fedipod 1.10.0 → 1.26.1

package/web/app/site/boot.js

@@ -33000,7 +33000,7 @@ var PodTransport = class {
   // leaves the private trees world-readable. $rdf.sym() also throws on an
   // illegal IRI, so a pod URL with something odd in it fails here rather than
   // silently producing a document that means something else.
-  aclDoc(targetUrl, publicModes, { appendAgents = [], aclUrl = null } = {}) {
+  aclDoc(targetUrl, publicModes, { appendAgents = [], readAgents = [], aclUrl = null } = {}) {
     const url = aclUrl || targetUrl + ".acl";
     const doc = namedNode2(url);
     const target = namedNode2(targetUrl);
@@ -33016,6 +33016,7 @@ var PodTransport = class {
       authorize(namedNode2(url + "#public"), ACL("agentClass"), FOAF("Agent"), publicModes);
     }
     appendAgents.forEach((webId, i) => authorize(namedNode2(url + `#gw${i}`), ACL("agent"), namedNode2(webId), ["Append"]));
+    readAgents.forEach((webId, i) => authorize(namedNode2(url + `#r${i}`), ACL("agent"), namedNode2(webId), ["Read"]));
     authorize(
       namedNode2(url + "#owner"),
       ACL("agent"),
@@ -33444,6 +33445,7 @@ async function signUp(answers, { onStep = () => {
     handle,
     name: handle,
     issuer: credential.issuerOrigin,
+    createdAt: (/* @__PURE__ */ new Date()).toISOString(),
     ...gateway ? { gateway } : {}
   };
   const cfgRemote = new BrowserRemotePod(session, { webId: credential.webId, role: "signup", log: () => {
@@ -33499,45 +33501,12 @@ function podBaseOfWebId(webId) {
   return `${u.origin}${dir.endsWith("/") ? dir : dir + "/"}`;
 }
 
-// web/app/oidc-session.mjs
-var DB2 = "fedipod-oidc";
+// lib/session/oidc-session.mjs
 var STORE = "session";
 var b64u2 = (buf) => btoa(String.fromCharCode(...new Uint8Array(buf))).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 var enc2 = (o) => b64u2(new TextEncoder().encode(JSON.stringify(o)));
 var sha2562 = (s) => crypto.subtle.digest("SHA-256", new TextEncoder().encode(s));
 var rand = (n = 32) => b64u2(crypto.getRandomValues(new Uint8Array(n)));
-function idb() {
-  return new Promise((res, rej) => {
-    const r = indexedDB.open(DB2, 1);
-    r.onupgradeneeded = () => r.result.createObjectStore(STORE);
-    r.onsuccess = () => res(r.result);
-    r.onerror = () => rej(r.error);
-  });
-}
-async function idbGet(key) {
-  const db = await idb();
-  return new Promise((res, rej) => {
-    const t = db.transaction(STORE).objectStore(STORE).get(key);
-    t.onsuccess = () => res(t.result);
-    t.onerror = () => rej(t.error);
-  });
-}
-async function idbPut(key, val) {
-  const db = await idb();
-  return new Promise((res, rej) => {
-    const t = db.transaction(STORE, "readwrite").objectStore(STORE).put(val, key);
-    t.onsuccess = () => res();
-    t.onerror = () => rej(t.error);
-  });
-}
-async function idbDel(key) {
-  const db = await idb();
-  return new Promise((res, rej) => {
-    const t = db.transaction(STORE, "readwrite").objectStore(STORE).delete(key);
-    t.onsuccess = () => res();
-    t.onerror = () => rej(t.error);
-  });
-}
 async function dpopKey() {
   return crypto.subtle.generateKey({ name: "ECDSA", namedCurve: "P-256" }, false, ["sign"]);
 }
@@ -33581,129 +33550,188 @@ async function registerClient(cfg, redirectUri, clientName) {
   if (!res.ok) throw new Error(`client registration failed (HTTP ${res.status})`);
   return (await res.json()).client_id;
 }
-async function beginLogin({ issuer, redirectUri, clientName = "FediPod" }) {
-  const cfg = await discover(issuer);
-  const client_id = await registerClient(cfg, redirectUri, clientName);
-  const pair = await dpopKey();
-  const verifier = rand(48);
-  const challenge = b64u2(await sha2562(verifier));
-  const state = rand(16);
-  await idbPut("pending", {
-    issuer,
-    client_id,
-    redirectUri,
-    verifier,
-    state,
-    pair,
-    tokenEndpoint: cfg.token_endpoint,
-    authorizationEndpoint: cfg.authorization_endpoint,
-    revocationEndpoint: cfg.revocation_endpoint || null
-  });
-  const url = new URL(cfg.authorization_endpoint);
-  for (const [k, v] of Object.entries({
-    client_id,
-    redirect_uri: redirectUri,
-    response_type: "code",
-    scope: "openid webid offline_access",
-    code_challenge: challenge,
-    code_challenge_method: "S256",
-    state,
-    prompt: "consent"
-  })) url.searchParams.set(k, v);
-  return { authorizationUrl: url.href };
-}
-async function completeLogin({ currentUrl }) {
-  const u = new URL(currentUrl);
-  const code = u.searchParams.get("code");
-  const state = u.searchParams.get("state");
-  if (!code) return null;
-  const p = await idbGet("pending");
-  if (!p || p.state !== state) throw new Error("login state mismatch");
-  const jwk = await publicJwk(p.pair);
-  const res = await fetch(p.tokenEndpoint, {
-    method: "POST",
-    headers: { "content-type": "application/x-www-form-urlencoded", dpop: await dpopProof(p.pair, jwk, "POST", p.tokenEndpoint) },
-    body: new URLSearchParams({ grant_type: "authorization_code", code, redirect_uri: p.redirectUri, client_id: p.client_id, code_verifier: p.verifier })
-  });
-  const tok = await res.json().catch(() => ({}));
-  if (!res.ok || !tok.access_token) throw new Error(`token exchange failed (HTTP ${res.status}): ${tok.error || ""}`);
-  const webId = jwtPayload(tok.access_token).webid || jwtPayload(tok.id_token || "").webid || null;
-  const session = {
-    issuer: p.issuer,
-    client_id: p.client_id,
-    tokenEndpoint: p.tokenEndpoint,
-    pair: p.pair,
-    // Where to hand the refresh token back at sign-out. Kept on the session
-    // because discovery is a network round trip and sign-out should not need
-    // one — see signOut().
-    revocationEndpoint: p.revocationEndpoint || null,
-    refreshToken: tok.refresh_token || null,
-    accessToken: tok.access_token,
-    expiresAt: Date.now() + Math.max(30, tok.expires_in || 300) * 1e3,
-    webId
-  };
-  await idbPut("session", session);
-  await idbDel("pending");
-  return sessionHandle(session);
-}
-async function getSession() {
-  const s = await idbGet("session");
-  return s ? sessionHandle(s) : null;
-}
-async function signOut() {
-  const s = await idbGet("session").catch(() => null);
-  if (s?.revocationEndpoint && s.refreshToken) {
-    try {
-      await fetch(s.revocationEndpoint, {
-        method: "POST",
-        headers: { "content-type": "application/x-www-form-urlencoded" },
-        body: new URLSearchParams({
-          token: s.refreshToken,
-          token_type_hint: "refresh_token",
-          client_id: s.client_id
-        })
-      });
-    } catch {
-    }
+function solidOidcSession({ dbName = "solid-oidc-session", clientName = "Solid app" } = {}) {
+  function idb() {
+    return new Promise((res, rej) => {
+      const r = indexedDB.open(dbName, 1);
+      r.onupgradeneeded = () => r.result.createObjectStore(STORE);
+      r.onsuccess = () => res(r.result);
+      r.onerror = () => rej(r.error);
+    });
   }
-  await idbDel("session");
-  await idbDel("pending");
-}
-function sessionHandle(s) {
-  let { accessToken, expiresAt, refreshToken } = s;
-  const jwkP = publicJwk(s.pair);
-  const refresh = async () => {
-    if (!refreshToken) throw new Error("session expired and there is no refresh token \u2014 sign in again");
-    const jwk = await jwkP;
-    const res = await fetch(s.tokenEndpoint, {
+  async function idbGet(key) {
+    const db = await idb();
+    return new Promise((res, rej) => {
+      const t = db.transaction(STORE).objectStore(STORE).get(key);
+      t.onsuccess = () => res(t.result);
+      t.onerror = () => rej(t.error);
+    });
+  }
+  async function idbPut(key, val) {
+    const db = await idb();
+    return new Promise((res, rej) => {
+      const t = db.transaction(STORE, "readwrite").objectStore(STORE).put(val, key);
+      t.onsuccess = () => res();
+      t.onerror = () => rej(t.error);
+    });
+  }
+  async function idbDel(key) {
+    const db = await idb();
+    return new Promise((res, rej) => {
+      const t = db.transaction(STORE, "readwrite").objectStore(STORE).delete(key);
+      t.onsuccess = () => res();
+      t.onerror = () => rej(t.error);
+    });
+  }
+  async function beginLogin2({ issuer, redirectUri, clientName: name = clientName, returnTo = null }) {
+    const cfg = await discover(issuer);
+    const client_id = await registerClient(cfg, redirectUri, name);
+    const pair = await dpopKey();
+    const verifier = rand(48);
+    const challenge = b64u2(await sha2562(verifier));
+    const state = rand(16);
+    await idbPut("pending", {
+      issuer,
+      client_id,
+      redirectUri,
+      verifier,
+      state,
+      pair,
+      returnTo,
+      tokenEndpoint: cfg.token_endpoint,
+      authorizationEndpoint: cfg.authorization_endpoint,
+      revocationEndpoint: cfg.revocation_endpoint || null
+    });
+    const url = new URL(cfg.authorization_endpoint);
+    for (const [k, v] of Object.entries({
+      client_id,
+      redirect_uri: redirectUri,
+      response_type: "code",
+      scope: "openid webid offline_access",
+      code_challenge: challenge,
+      code_challenge_method: "S256",
+      state,
+      prompt: "consent"
+    })) url.searchParams.set(k, v);
+    return { authorizationUrl: url.href };
+  }
+  async function completeLogin2({ currentUrl }) {
+    const u = new URL(currentUrl);
+    const code = u.searchParams.get("code");
+    const state = u.searchParams.get("state");
+    if (!code) return null;
+    const p = await idbGet("pending");
+    if (!p || p.state !== state) throw new Error("login state mismatch");
+    const jwk = await publicJwk(p.pair);
+    const res = await fetch(p.tokenEndpoint, {
       method: "POST",
-      headers: { "content-type": "application/x-www-form-urlencoded", dpop: await dpopProof(s.pair, jwk, "POST", s.tokenEndpoint) },
-      body: new URLSearchParams({ grant_type: "refresh_token", refresh_token: refreshToken, client_id: s.client_id, scope: "openid webid offline_access" })
+      headers: { "content-type": "application/x-www-form-urlencoded", dpop: await dpopProof(p.pair, jwk, "POST", p.tokenEndpoint) },
+      body: new URLSearchParams({ grant_type: "authorization_code", code, redirect_uri: p.redirectUri, client_id: p.client_id, code_verifier: p.verifier })
     });
     const tok = await res.json().catch(() => ({}));
-    if (!res.ok || !tok.access_token) {
-      await idbDel("session");
-      throw new Error("refresh failed \u2014 sign in again");
-    }
-    accessToken = tok.access_token;
-    expiresAt = Date.now() + Math.max(30, tok.expires_in || 300) * 1e3;
-    if (tok.refresh_token) refreshToken = tok.refresh_token;
-    const now = await idbGet("session");
-    if (now && now.webId !== s.webId) {
-      throw new Error("signed in as somebody else while this session was refreshing");
-    }
-    await idbPut("session", { ...s, accessToken, expiresAt, refreshToken });
-  };
-  const authFetch = async (url, init = {}) => {
-    if (Date.now() > expiresAt - 3e4) await refresh();
-    const jwk = await jwkP;
-    const ath = b64u2(await sha2562(accessToken));
-    const headers = { ...init.headers || {}, authorization: `DPoP ${accessToken}`, dpop: await dpopProof(s.pair, jwk, init.method || "GET", url, ath) };
-    return fetch(url, { ...init, headers });
-  };
-  return { webId: s.webId, fetch: authFetch, refresh, signOut };
+    if (!res.ok || !tok.access_token) throw new Error(`token exchange failed (HTTP ${res.status}): ${tok.error || ""}`);
+    const webId = jwtPayload(tok.access_token).webid || jwtPayload(tok.id_token || "").webid || null;
+    const session = {
+      issuer: p.issuer,
+      client_id: p.client_id,
+      tokenEndpoint: p.tokenEndpoint,
+      pair: p.pair,
+      // Where to hand the refresh token back at sign-out. Kept on the session
+      // because discovery is a network round trip and sign-out should not need
+      // one — see signOut().
+      revocationEndpoint: p.revocationEndpoint || null,
+      refreshToken: tok.refresh_token || null,
+      accessToken: tok.access_token,
+      expiresAt: Date.now() + Math.max(30, tok.expires_in || 300) * 1e3,
+      webId
+    };
+    await idbPut("session", session);
+    await idbDel("pending");
+    return Object.assign(sessionHandle(session), p.returnTo ? { returnTo: p.returnTo } : {});
+  }
+  async function getSession2() {
+    const s = await idbGet("session");
+    return s ? sessionHandle(s) : null;
+  }
+  async function signOut2() {
+    const s = await idbGet("session").catch(() => null);
+    if (s?.revocationEndpoint && s.refreshToken) {
+      try {
+        await fetch(s.revocationEndpoint, {
+          method: "POST",
+          headers: { "content-type": "application/x-www-form-urlencoded" },
+          body: new URLSearchParams({
+            token: s.refreshToken,
+            token_type_hint: "refresh_token",
+            client_id: s.client_id
+          })
+        });
+      } catch {
+      }
+    }
+    await idbDel("session");
+    await idbDel("pending");
+  }
+  function sessionHandle(s) {
+    let { accessToken, expiresAt, refreshToken } = s;
+    const jwkP = publicJwk(s.pair);
+    const refresh = async () => {
+      if (!refreshToken) throw new Error("session expired and there is no refresh token \u2014 sign in again");
+      const jwk = await jwkP;
+      let res;
+      try {
+        res = await fetch(s.tokenEndpoint, {
+          method: "POST",
+          headers: { "content-type": "application/x-www-form-urlencoded", dpop: await dpopProof(s.pair, jwk, "POST", s.tokenEndpoint) },
+          body: new URLSearchParams({ grant_type: "refresh_token", refresh_token: refreshToken, client_id: s.client_id, scope: "openid webid offline_access" })
+        });
+      } catch (e) {
+        throw new Error(`${e.message} \u2014 renewing your sign-in at ${new URL(s.tokenEndpoint).host}`);
+      }
+      const tok = await res.json().catch(() => ({}));
+      if (res.status === 429) {
+        throw new Error(`${new URL(s.tokenEndpoint).host} is asking us to slow down \u2014 your sign-in could not be renewed just now`);
+      }
+      if (!res.ok || !tok.access_token) {
+        await idbDel("session");
+        throw new Error("refresh failed \u2014 sign in again");
+      }
+      accessToken = tok.access_token;
+      expiresAt = Date.now() + Math.max(30, tok.expires_in || 300) * 1e3;
+      if (tok.refresh_token) refreshToken = tok.refresh_token;
+      const now = await idbGet("session");
+      if (now && now.webId !== s.webId) {
+        throw new Error("signed in as somebody else while this session was refreshing");
+      }
+      await idbPut("session", { ...s, accessToken, expiresAt, refreshToken });
+    };
+    const send = async (url, init) => {
+      const jwk = await jwkP;
+      const ath = b64u2(await sha2562(accessToken));
+      const headers = { ...init.headers || {}, authorization: `DPoP ${accessToken}`, dpop: await dpopProof(s.pair, jwk, init.method || "GET", url, ath) };
+      return fetch(url, { ...init, headers });
+    };
+    const authFetch = async (url, init = {}) => {
+      if (Date.now() > expiresAt - 3e4) await refresh();
+      const res = await send(url, init);
+      if (res.status === 401 && refreshToken) {
+        try {
+          await refresh();
+        } catch {
+          return res;
+        }
+        return send(url, init);
+      }
+      return res;
+    };
+    return { webId: s.webId, issuer: s.issuer, fetch: authFetch, refresh, signOut: signOut2 };
+  }
+  return { beginLogin: beginLogin2, completeLogin: completeLogin2, getSession: getSession2, signOut: signOut2 };
 }
 
+// web/app/oidc-session.mjs
+var { beginLogin, completeLogin, getSession, signOut } = solidOidcSession({ dbName: "fedipod-oidc", clientName: "FediPod" });
+
 // web/app/boot.mjs
 var REDIRECT = `${location.origin}/`;
 async function bootWorker({ reset = false } = {}) {
@@ -33925,20 +33953,82 @@ if (typeof document !== "undefined") (async () => {
         $("unlock-password").focus();
         return;
       }
+      const once = (key) => {
+        try {
+          if (sessionStorage.getItem(key)) return false;
+          sessionStorage.setItem(key, "1");
+          return true;
+        } catch {
+          return false;
+        }
+      };
+      const reload = () => location.reload();
+      const signIn = () => {
+        location.href = "/?add";
+      };
+      const known = {
+        "sign-in-refused": { title: "Your pod refused this sign-in", retry: "Sign in again", go: signIn },
+        "pod-busy": { title: "Your pod is asking for a pause", retry: "Reload", go: reload, wait: 45 },
+        "pod-error": { title: "Your pod had an error", retry: "Reload", go: reload, wait: 20 },
+        "pod-unreachable": { title: "Your pod could not be reached", retry: "Reload", go: reload, wait: 20 },
+        "no-account-here": { title: "No FediPod account in that pod", retry: "Use another pod", go: signIn },
+        "no-account": { title: "No FediPod account in that pod", retry: "Use another pod", go: signIn },
+        "device-account": { title: "This account is run from a device", retry: "Use another pod", go: signIn }
+      }[e.code];
+      if (e.code === "sign-in-refused" && once("fedipod-renewing")) {
+        $("loading").hidden = true;
+        $("hero").hidden = true;
+        $("landing").hidden = true;
+        $("brand").hidden = false;
+        $("running").hidden = false;
+        $("running-title").textContent = "Renewing your sign-in";
+        $("run-error").style.color = "var(--sub)";
+        $("run-error").style.borderLeftColor = "var(--line)";
+        $("run-error").textContent = "Your pod would not take the sign-in this browser is holding. Renewing it now.";
+        $("run-actions").hidden = true;
+        const session = await getSession().catch(() => null);
+        if (session) {
+          try {
+            await session.refresh();
+            location.reload();
+            return;
+          } catch {
+          }
+          try {
+            const { authorizationUrl } = await beginLogin({ issuer: session.issuer, redirectUri: REDIRECT });
+            location.href = authorizationUrl;
+            return;
+          } catch {
+          }
+        }
+      }
       console.error(e);
       $("loading").hidden = true;
       $("hero").hidden = true;
       $("landing").hidden = true;
       $("brand").hidden = false;
       $("running").hidden = false;
-      $("running-title").textContent = "Signed in, but the agent could not start";
+      $("running-title").textContent = known ? known.title : "Signed in, but the agent could not start";
       $("run-error").style.whiteSpace = "pre-wrap";
-      $("run-error").textContent = (e.message || String(e)) + (e.detail ? `
+      $("run-error").textContent = (e.message || String(e)) + (!known && e.detail ? `
 
 ${e.detail}` : "");
       $("run-actions").hidden = false;
-      $("run-retry").textContent = "Reload";
-      $("run-retry").addEventListener("click", () => location.reload());
+      $("run-actions").prepend($("run-retry"));
+      $("run-retry").textContent = known ? known.retry : "Reload";
+      $("run-retry").addEventListener("click", known ? known.go : reload);
+      if (known?.wait && once(`fedipod-waited-${e.code}`)) {
+        let left = known.wait;
+        const tick = () => {
+          $("run-retry").textContent = left > 0 ? `Trying again in ${left}s` : "Trying again\u2026";
+          if (left-- <= 0) {
+            clearInterval(timer);
+            location.reload();
+          }
+        };
+        const timer = setInterval(tick, 1e3);
+        tick();
+      }
       $("run-back").textContent = "Sign out";
       $("run-back").addEventListener("click", async () => {
         try {

package/web/app/site/build.json

@@ -0,0 +1 @@
+{"build":"a59138536e01","version":"1.26.1","at":"2026-09-20T18:26:18.671Z"}