fedipod 0.8.0 → 0.9.0

package/lib/deliver.mjs

@@ -4,11 +4,43 @@
 // dropped after MAX_ATTEMPTS (~3 days).
 
 import { signRequest } from '@fedify/fedify/sig';
+import { webcrypto } from 'node:crypto';
+import { attachProof } from './proof.mjs';
 import { pinnedFor, retryAfterMs, HTTP_TIMEOUT_MS } from './safefetch.mjs';
 import { USER_AGENT } from './ua.mjs';
 
 const MAX_REDIRECTS = 3;
 
+// draft-cavage signs `(request-target): <method> <path><query>`. Fedify 2.3.4
+// builds that line from the pathname alone, so a signature over any URL
+// carrying a query is one a correct verifier cannot reconstruct — a paged
+// collection at `?page=2`, a WordPress inbox at `?rest_route=…`. Re-sign just
+// that line, over the header list Fedify already chose; a URL with no query
+// comes back untouched, and anything unexpected is left exactly as signed.
+export async function withQueryInTarget(signed, privateKey) {
+  const url = new URL(signed.url);
+  if (!url.search) return signed;
+  const header = signed.headers.get('signature');
+  if (!header) return signed;
+  const fields = Object.fromEntries(
+    [...header.matchAll(/([A-Za-z]+)="([^"]*)"/g)].map(m => [m[1], m[2]]));
+  const names = fields.headers?.split(/\s+/g) || [];
+  if (!fields.signature || !names.includes('(request-target)')) return signed;
+  if (names.some(n => n.startsWith('(') && n !== '(request-target)')) return signed;
+  const message = names.map(n => n === '(request-target)'
+    ? `(request-target): ${signed.method.toLowerCase()} ${url.pathname}${url.search}`
+    : `${n}: ${(n === 'host' ? signed.headers.get('host') || url.host : signed.headers.get(n)) ?? ''}`)
+    .join('\n');
+  const sig = await webcrypto.subtle.sign('RSASSA-PKCS1-v1_5', privateKey,
+    new TextEncoder().encode(message));
+  const headers = new Headers(signed.headers);
+  headers.set('signature',
+    header.replace(/signature="[^"]*"/, `signature="${Buffer.from(sig).toString('base64')}"`));
+  const init = { method: signed.method, headers, signal: signed.signal };
+  if (signed.method !== 'GET' && signed.method !== 'HEAD') init.body = await signed.arrayBuffer();
+  return new Request(signed.url, init);
+}
+
 const MAX_ATTEMPTS = 12;                       // 2^12 min ≈ 68h of backoff
 const TICK_MS = 60_000;
 const MAX_QUEUE = 2000;                        // beyond it, overflow dead-letters
@@ -25,10 +57,14 @@ export class Deliverer {
   // passive: signing-only (viewer-mode agents) — no queue drain timer, so a
   // read-only agent never mutates shared delivery state. startQueue() flips
   // it live when a viewer is promoted to active.
-  constructor({ store, keyId, rsaPrivate, log = console.log, passive = false }) {
+  constructor({ store, keyId, rsaPrivate, actorId = null, edPrivate = null, proofKeyId = null,
+    log = console.log, passive = false }) {
     this.store = store;
     this.keyId = keyId;
     this.rsaPrivate = rsaPrivate;
+    this.actorId = actorId;
+    this.edPrivate = edPrivate;
+    this.proofKeyId = proofKeyId;
     this.log = log;
     if (!passive) this.startQueue();
   }
@@ -64,7 +100,8 @@ export class Deliverer {
     for (let hop = 0; hop <= MAX_REDIRECTS; hop++) {
       const dispatcher = await pinnedFor(current);
       const req = new Request(current, withUa);
-      const signed = await signRequest(req, this.rsaPrivate, new URL(this.keyId));
+      const signed = await withQueryInTarget(
+        await signRequest(req, this.rsaPrivate, new URL(this.keyId)), this.rsaPrivate);
       const res = await fetch(signed, { ...(dispatcher ? { dispatcher } : {}), redirect: 'manual' });
       if (res.status >= 300 && res.status < 400 && res.headers.get('location')) {
         current = new URL(res.headers.get('location'), current).href;
@@ -101,20 +138,43 @@ export class Deliverer {
   }
 
   // Deliver, queueing on failure.
+  // FEP-8b32: a proof on everything WE author, so a server that meets one of
+  // our activities second-hand can verify it without asking us.
+  //
+  // Only ours. An activity we forward on someone else's behalf keeps whatever
+  // proof its author gave it — signing that one as an assertion of ours would
+  // be claiming to have written it.
+  async proofed(activity) {
+    if (!this.edPrivate || !this.proofKeyId || !activity || typeof activity !== 'object') return activity;
+    if (activity.proof) return activity;
+    const actor = typeof activity.actor === 'string' ? activity.actor : activity.actor?.id;
+    if (!this.actorId || actor !== this.actorId) return activity;
+    try {
+      return await attachProof(activity,
+        { privateKey: this.edPrivate, verificationMethod: this.proofKeyId });
+    } catch (e) {
+      this.log(`proof: ${e.message}`);      // an unproved activity still federates
+      return activity;
+    }
+  }
+
   async deliver(inbox, activity) {
+    // Proved before anything else, so the copy that goes on the queue is the
+    // copy that was signed — a retry days later must not post a bare activity.
+    const signed = await this.proofed(activity);
     // A host we already know is refusing: queue without asking again. This is
     // the path a FRESH activity takes, so without it a fan-out to a struggling
     // server opened one socket per follower before any of this applied.
     const host = hostOf(inbox);
     const until = this._cooling?.get(host);
     if (until && until > Date.now()) {
-      this.log(`${host} is cooling — queueing ${activity.type} rather than asking again`);
-      this._enqueue({ inbox, activity, attempts: 1, nextAt: until });
+      this.log(`${host} is cooling — queueing ${signed.type} rather than asking again`);
+      this._enqueue({ inbox, activity: signed, attempts: 1, nextAt: until });
       return;
     }
     try {
-      await this.deliverNow(inbox, activity);
-      this.log(`delivered ${activity.type} → ${inbox}`);
+      await this.deliverNow(inbox, signed);
+      this.log(`delivered ${signed.type} → ${inbox}`);
     } catch (e) {
       this.log(`delivery failed (${e.message}) — queued`);
       const wait = e.retryAfterMs || 60_000;
@@ -122,7 +182,7 @@ export class Deliverer {
         this._cooling ||= new Map();
         this._cooling.set(host, Date.now() + wait);
       }
-      this._enqueue({ inbox, activity, attempts: 1, nextAt: Date.now() + wait });
+      this._enqueue({ inbox, activity: signed, attempts: 1, nextAt: Date.now() + wait });
     }
   }
 
@@ -140,8 +200,11 @@ export class Deliverer {
   }
 
   async deliverToAll(inboxes, activity) {
+    // Proved once for the whole fan-out: every recipient gets the same bytes,
+    // and one signature is computed rather than one per follower.
+    const signed = await this.proofed(activity);
     // Shared inboxes deduplicate fan-out to the same server.
-    for (const inbox of [...new Set(inboxes)]) await this.deliver(inbox, activity);
+    for (const inbox of [...new Set(inboxes)]) await this.deliver(inbox, signed);
   }
 
   // Serialized, for the same reason Intake.drain is: the tick is 60s and a

package/lib/gateway-core.mjs

@@ -33,7 +33,9 @@ function httpUrl(u) {
 function isBlocked(actor, blocklist = {}) {
   if (!actor) return true;
   if ((blocklist.actors || []).includes(actor)) return true;
-  let host; try { host = new URL(actor).host; } catch { return false; }
+  // hostname, not host: the agent's own isBlocked strips the port, and a door
+  // that keeps it lets a blocked domain back in on a non-default port.
+  let host; try { host = new URL(actor).hostname; } catch { return false; }
   return (blocklist.domains || []).some(d => host === d || host.endsWith('.' + d));
 }
 
@@ -88,7 +90,7 @@ export async function handleDelivery(request, ident, { podPut, fetchImpl = fetch
   // reaches the pod (today it would, drain, and die unapplied). An absent or
   // unfetchable-key signature is NOT dropped: it forwards unverified and the
   // drain's verify-by-dereference still stands behind it.
-  if (v.verified === false && v.reason === 'bad-signature-or-key-unfetchable') {
+  if (v.verified === false && v.reason === 'bad-signature') {
     return { status: 202, reason: 'forged signature' };
   }
 

package/lib/httpsig.mjs

@@ -10,7 +10,7 @@
 // — so the key deref is injected as a loader that goes through safefetch.
 
 import crypto from 'node:crypto';
-import { verifyRequest } from '@fedify/fedify/sig';
+import { verifyRequestDetailed } from '@fedify/fedify/sig';
 import { assertPublicUrl, safeFetch, readCapped } from './safefetch.mjs';
 
 // An SSRF-safe JSON-LD document loader for Fedify's key fetch. The keyId in a
@@ -40,33 +40,48 @@ export function makeSafeLoader({ getActors = null, fetchImpl = fetch } = {}) {
 // has one natively; an agent-side endpoint builds one from its req). Returns a
 // normalized result both the gateway and the drain understand — never throws
 // on a bad signature, because "unverified" is a routine outcome, not an error.
+//
+// Three outcomes, kept apart because the door acts on them differently. Only a
+// signature we could CHECK and found wrong is a forgery. A key we could not
+// fetch proves nothing: a sender in secure mode — Threads, Mastodon with
+// AUTHORIZED_FETCH — answers this keyless loader 404 or 401, so its deliveries
+// have to degrade to unverified rather than be read as forged.
 export async function verifyHttpSignature(request, { documentLoader, keyCache, timeWindow } = {}) {
   const hadSig = request.headers.get('signature') != null;
-  let key = null;
+  let result = null;
   try {
-    key = await verifyRequest(request, {
+    result = await verifyRequestDetailed(request, {
       documentLoader,
       ...(keyCache ? { keyCache } : {}),
       timeWindow: timeWindow ?? { hours: 1 },
     });
   } catch {
-    key = null;   // a loader that refused (SSRF, 401 from a secure-mode pod) → unverified
+    result = null;   // the library itself failed — no more informative than a bad signature
   }
-  if (key) {
+  if (result?.verified) {
+    const key = result.key;
     return {
       verified: true, method: 'draft-cavage',
       keyId: key.id?.href ?? null, actor: key.ownerId?.href ?? null, reason: null,
       checks: { signature: true, digest: true, dateSkew: true, keyFetched: true },
     };
   }
+  const kind = result?.reason?.type;
+  if (!hadSig || kind === 'noSignature') {
+    return {
+      verified: false, method: 'none', keyId: null, actor: null,
+      reason: 'no-signature', checks: { signature: false },
+    };
+  }
+  if (kind === 'keyFetchError') {
+    return {
+      verified: false, method: 'draft-cavage', keyId: null, actor: null,
+      reason: 'key-unfetchable', checks: { signature: false, keyFetched: false },
+    };
+  }
   return {
-    verified: false, method: hadSig ? 'draft-cavage' : 'none',
-    keyId: null, actor: null,
-    // The distinction the receipt needs: a forgery (present but invalid) is
-    // dropped at the edge; an absent or unfetchable-key signature degrades to
-    // buffered-unverified, exactly as an install with no gateway behaves.
-    reason: hadSig ? 'bad-signature-or-key-unfetchable' : 'no-signature',
-    checks: { signature: false },
+    verified: false, method: 'draft-cavage', keyId: null, actor: null,
+    reason: 'bad-signature', checks: { signature: false },
   };
 }
 

package/lib/intake.mjs

@@ -113,7 +113,19 @@ function pollOf(note) {
     })),
   };
 }
-export const isContentType = (t) => CONTENT_TYPES.has(t);
+// AS2 lets `type` be one string or a list, and implementations use both —
+// `["Person","Service"]` is an ordinary actor. Read either form.
+const typesOf = (t) => (Array.isArray(t) ? t : [t]).filter(x => typeof x === 'string');
+export const isContentType = (t) => typesOf(t).some(x => CONTENT_TYPES.has(x));
+const isActorType = (t) => typesOf(t).some(x => ACTOR_TYPES.has(x));
+
+// What we will carry to our followers on someone else's behalf (§7.1.2): the
+// activities a conversation is made of, and nothing else. A type this file
+// does not handle falls out of handle() with no rejection, and "no rejection"
+// is what qualifies an activity for forwarding — so without this gate a
+// stranger could have anything at all, of a type nothing here reads,
+// re-delivered to every follower over our signature.
+const FORWARDABLE = new Set(['Create', 'Update', 'Delete', 'Like', 'Announce', 'Undo']);
 const ACCEPT_AP = 'application/activity+json, application/ld+json; profile="https://www.w3.org/ns/activitystreams"';
 
 export function sameOrigin(a, b) {
@@ -741,7 +753,7 @@ export class Intake {
     // Same origin rather than exact equality: signedFetch follows redirects
     // without reporting where it landed, so a server that redirects its own
     // canonical actor URL would otherwise stop being cached at all.
-    if (ACTOR_TYPES.has(doc?.type) && doc.id && sameOrigin(doc.id, url)) {
+    if (isActorType(doc?.type) && doc.id && sameOrigin(doc.id, url)) {
       this.store.cacheActor(doc.id, doc);
     }
     return doc;
@@ -1123,6 +1135,7 @@ export class Intake {
   // never forwarded.
   async _maybeForward(activity) {
     if (!activity || typeof activity !== 'object') return;
+    if (!FORWARDABLE.has(activity.type)) return;              // see FORWARDABLE
     try {
       const audience = []
         .concat(activity.to || [], activity.cc || [], activity.audience || [])
@@ -1380,9 +1393,9 @@ export class Intake {
     const note = await this.fetchAP(objectId);
     if (!note) return `object fetch failed (${objectId})`;
     if (note.id !== objectId || !isContentType(note.type)) return `object not verifiable content (${objectId}, ${note.type})`;
-    const { attachmentsOf, sanitizeHtml } = await import('./wire.mjs');
+    const { attachmentsOf, titledContent } = await import('./wire.mjs');
     const attachments = attachmentsOf(note);
-    const content = sanitizeHtml(note.content);   // hostile markup never reaches pod or client
+    const content = titledContent(note);          // hostile markup never reaches pod or client
     // The delivering actor was checked on arrival; the author is only known once
     // the note is dereferenced. authorOf refuses an author the note's own origin
     // does not vouch for — see its comment; this is where a forged attribution
@@ -1594,8 +1607,8 @@ export class Intake {
     const note = await this.fetchAP(objectId);
     if (!note) throw new Error(`cannot refetch ${objectId} — will retry`);
     if (note.id !== objectId || !isContentType(note.type)) return `object not verifiable content (${objectId}, ${note.type})`;
-    const { attachmentsOf, sanitizeHtml } = await import('./wire.mjs');
-    const content = sanitizeHtml(note.content);
+    const { attachmentsOf, titledContent } = await import('./wire.mjs');
+    const content = titledContent(note);
     const attachments = attachmentsOf(note);
     const freshPoll = pollOf(note);
     const freshEmojis = emojisOf(note);

package/lib/keys.mjs

@@ -1,7 +1,7 @@
 // keys.mjs — actor signing keys. RSA (Mastodon's draft-cavage HTTP Signatures
-// require RSA-SHA256) + Ed25519 (stored for future FEP-8b32 use, not yet in
-// the actor doc). PEM at rest (0600), CryptoKey in memory for Fedify's
-// signRequest.
+// require RSA-SHA256) signs deliveries; Ed25519 signs the FEP-8b32 proof that
+// travels with an activity. PEM at rest (0600), CryptoKey in memory for
+// Fedify's signRequest and for the proof.
 //
 // The key lives on THIS MACHINE by default (AP_HOME/keys.json): the pod host
 // then never holds it. `setup --keys pod` puts it in pod state instead,
@@ -112,9 +112,23 @@ export async function resolveKeys(store, { localDir = null, rotate = false, acto
     log(rotate ? 'minted a REPLACEMENT signing key — republish the profile' : 'minted a signing key');
   }
 
+  // A record written before proofs existed has no Ed25519 half. Minting one is
+  // safe in a way minting an RSA key is not: nothing has ever published or
+  // cached it, so no remote signature is invalidated.
+  if (!rec.ed25519) {
+    rec = { ...rec, ed25519: generate().ed25519 };
+    if (localDir) writeLocal(localDir, rec); else store.write('keys.json', rec);
+    log('minted the Ed25519 half of the signing key');
+  }
+
   const der = crypto.createPrivateKey(rec.rsa.privatePem).export({ type: 'pkcs8', format: 'der' });
   const rsaPrivate = await crypto.subtle.importKey('pkcs8', der, RSA_ALG, true, ['sign']);
-  return { rsaPrivate, rsaPublicPem: rec.rsa.publicPem };
+  const { edPrivateKey, multibaseEd25519 } = await import('./proof.mjs');
+  return {
+    rsaPrivate, rsaPublicPem: rec.rsa.publicPem,
+    edPrivate: await edPrivateKey(rec.ed25519.privatePem),
+    edPublicMultibase: multibaseEd25519(rec.ed25519.publicPem),
+  };
 }
 
 // Move a local key into pod state — the arrangement that lets several

package/lib/mastoapi.mjs

@@ -12,7 +12,7 @@
 
 import crypto from 'node:crypto';
 import * as social from './social.mjs';
-import { sanitizeHtml } from './wire.mjs';
+import { sanitizeHtml, followsNeedApproval } from './wire.mjs';
 import { authorOf } from './intake.mjs';
 import { profileUrl, postUrl } from './bskyfeed.mjs';
 import { Push } from './webpush.mjs';
@@ -222,7 +222,7 @@ export class MastoApi {
       // people — so read it from config, or the editor opens empty and saving
       // wipes what was there.
       display_name: (self ? this.store.getConfig()?.name : cached.name) || cached.name || user,
-      locked: self ? !!this.store.getConfig()?.approveJoins : false,
+      locked: self ? followsNeedApproval(this.store.getConfig() || {}) : false,
       // Read from config for self, like the fields above it: our own actor is
       // not in the actor cache — the cache is for other people — so a group
       // asking about itself would be told it was a person.

package/lib/proof.mjs

@@ -0,0 +1,79 @@
+// proof.mjs — FEP-8b32 object integrity proofs (Data Integrity, eddsa-jcs-2022).
+//
+// An HTTP signature covers one delivery and says nothing about who wrote what
+// was inside it. A proof travels with the activity, so a server that receives
+// one of ours second-hand — carried by a group, or forwarded by a follower's
+// server — can tell it is ours without asking us.
+//
+// The RSA `#main-key` and its HTTP signatures are untouched; this is a second
+// key alongside, which is what the Data Integrity suites require.
+
+import crypto from 'node:crypto';
+import serialize from 'json-canon';
+
+// multicodec: an Ed25519 public key is its 32 raw bytes behind 0xed 0x01.
+const ED25519_PREFIX = Buffer.from([0xed, 0x01]);
+const B58 = '123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz';
+
+export function base58btc(bytes) {
+  const b = Buffer.from(bytes);
+  let n = 0n;
+  for (const byte of b) n = (n << 8n) + BigInt(byte);
+  let out = '';
+  while (n > 0n) { out = B58[Number(n % 58n)] + out; n /= 58n; }
+  for (const byte of b) { if (byte !== 0) break; out = B58[0] + out; }
+  return out;
+}
+
+/** The `publicKeyMultibase` form of an Ed25519 public key in PEM. */
+export function multibaseEd25519(publicPem) {
+  const raw = Buffer.from(crypto.createPublicKey(publicPem).export({ format: 'jwk' }).x, 'base64url');
+  return 'z' + base58btc(Buffer.concat([ED25519_PREFIX, raw]));
+}
+
+/** The signing key, as WebCrypto wants it. */
+export function edPrivateKey(privatePem) {
+  const jwk = crypto.createPrivateKey(privatePem).export({ format: 'jwk' });
+  return crypto.subtle.importKey('jwk', { ...jwk, key_ops: ['sign'] }, { name: 'Ed25519' }, true, ['sign']);
+}
+
+const sha256 = (s) => crypto.createHash('sha256').update(s).digest();
+
+// The proof's own terms have to be declared in the document that carries it,
+// or a receiver that processes JSON-LD expands the proof away before it ever
+// looks at it. Declared BEFORE signing, because the proof covers the document
+// exactly as sent, `@context` included.
+export const DI_CTX = 'https://w3id.org/security/data-integrity/v1';
+
+function withProofContext(doc) {
+  const ctx = doc['@context'];
+  const list = Array.isArray(ctx) ? ctx : ctx ? [ctx] : [];
+  if (list.includes(DI_CTX)) return doc;
+  return { ...doc, '@context': [...list, DI_CTX] };
+}
+
+/**
+ * Return the activity with a `proof` attached. The proof covers the activity
+ * exactly as it goes on the wire, minus the proof itself — so it must be the
+ * last thing added, and nothing may edit the activity afterwards.
+ *
+ * Whole seconds on `created`: a verifier re-serializes the timestamp it was
+ * given, and a fractional one has more than one spelling.
+ */
+export async function attachProof(activity, { privateKey, verificationMethod, created = new Date() } = {}) {
+  if (!privateKey || !verificationMethod || !activity || typeof activity !== 'object') return activity;
+  const { proof: _existing, ...bare } = activity;
+  const doc = withProofContext(bare);
+  const config = {
+    '@context': doc['@context'],
+    type: 'DataIntegrityProof',
+    cryptosuite: 'eddsa-jcs-2022',
+    verificationMethod,
+    proofPurpose: 'assertionMethod',
+    created: new Date(created).toISOString().replace(/\.\d+Z$/, 'Z'),
+  };
+  const digest = Buffer.concat([sha256(serialize(config)), sha256(serialize(doc))]);
+  const sig = await crypto.subtle.sign('Ed25519', privateKey, digest);
+  const { '@context': _ctx, ...emitted } = config;
+  return { ...doc, proof: { ...emitted, proofValue: 'z' + base58btc(Buffer.from(sig)) } };
+}

package/lib/publisher.mjs

@@ -22,7 +22,7 @@ const AGENT_VERSION = JSON.parse(fs.readFileSync(
   path.join(path.dirname(fileURLToPath(import.meta.url)), '../package.json'), 'utf8')).version;
 
 export class Publisher {
-  constructor({ config, remote, local, store, deliverer, publicKeyPem, log = console.log,
+  constructor({ config, remote, local, store, deliverer, publicKeyPem, assertionKey = null, log = console.log,
     probeFetch = null, resolveMention = null, privateOnPod = true,
   }) {
     this.config = config;
@@ -31,6 +31,7 @@ export class Publisher {
     this.store = store;
     this.deliverer = deliverer;
     this.publicKeyPem = publicKeyPem;
+    this.assertionKey = assertionKey;      // Ed25519 public half, multibase; null = no proofs
     // A fronted identity (config.gateway.frontActor) advertises its ids on a
     // shared domain; the map tells RemotePod where each writes on the pod.
     const publicBase = config.gateway?.frontActor
@@ -76,7 +77,8 @@ export class Publisher {
     const actorDoc = wire.actorDoc({
       urls, handle: this.config.handle, name: this.config.name, publicKeyPem: this.publicKeyPem,
       movedTo: this.config.movedTo || null, kind: this.config.kind,
-      approveJoins: !!this.config.approveJoins,
+      approveJoins: wire.followsNeedApproval(this.config),
+      assertionKey: this.assertionKey,
       summary: this.config.summary || null, icon: this.config.icon || null,
       image: this.config.image || null, fields: this.config.fields || [],
       webId: this.remote.webId || null,
@@ -350,7 +352,8 @@ export class Publisher {
     await this.remote.putJson(urls.actor, wire.actorDoc({
       urls, handle: this.config.handle, name: this.config.name,
       publicKeyPem: this.publicKeyPem, movedTo: target, kind: this.config.kind,
-      approveJoins: !!this.config.approveJoins,
+      approveJoins: wire.followsNeedApproval(this.config),
+      assertionKey: this.assertionKey,
       summary: this.config.summary || null, icon: this.config.icon || null,
       image: this.config.image || null, fields: this.config.fields || [],
       webId: this.remote.webId || null,

package/lib/tagfeed.mjs

@@ -135,10 +135,10 @@ export class TagFeed {
         if (!this.store.getActors()[author]) {
           await this.intake.fetchAP(author).catch(() => {});   // warm name+avatar
         }
-        const { attachmentsOf, sanitizeHtml } = await import('./wire.mjs');
+        const { attachmentsOf, titledContent } = await import('./wire.mjs');
         const attachments = attachmentsOf(note);
         this.store.addStatus({
-          noteId, actor: author, content: sanitizeHtml(note.content),
+          noteId, actor: author, content: titledContent(note),
           published: note.published, inReplyTo: note.inReplyTo, kind: 'tag', tag,
           ...(attachments.length ? { attachments } : {}),
         });

package/lib/update.mjs

@@ -42,16 +42,21 @@ export async function checkLatest({ current = localVersion(), fetchImpl = fetch
   } catch { return null; }
 }
 
+// The npm half, injectable — a test asking what runUpdate DOES must never be
+// able to install software on the machine running it.
+const npmInstallLatest = () =>
+  execFileSync('npm', ['install', '-g', 'fedipod@latest'], { stdio: 'pipe' });
+
 // Fast-forward only: a checkout with local changes is somebody's work, and an
 // update must refuse rather than eat it.
-export function runUpdate({ root = repoRoot(), log = () => {} } = {}) {
+export function runUpdate({ root = repoRoot(), log = () => {}, install = npmInstallLatest } = {}) {
   // The ordinary install comes from npm, where updating is npm's job and the
   // files under us are not ours to move. A checkout is somebody working on it,
   // and gets the fast-forward below.
   if (!fs.existsSync(path.join(root, '.git'))) {
     try {
       log('updating from npm…');
-      execFileSync('npm', ['install', '-g', 'fedipod@latest'], { stdio: 'pipe' });
+      install();
       return { ok: true, note: 'updated from npm — restart the agent to serve it' };
     } catch (e) {
       return { ok: false,

package/lib/wire.mjs

@@ -87,7 +87,19 @@ export function jrd({ handle, host, actor }) {
 
 // `kind: 'group'` publishes a Group rather than a Person, which is what makes
 // Mastodon and Lemmy treat the actor as a community you join.
-export function actorDoc({ urls, handle, name, publicKeyPem, movedTo = null, kind = 'person',
+// Whether a follow will be held for the operator instead of accepted on
+// arrival. A person's follows wait unless `autoAcceptFollows` says otherwise,
+// because a delivery on its own proves nothing about who sent it; a group is
+// open unless its operator asked to see joins. The actor document has to say
+// the same thing, or a remote server shows "Following" for a follow that is
+// in fact still waiting, and nothing ever tells it otherwise.
+export function followsNeedApproval(config = {}) {
+  return !!config.approveJoins || (config.kind !== 'group' && !config.autoAcceptFollows);
+}
+
+export const assertionKeyId = (urls) => urls.actor + '#ed25519-key';
+
+export function actorDoc({ urls, handle, name, publicKeyPem, assertionKey = null, movedTo = null, kind = 'person',
   approveJoins = false, summary = null, icon = null, image = null, fields = [],
   webId = null, aliases = [], moderators = null, pendingFollowers = null, pendingFollowing = null,
   blocked = null, inbox = null }) {
@@ -103,6 +115,12 @@ export function actorDoc({ urls, handle, name, publicKeyPem, movedTo = null, kin
   // inline exactly as Mastodon declares it.
   context.push({ toot: 'http://joinmastodon.org/ns#', featured: { '@id': 'toot:featured', '@type': '@id' } });
   if (approveJoins) context.push({ manuallyApprovesFollowers: 'as:manuallyApprovesFollowers' });
+  // FEP-8b32. The Multikey is a SECOND key beside publicKey/#main-key, not a
+  // replacement: HTTP signatures stay RSA, and only the proof is Ed25519.
+  // `assertionMethod` comes from the DID context and the key's own terms from
+  // the Multikey one; the proof's terms travel with the proof, not here.
+  if (assertionKey) context.push('https://www.w3.org/ns/did/v1',
+    'https://w3id.org/security/multikey/v1');
   // FEP-4ccd and FEP-c648 terms, declared exactly as those FEPs declare them,
   // and only when the collections are actually published.
   if (pendingFollowers || pendingFollowing) {
@@ -130,6 +148,10 @@ export function actorDoc({ urls, handle, name, publicKeyPem, movedTo = null, kin
     id: urls.actor,
     type: kind === 'group' ? 'Group' : 'Person',
     ...(approveJoins ? { manuallyApprovesFollowers: true } : {}),
+    ...(assertionKey ? { assertionMethod: [{
+      id: assertionKeyId(urls), type: 'Multikey', controller: urls.actor,
+      publicKeyMultibase: assertionKey,
+    }] } : {}),
     ...(movedTo ? { movedTo } : {}),
     ...(webId || aliases.length ? { alsoKnownAs: [...(webId ? [webId] : []), ...aliases] } : {}),
     preferredUsername: handle,
@@ -526,11 +548,28 @@ export function sanitizeHtml(html) {
   });
 }
 
+// A Lemmy post, a blog article, a PeerTube video and a Bookwyrm review each
+// carry their headline in `name` and their body in `content`. Reading content
+// alone loses the headline, and a link post is often nothing else — so keep it
+// as the first line, unless the body already opens with it.
+export function titledContent(note) {
+  const html = sanitizeHtml(note?.content);
+  const types = Array.isArray(note?.type) ? note.type : [note?.type];
+  const title = typeof note?.name === 'string' ? note.name.trim() : '';
+  if (!title || types.includes('Note')) return html;
+  const opening = html.replace(/<[^>]*>/g, ' ').replace(/\s+/g, ' ').trim().toLowerCase();
+  if (opening.startsWith(title.toLowerCase())) return html;
+  const esc = String(title).replace(/[&<>]/g, c => HTML_ESCAPES[c]);
+  return `<p><strong>${esc}</strong></p>${html}`;
+}
+
 // Normalize a wire Note's attachment list to { url, mediaType, description }.
 export function attachmentsOf(note) {
   const list = Array.isArray(note?.attachment) ? note.attachment : note?.attachment ? [note.attachment] : [];
+  // A bare Link carries `href` and no `url` — Lemmy's link posts arrive that
+  // way, and reading only `url` dropped the link the post was about.
   return list.map(a => ({
-    url: typeof a?.url === 'string' ? a.url : a?.url?.href,
+    url: typeof a?.url === 'string' ? a.url : a?.url?.href || (typeof a?.href === 'string' ? a.href : undefined),
     mediaType: a?.mediaType || '',
     ...(a?.name ? { description: a.name } : {}),
   })).filter(a => a.url);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fedipod",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "description": "Standalone single-actor ActivityPub agent whose wire face, RDF truth and state all live on a Solid pod (CSS). Bundles a Phanpy UI and a Mastodon client-API facade.",
   "type": "module",
   "license": "MIT",
@@ -43,6 +43,7 @@
     "@netlify/blobs": "^10.7.13",
     "@solid/access-token-verifier": "^2.1.1",
     "jose": "^6.2.8",
+    "json-canon": "^1.0.1",
     "node-forge": "^1.4.0",
     "rdflib": "^2.4.0",
     "sanitize-html": "^2.17.6",

package/run-agent.mjs

@@ -47,7 +47,7 @@ import { Lease } from './lib/lease.mjs';
 import { startAdmin } from './lib/admin.mjs';
 import { exposureProblem, hostLabel } from './lib/guard.mjs';
 import { pendingSteps } from './lib/migrate.mjs';
-import { apUrls } from './lib/wire.mjs';
+import { apUrls, assertionKeyId } from './lib/wire.mjs';
 import { followActor, unfollowActor, resolveHandle } from './lib/social.mjs';
 
 export class Agent {
@@ -324,11 +324,14 @@ export class Agent {
     clearInterval(this.schedTimer);
     this.deliverer = new Deliverer({
       store: this.store, rsaPrivate: keys.rsaPrivate, keyId: this.urls.actor + '#main-key',
+      actorId: this.urls.actor, edPrivate: keys.edPrivate,
+      proofKeyId: assertionKeyId(this.urls),
       log: this.log, passive: this.viewer,
     });
     this.publisher = new Publisher({
       config, remote: this.remote, local: this.local, store: this.store,
-      deliverer: this.deliverer, publicKeyPem: keys.rsaPublicPem, log: this.log,
+      deliverer: this.deliverer, publicKeyPem: keys.rsaPublicPem,
+      assertionKey: keys.edPublicMultibase, log: this.log,
       resolveMention: (h) => resolveHandle(this, h),
       // Whether the fediverse tree is on the pod at all, so the ACL check does
       // not probe for something the default layout keeps on local disk.
@@ -389,7 +392,9 @@ export class Agent {
       log: this.log,
     });
     this.publisher.publicKeyPem = keys.rsaPublicPem;
+    this.publisher.assertionKey = keys.edPublicMultibase;
     this.deliverer.rsaPrivate = keys.rsaPrivate;
+    this.deliverer.edPrivate = keys.edPrivate;
     await this.publisher.publishProfile();
     return { changed: before !== keys.rsaPublicPem, publicKeyPem: keys.rsaPublicPem };
   }