       return { ok: false,

package/lib/wire.mjs

@@ -87,7 +87,19 @@ export function jrd({ handle, host, actor }) {
 
 // `kind: 'group'` publishes a Group rather than a Person, which is what makes
 // Mastodon and Lemmy treat the actor as a community you join.
-export function actorDoc({ urls, handle, name, publicKeyPem, movedTo = null, kind = 'person',
+// Whether a follow will be held for the operator instead of accepted on
+// arrival. A person's follows wait unless `autoAcceptFollows` says otherwise,
+// because a delivery on its own proves nothing about who sent it; a group is
+// open unless its operator asked to see joins. The actor document has to say
+// the same thing, or a remote server shows "Following" for a follow that is
+// in fact still waiting, and nothing ever tells it otherwise.
+export function followsNeedApproval(config = {}) {
+  return !!config.approveJoins || (config.kind !== 'group' && !config.autoAcceptFollows);
+}
+
+export const assertionKeyId = (urls) => urls.actor + '#ed25519-key';
+
+export function actorDoc({ urls, handle, name, publicKeyPem, assertionKey = null, movedTo = null, kind = 'person',
   approveJoins = false, summary = null, icon = null, image = null, fields = [],
   webId = null, aliases = [], moderators = null, pendingFollowers = null, pendingFollowing = null,
   blocked = null, inbox = null }) {
@@ -103,6 +115,12 @@ export function actorDoc({ urls, handle, name, publicKeyPem, movedTo = null, kin
   // inline exactly as Mastodon declares it.
   context.push({ toot: 'http://joinmastodon.org/ns#', featured: { '@id': 'toot:featured', '@type': '@id' } });
   if (approveJoins) context.push({ manuallyApprovesFollowers: 'as:manuallyApprovesFollowers' });
+  // FEP-8b32. The Multikey is a SECOND key beside publicKey/#main-key, not a
+  // replacement: HTTP signatures stay RSA, and only the proof is Ed25519.
+  // `assertionMethod` comes from the DID context and the key's own terms from
+  // the Multikey one; the proof's terms travel with the proof, not here.
+  if (assertionKey) context.push('https://www.w3.org/ns/did/v1',
+    'https://w3id.org/security/multikey/v1');
   // FEP-4ccd and FEP-c648 terms, declared exactly as those FEPs declare them,
   // and only when the collections are actually published.
   if (pendingFollowers || pendingFollowing) {
@@ -130,6 +148,10 @@ export function actorDoc({ urls, handle, name, publicKeyPem, movedTo = null, kin
     id: urls.actor,
     type: kind === 'group' ? 'Group' : 'Person',
     ...(approveJoins ? { manuallyApprovesFollowers: true } : {}),
+    ...(assertionKey ? { assertionMethod: [{
+      id: assertionKeyId(urls), type: 'Multikey', controller: urls.actor,
+      publicKeyMultibase: assertionKey,
+    }] } : {}),
     ...(movedTo ? { movedTo } : {}),
     ...(webId || aliases.length ? { alsoKnownAs: [...(webId ? [webId] : []), ...aliases] } : {}),
     preferredUsername: handle,
@@ -526,11 +548,28 @@ export function sanitizeHtml(html) {
   });
 }
 
+// A Lemmy post, a blog article, a PeerTube video and a Bookwyrm review each
+// carry their headline in `name` and their body in `content`. Reading content
+// alone loses the headline, and a link post is often nothing else — so keep it
+// as the first line, unless the body already opens with it.
+export function titledContent(note) {
+  const html = sanitizeHtml(note?.content);
+  const types = Array.isArray(note?.type) ? note.type : [note?.type];
+  const title = typeof note?.name === 'string' ? note.name.trim() : '';
+  if (!title || types.includes('Note')) return html;
+  const opening = html.replace(/<[^>]*>/g, ' ').replace(/\s+/g, ' ').trim().toLowerCase();
+  if (opening.startsWith(title.toLowerCase())) return html;
+  const esc = String(title).replace(/[&<>]/g, c => HTML_ESCAPES[c]);
+  return `<p><strong>${esc}</strong></p>${html}`;
+}
+
 // Normalize a wire Note's attachment list to { url, mediaType, description }.
 export function attachmentsOf(note) {
   const list = Array.isArray(note?.attachment) ? note.attachment : note?.attachment ? [note.attachment] : [];
+  // A bare Link carries `href` and no `url` — Lemmy's link posts arrive that
+  // way, and reading only `url` dropped the link the post was about.
   return list.map(a => ({
-    url: typeof a?.url === 'string' ? a.url : a?.url?.href,
+    url: typeof a?.url === 'string' ? a.url : a?.url?.href || (typeof a?.href === 'string' ? a.href : undefined),
     mediaType: a?.mediaType || '',
     ...(a?.name ? { description: a.name } : {}),
   })).filter(a => a.url);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fedipod",
-  "version": "0.8.0",
+  "version": "0.10.0",
   "description": "Standalone single-actor ActivityPub agent whose wire face, RDF truth and state all live on a Solid pod (CSS). Bundles a Phanpy UI and a Mastodon client-API facade.",
   "type": "module",
   "license": "MIT",
@@ -43,6 +43,7 @@
     "@netlify/blobs": "^10.7.13",
     "@solid/access-token-verifier": "^2.1.1",
     "jose": "^6.2.8",
+    "json-canon": "^1.0.1",
     "node-forge": "^1.4.0",
     "rdflib": "^2.4.0",
     "sanitize-html": "^2.17.6",

package/run-agent.mjs

@@ -47,7 +47,7 @@ import { Lease } from './lib/lease.mjs';
 import { startAdmin } from './lib/admin.mjs';
 import { exposureProblem, hostLabel } from './lib/guard.mjs';
 import { pendingSteps } from './lib/migrate.mjs';
-import { apUrls } from './lib/wire.mjs';
+import { apUrls, assertionKeyId } from './lib/wire.mjs';
 import { followActor, unfollowActor, resolveHandle } from './lib/social.mjs';
 
 export class Agent {
@@ -324,11 +324,14 @@ export class Agent {
     clearInterval(this.schedTimer);
     this.deliverer = new Deliverer({
       store: this.store, rsaPrivate: keys.rsaPrivate, keyId: this.urls.actor + '#main-key',
+      actorId: this.urls.actor, edPrivate: keys.edPrivate,
+      proofKeyId: assertionKeyId(this.urls),
       log: this.log, passive: this.viewer,
     });
     this.publisher = new Publisher({
       config, remote: this.remote, local: this.local, store: this.store,
-      deliverer: this.deliverer, publicKeyPem: keys.rsaPublicPem, log: this.log,
+      deliverer: this.deliverer, publicKeyPem: keys.rsaPublicPem,
+      assertionKey: keys.edPublicMultibase, log: this.log,
       resolveMention: (h) => resolveHandle(this, h),
       // Whether the fediverse tree is on the pod at all, so the ACL check does
       // not probe for something the default layout keeps on local disk.
@@ -355,7 +358,9 @@ export class Agent {
     this.intake.bskyGroup = null;
     if (this.viewer) {
       this.startViewer();
-      this.log(`another agent is active for this pod — viewing as @${config.handle} (read-only)`);
+      this.log(this.lease.denied === 'unreadable'
+        ? `the pod cannot be read, so the lease is unknown — viewing as @${config.handle} (read-only)`
+        : `another agent is active for this pod — viewing as @${config.handle} (read-only)`);
       return true;
     }
     await this.startActive({ repair });
@@ -389,7 +394,9 @@ export class Agent {
       log: this.log,
     });
     this.publisher.publicKeyPem = keys.rsaPublicPem;
+    this.publisher.assertionKey = keys.edPublicMultibase;
     this.deliverer.rsaPrivate = keys.rsaPrivate;
+    this.deliverer.edPrivate = keys.edPrivate;
     await this.publisher.publishProfile();
     return { changed: before !== keys.rsaPublicPem, publicKeyPem: keys.rsaPublicPem };
   }

package/web/admin/admin.js

@@ -141,7 +141,7 @@ function render() {
     ['local host', (origins.named || origins.loopback || `http://localhost:${config.port}`)
       .replace(/\/$/, '')],
   ];
-  if (config.update || config.pendingUpgrade?.length) rows.push(['software', 'ctl']);
+  if (config.version || config.update || config.pendingUpgrade?.length) rows.push(['software', 'ctl']);
   if (config.quiescedAt) rows.push(['parked since', config.quiescedAt]);
   if (config.movedTo) rows.push(['moved to', config.movedTo]);
   // A person gates followers here; a group's gate is the joins control on its
@@ -190,8 +190,13 @@ function render() {
       dd.append(UPDATE_CTL);
       UPDATE_CTL.hidden = false;
       const u = config.update;
+      // The version this agent is running, never the one sitting in the
+      // checkout — saying otherwise would name a version nobody is serving.
+      const running = config.version || u?.current || null;
       const words = [];
-      if (u) words.push(u.available ? `FediPod ${u.current} — ${u.latest} available` : `FediPod ${u.current}`);
+      if (running) words.push(u?.available ? `FediPod ${running} — ${u.latest} available` : `FediPod ${running}`);
+      if (config.versionOnDisk && running && config.versionOnDisk !== running)
+        words.push(`${config.versionOnDisk} is on disk — restart to run it`);
       if (config.pendingUpgrade?.length) words.push('older data layout — run `fedipod upgrade` in a terminal');
       UPDATE_WORD.textContent = words.join('; ');
       UPDATE_GO.hidden = !u?.available;
@@ -232,6 +237,7 @@ function render() {
   renderAliases();
   renderOthers();
   renderInbox();
+  renderGateway();
   if (config.kind === 'group') {
     // Its lists have no bound, so this page scrolls — see body.group in the CSS.
     document.body.classList.add('group');
@@ -931,9 +937,62 @@ async function renderInbox() {
   panel.hidden = false;
 }
 
-// The inbox-gateway / multi-user-front operator panel is parked: not shown in
-// the UI yet. The backend routes (GET/POST /gateway) still exist and work, so
-// this can be re-added when the feature is ready to expose.
+// The gateway panel: attach through a multi-user front with this agent's own
+// credential, see what the door has verified, detach back to the pod inbox.
+let gwTimer = null;
+async function renderGateway() {
+  const { status, json: g } = await api('/gateway');
+  if (status !== 200 || !g) return;              // no answer, no surface
+  $('pane-gateway').hidden = false;
+  if (g.configured) {
+    const host = (() => { try { return new URL(g.url).host; } catch { return g.url; } })();
+    const st = g.stats || {};
+    $('gateway-summary').textContent = `Attached to ${host} (mode ${g.mode})`
+      + (g.frontActor ? `, publishing as ${g.frontActor}` : '')
+      + ` — ${st.verified || 0} deliveries verified, ${st.unverified || 0} unverified.`;
+    $('gateway-attach-form').hidden = true;
+    $('gateway-attached').hidden = false;
+  } else {
+    $('gateway-summary').textContent = 'Mail arrives directly at your pod\'s own inbox.';
+    $('gateway-attach-form').hidden = false;
+    $('gateway-attached').hidden = true;
+    if (!$('gw-name').value && config?.handle) $('gw-name').value = config.handle;
+  }
+}
+// Live availability, asked through the agent (the front answers it without CORS).
+function gwCheck() {
+  clearTimeout(gwTimer);
+  const front = $('gw-front').value.trim().replace(/\/+$/, '');
+  const name = $('gw-name').value.trim().toLowerCase();
+  $('gw-name-msg').textContent = ''; $('gw-name-msg').className = 'hint';
+  if (!front || !name) return;
+  gwTimer = setTimeout(async () => {
+    const { status, json } = await postJson('/gateway', { action: 'check', front, handle: name });
+    if (status !== 200 || !json) return;
+    $('gw-name-msg').textContent = json.available
+      ? `${name} is free at ${front.replace(/^https?:\/\//, '')}`
+      : (json.reason || 'that name is taken');
+    $('gw-name-msg').className = json.available ? 'hint' : 'warn';
+  }, 300);
+}
+$('gw-front').addEventListener('input', gwCheck);
+$('gw-name').addEventListener('input', gwCheck);
+$('gw-attach').onclick = async () => {
+  const front = $('gw-front').value.trim().replace(/\/+$/, '');
+  const fronted = $('gw-shape').value === 'front';
+  $('gw-attach').disabled = true;
+  const r = await write('/gateway',
+    { action: 'attach', front, handle: $('gw-name').value.trim().toLowerCase(), fronted },
+    fronted ? 'attached — restart the agent to publish under the gateway name'
+      : 'attached — your mail now arrives through the gateway, filtered');
+  $('gw-attach').disabled = false;
+  if (r) renderGateway();
+};
+$('gw-detach').onclick = async () => {
+  const r = await write('/gateway', { action: 'forget' },
+    'detached — the actor was republished advertising your pod\'s own inbox');
+  if (r) renderGateway();
+};
 
 $('inbox-keep').addEventListener('click', () => {
   dismissed = true;

package/web/admin/index.html

@@ -314,9 +314,36 @@ pre { overflow-x: auto; background: #0001; padding: .6rem; border-radius: .3rem;
   </span>
 </section>
 
-<!-- The inbox-gateway / multi-user-front controls are deliberately not shown
-     in the UI yet. The backend routes (GET/POST /gateway) exist and work; the
-     operator surface is parked until the feature is ready to expose. -->
+<!-- The inbox gateway: a mail filter for an account that stays yours. -->
+<section id="pane-gateway" hidden>
+  <h2><span class="hlabel">Gateway</span></h2>
+  <p id="gateway-summary"></p>
+  <div id="gateway-attach-form" hidden>
+    <p class="hint">A gateway filters your fediverse mail before it reaches your pod: your
+      actor advertises the gateway's door as its inbox, each delivery is verified there,
+      spam is dropped, and the rest lands in your pod as before. Attaching proves the pod
+      with this agent's own credential — no password leaves this machine.</p>
+    <p>
+      <label for="gw-front">Gateway</label>
+      <input type="url" id="gw-front" placeholder="https://fedipod.net" autocomplete="off">
+      <label for="gw-name">Your name there</label>
+      <input type="text" id="gw-name" autocomplete="off" autocapitalize="off" spellcheck="false">
+    </p>
+    <p id="gw-name-msg" class="hint"></p>
+    <p>
+      <select id="gw-shape" aria-label="Name shape" title="   Which address the fediverse sees — the pod-based name keeps everything on your pod; a gateway-based name survives changing pods">
+        <option value="pod">keep my pod-based name</option>
+        <option value="front">use a gateway-based name</option>
+      </select>
+      <button id="gw-attach" class="primary" title="   Create the gateway account and point your mail through its door">Attach</button>
+    </p>
+  </div>
+  <div id="gateway-attached" hidden>
+    <p>
+      <button id="gw-detach" class="inline danger" title="   Republish the actor with your pod's own inbox and forget the gateway">Detach</button>
+    </p>
+  </div>
+</section>
 
 <section id="pane-group" hidden>
   <!-- Both queues are consequences of a moderation setting: with the setting off