npm - fedipod - Versions diffs - 1.10.0 → 1.26.1 - Mend

fedipod 1.10.0 → 1.26.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (7899) hide show

package/lib/core/wire.mjs CHANGED Viewed

@@ -124,7 +124,9 @@ export function actorDoc({ urls, handle, name, publicKeyPem, assertionKey = null
   return {
     '@context': context,
     id: urls.actor,
-    type: kind === 'group' ? 'Group' : 'Person',
+    // A group is a community; an application is a service that speaks for a
+    // site rather than a person — the actor a forum publishes for itself.
+    type: kind === 'group' ? 'Group' : kind === 'application' ? 'Application' : 'Person',
     ...(approveJoins ? { manuallyApprovesFollowers: true } : {}),
     ...(assertionKey ? { assertionMethod: [{
       id: assertionKeyId(urls), type: 'Multikey', controller: urls.actor,
@@ -196,66 +198,7 @@ export function actorDoc({ urls, handle, name, publicKeyPem, assertionKey = null
 // the actor document. It says who this is and how to follow — the handle to
 // paste, and the remote-follow control that hands the visitor to their own
 // server's follow screen.
-export function profilePageHtml({ name, address, summary = null, icon = null, kind = 'person' }) {
-  const esc = (s) => String(s ?? '').replace(/[&<>"]/g, c => ({ ...HTML_ESCAPES, '"': '&quot;' }[c]));
-  const what = kind === 'group' ? 'a group' : 'an account';
-  return `<!doctype html>
-<html lang="en">
-<head>
-<meta charset="utf-8">
-<meta name="viewport" content="width=device-width, initial-scale=1">
-<title>${esc(name)} (${esc(address)})</title>
-<style>
-:root { color-scheme: light dark; }
-body { font: 112.5%/1.5 system-ui, sans-serif; max-width: 34rem; margin: 3rem auto; padding: 0 1rem; }
-img.avatar { width: 6rem; height: 6rem; border-radius: 1rem; object-fit: cover; }
-h1 { margin: .5rem 0 0; }
-.address { font-size: 1.1rem; user-select: all; }
-form { margin-top: 2rem; }
-label { display: block; margin-bottom: .3rem; }
-input { font: inherit; padding: .5rem; width: 14rem; max-width: 100%; }
-button { font: inherit; padding: .5rem 1rem; }
-.hint { color: #777; font-size: .9rem; }
-.err { color: #b00020; }
-.err:empty { display: none; }
-@media (prefers-color-scheme: dark) {
-  .hint { color: #aaa; }
-  .err { color: #ff8a80; }
-}
-</style>
-</head>
-<body>
-<main>
-${icon ? `<img class="avatar" src="${esc(icon)}" alt="">` : ''}
-<h1>${esc(name)}</h1>
-<p class="address">${esc(address)}</p>
-${summary ? `<div>${summary}</div>` : ''}
-<p>This is ${what} on the Fediverse. To follow it, paste the address above
-into the search box of Mastodon or any Fediverse app — or use the form.</p>
-<form id="follow">
-  <label for="server">your server</label>
-  <input id="server" type="text" placeholder="mastodon.social" autocomplete="off"
-    required aria-describedby="follow-err">
-  <button type="submit">Follow</button>
-  <p class="err" id="follow-err" role="alert"></p>
-</form>
-<p class="hint">The form sends you to your own server's follow screen.</p>
-</main>
-<script>
-document.getElementById('follow').addEventListener('submit', (ev) => {
-  ev.preventDefault();
-  const s = document.getElementById('server').value.trim().replace(/^https?:\\/\\//, '').replace(/\\/.*$/, '');
-  const err = document.getElementById('follow-err');
-  const addr = document.querySelector('.address').textContent.trim();
-  if (!s) { err.textContent = 'Enter your server, e.g. mastodon.social'; return; }
-  err.textContent = '';
-  location.href = 'https://' + s + '/authorize_interaction?uri=' + encodeURIComponent(addr);
-});
-</script>
-</body>
-</html>
-`;
-}
+export { profilePageHtml } from './profile-page.mjs';
 // Retirement. An abandoned pod keeps accepting deliveries into a container
 // nobody will ever drain, and no remote server has any way to learn that. A
@@ -656,18 +599,47 @@ export function addressing(urls, visibility, who = []) {
   }[visibility] || { to: [PUBLIC], cc: [urls.followers, ...who] };
 }
+// The quote terms, declared exactly as Mastodon declares them on a post:
+// FEP-044f's `quote` and `quoteAuthorization`, and the two older spellings
+// (Fedibird's quoteUri, Misskey's _misskey_quote) that older servers read.
+export const QUOTE_CTX = {
+  quote: { '@id': 'https://w3id.org/fep/044f#quote', '@type': '@id' },
+  quoteUri: { '@id': 'http://fedibird.com/ns#quoteUri', '@type': '@id' },
+  _misskey_quote: { '@id': 'https://misskey-hub.net/ns#_misskey_quote', '@type': '@id' },
+  quoteAuthorization: { '@id': 'https://w3id.org/fep/044f#quoteAuthorization', '@type': '@id' },
+};
+// The interaction policy terms, GoToSocial's, declared as Mastodon declares them.
+export const POLICY_CTX = {
+  gts: 'https://gotosocial.org/ns#',
+  interactionPolicy: { '@id': 'gts:interactionPolicy', '@type': '@id' },
+  canQuote: { '@id': 'gts:canQuote', '@type': '@id' },
+  automaticApproval: { '@id': 'gts:automaticApproval', '@type': '@id' },
+  manualApproval: { '@id': 'gts:manualApproval', '@type': '@id' },
+};
+// Who may quote a post: anyone, for a post the world can read; nobody, for a
+// followers-only or direct one. Said on every note, because a server that
+// finds no policy offers no quote button.
+export function quotePolicy(visibility) {
+  const open = visibility === 'public' || visibility === 'unlisted';
+  return { canQuote: { automaticApproval: open ? [PUBLIC] : [], manualApproval: [] } };
+}
 // `also`: actors addressed without being mentioned — the parent's author on
 // a reply. In cc but not in tag, so their server receives the post and does
 // not notify them. A direct post names its audience in the text alone.
+// `quote`: the post this one quotes, `{ id, authorization }` — the
+// authorization is the quoted author's QuoteAuthorization, once granted.
 export function noteDoc({ urls, slug, content, published, inReplyTo, attachments, mentions = [],
-  visibility = 'public', summary = null, sensitive = false, updated = null, container = null, also = [] }) {
+  visibility = 'public', summary = null, sensitive = false, updated = null, container = null, also = [],
+  quote = null }) {
   const id = (container || urls.notes) + slug;
   const who = mentions.map(m => m.actor);
   const extra = visibility === 'direct' ? [] : also.filter(a => a && !who.includes(a));
   const addressed = addressing(urls, visibility, [...who, ...extra]);
   const hashtags = hashtagsIn(content).map(name => ({ name, href: tagHref(urls, name) }));
   const note = {
-    '@context': AS_CTX,
+    '@context': [AS_CTX, { ...POLICY_CTX, ...(quote?.id ? QUOTE_CTX : {}) }],
     id, type: 'Note',
     attributedTo: urls.actor,
     content: contentHtml(content, mentions, hashtags),
@@ -675,7 +647,15 @@ export function noteDoc({ urls, slug, content, published, inReplyTo, attachments
     to: addressed.to,
     cc: addressed.cc,
     replies: repliesId(id),
+    interactionPolicy: quotePolicy(visibility),
   };
+  if (quote?.id) {
+    // All three spellings name the same post, as Mastodon writes them.
+    note.quote = quote.id;
+    note.quoteUri = quote.id;
+    note._misskey_quote = quote.id;
+    if (quote.authorization) note.quoteAuthorization = quote.authorization;
+  }
   if (summary) note.summary = summary;      // the content warning
   // A content warning is what a receiver hides behind; media marked
   // sensitive without one is hidden the same way.
@@ -723,7 +703,7 @@ export function questionDoc({ options = [], multiple = false, endTime = null,
   if (endTime) question.endTime = endTime;
   if (closed) question.closed = closed;
   if (votersCount !== null && votersCount !== undefined) {
-    question['@context'] = [AS_CTX, {
+    question['@context'] = [...[].concat(note['@context']), {
       toot: 'http://joinmastodon.org/ns#',
       votersCount: {
         '@id': 'toot:votersCount',
@@ -839,10 +819,13 @@ export function updateActorActivity({ urls, actor, serial, published = new Date(
 // An edit: same Note id, `updated` stamped, so receivers replace their copy
 // and show it as edited. The activity id carries the stamp — each edit is a
 // new activity, and a replay of an old one is already seen.
-export function updateActivity(note, urls) {
+// `serial` names the activity when the note is not being edited — a quote
+// authorization arriving on it changes what the note says about its quote,
+// not what it says.
+export function updateActivity(note, urls, { serial = null } = {}) {
   return {
     '@context': AS_CTX,
-    id: note.id + '#update-' + String(note.updated || '').replace(/[^0-9TZ]/g, ''),
+    id: note.id + '#update-' + (note.updated ? String(note.updated).replace(/[^0-9TZ]/g, '') : 'q' + (serial ?? Date.now())),
     type: 'Update',
     actor: urls.actor,
     to: note.to, cc: note.cc,

package/lib/device/admin/routes/lifecycle.mjs CHANGED Viewed

@@ -14,6 +14,15 @@ export async function post(p, body, ctx, req, res) {   // eslint-disable-line no
     // lease exists to keep to a single agent. A viewer must claim it first
     // and give up if it cannot — the facade has refused viewer writes since
     // multi-device landed, and these two were simply missed.
+    // The account back in this agent's hands. A viewer publishes nothing and
+    // drains nothing, so a lease left behind by something that is gone leaves
+    // the account silent with nothing in the interface to say so.
+    case '/takeover': {
+      if (!await agent.requestTakeover?.()) {
+        return json(res, 503, { error: 'the lease could not be taken — the pod refused the write' });
+      }
+      return json(res, 200, { ok: true, mode: agent.status().mode });
+    }
     case '/drain': {
       if (!await agent.requestTakeover?.()) {
         return json(res, 503, { error: 'another agent is active for this pod — it is doing the draining' });

package/lib/device/admin/static.mjs CHANGED Viewed

@@ -52,7 +52,10 @@ const UI_DIR = path.join(projectRoot, 'ui');       // extra client dists: ui/<na
 // One surface, /admin/, with setup as its first section: /admin/setup/ is the
 // first run, /admin/ is the record, and there is room for the rest.
 const WEB_DIR = path.join(projectRoot, 'web');
-const WEB_MOUNTS = ['admin'];
+// `icons` alongside `admin`: the favicons the agent's own pages name. One
+// file each, no authority behind them, and the same jail as everything else
+// under web/.
+const WEB_MOUNTS = ['admin', 'icons'];
 export const webMount = (pathname) => {
   const seg = decodeURIComponent(pathname).replace(/^\/+/, '').split('/')[0];
   return WEB_MOUNTS.includes(seg) ? seg : null;

package/lib/device/admin/surface.mjs CHANGED Viewed

@@ -83,7 +83,8 @@ export function buildAdminSurface({ agent, gate, allowed, log = console.log,
   const masto = new MastoApi({ agent, log, allowed, scheme, embedded, mount });
   // The spec's own write API (§6), beside the facade. Its bearer fallback is
   // the facade's token, so the two surfaces share one notion of the operator.
-  const c2s = new C2S({ agent, log, auth: makeC2sAuth({ agent, masto, log, scheme, mount }) });
+  const c2s = new C2S({ agent, log, scheme, mount,
+    auth: makeC2sAuth({ agent, masto, log, scheme, mount }) });
   const streaming = new Streaming({ masto, log, allowed, gate, gateOptional: embedded });
   // Asked per request, not once here: startAdmin runs before connect, so the
   // kind is not known yet at mount time.

package/lib/device/cli/commands/setup.mjs CHANGED Viewed

@@ -163,6 +163,7 @@ const credential = await mintCredential({ origin: issuer, email, password, name:
 const rec = {
   ...credential,
   remotePod: pod.endsWith('/') ? pod : pod + '/',
+  createdAt: new Date().toISOString(),
   // The private half goes on THIS machine, exactly as the browser setup does
   // (lib/setup.mjs). Omitting it here meant the two paths produced different
   // installs from the same answers: the CLI put the timeline, contacts,

package/lib/device/cli/commands/state.mjs CHANGED Viewed

@@ -289,7 +289,9 @@ for (const { name, dir } of homes) {
   // The kind lives in pod state, so it is only knowable from the live probe —
   // a stopped identity honestly shows nothing rather than a guess.
   rows.push({ name, pod: pod ? new URL(pod).host : '(no credential)', port: port || '—',
-    kind: live?.kind === 'group' ? 'group' : live ? 'person' : '—',
+    // A home can hold a forum, which says so itself; anything else that
+    // answers is a person unless it says group.
+    kind: live?.kind === 'group' ? 'group' : live?.kind === 'forum' ? 'forum' : live ? 'person' : '—',
     state: live ? `${live.mode}${live.podRequests ? ` · ${live.podRequests.perMinuteNow}/min` : ''}` : 'not running' });
 }

package/lib/device/setup.mjs CHANGED Viewed

@@ -293,6 +293,7 @@ export async function runSetup({ home, agent, answers, run, deps = {}, log = ()
       const rec = {
         ...credential,
         remotePod: pod.endsWith('/') ? pod : pod + '/',
+        createdAt: new Date().toISOString(),
         ...(root ? { root } : {}),
         ...(keys === 'pod' ? { keysMode: 'pod' } : {}),
         // Where the private half lives. Per-machine, like keysMode.

package/lib/gateway/front-core.mjs CHANGED Viewed

@@ -26,14 +26,22 @@ import { podBaseOfWebId } from '../pod/urls.mjs';
 // wire.mjs: wire drags the agent's whole HTML pipeline (sanitize-html and
 // friends), which a serverless front must never carry — it crashed the
 // deployed function before it answered its first request.
-const jrd = ({ handle, host, actor, aliases = [], page = null }) => ({
+const jrd = ({ handle, host, actor, aliases = [], page = null, subscribe = null }) => ({
   subject: `acct:${handle}@${host}`,
   ...(aliases.length ? { aliases } : {}),
   links: [
     { rel: 'self', type: 'application/activity+json', href: actor },
     ...(page ? [{ rel: 'http://webfinger.net/rel/profile-page', type: 'text/html', href: page }] : []),
+    // Remote follow. Somebody reading this account on another server presses
+    // Follow, says they are here, and that server looks for this link to find
+    // out where to send them. `{uri}` is a literal the other server fills in
+    // with whatever they are following — it must not be escaped.
+    ...(subscribe ? [{ rel: 'http://ostatus.org/schema/1.0/subscribe', template: subscribe }] : []),
   ],
 });
+// The door that link names, which the site staged beside this function serves.
+const subscribeTemplate = (origin) => (origin
+  ? `${String(origin).replace(/\/$/u, '')}/authorize_interaction?uri={uri}` : null);
 // The public profile page of any account the front answers for lives on
 // its pod, whether the address is the front's or the pod's own.
 const profilePageOf = (rec) => (rec?.podHome ? rec.podHome + 'ap/profile.html' : null);
@@ -136,6 +144,8 @@ const RELAY_MAX_BODY = 1024 * 1024;
 const RELAY_TIMEOUT_MS = 8_000;
 // The only headers a relayed request may carry to the remote server. Host
 // comes from the URL; the user agent from safeFetch.
+const SERVER_PROBE_MS = 6000;
+const SERVER_PROBE_BYTES = 64 * 1024;
 const RELAY_HEADERS = new Set(['date', 'digest', 'signature', 'content-type', 'accept']);
 const keyIdOf = (signature) => (/keyId="([^"]+)"/.exec(signature || '') || [])[1] || null;
@@ -203,6 +213,43 @@ function parseUserPath(pathname) {
   return m ? { handle: decodeURIComponent(m[1]), rest: m[2] } : null;
 }
+// A public document is the same for everybody who asks, so the edge may hold
+// it and answer the next reader itself. Without this every read of an actor,
+// a topic, a post or a card was a function call: one visit to a forum is
+// twenty of them, and every visitor and every refresh paid again.
+//
+// `netlify-cdn-cache-control` is the edge's own instruction; `cache-control`
+// is what the reader's browser is told. The edge may serve a stale copy while
+// it fetches a fresh one, so nobody waits on the pod for a document that is
+// merely a minute old.
+const publicFor = (seconds, stale = seconds * 4) => ({
+  'cache-control': `public, max-age=${seconds}`,
+  'netlify-cdn-cache-control': `public, s-maxage=${seconds}, stale-while-revalidate=${stale}`,
+});
+// Where a pod owner opts their identity in. An operator may name it, because
+// the path it takes is one their pod server can no longer serve; the dot says
+// it belongs to the server rather than to anybody's data, the way
+// `.well-known` and `.account` do.
+export const DEFAULT_RUN_PATH = '/.fediverse-account';
+export const runPath = (ctx) => {
+  const said = String(ctx?.runPath || '').trim().replace(/\/+$/u, '');
+  if (!said) return DEFAULT_RUN_PATH;
+  return said.startsWith('/') ? said : `/${said}`;
+};
+// A request the browser itself says came from this very origin. `Sec-Fetch-Site`
+// is the browser's word and a page cannot forge it; an `Origin` that matches is
+// the older way of saying the same. This is what makes it safe to read a
+// session cookie as proof: a page on another site gets neither.
+const sameOriginRequest = (request, origin) => {
+  const site = request.headers.get('sec-fetch-site');
+  if (site) return site === 'same-origin';
+  const said = request.headers.get('origin');
+  if (!said || !origin) return false;
+  try { return new URL(said).origin === new URL(origin).origin; } catch { return false; }
+};
 // Top-level paths a handle may not take, so a name never shadows a route.
 const RESERVED = new Set(['u', 'api', 'signup', 'new-account', 'run', 'admin', 'roster', 'gateway',
   'gw', 'well-known', 'inbox', 'outbox', 'actor', 'install']);
@@ -240,7 +287,9 @@ const policyFor = (rec, fetchImpl = fetch) =>
 // `policy` is the person's published filtering policy when there is one.
 function identFor(rec, policy = null) {
   return {
-    inboxUrl: rec.podHome + 'ap/inbox/',
+    // A row may name the inbox its deliveries are written to: a forum's
+    // categories share one, on the forum's pod, above their own trees.
+    inboxUrl: rec.inboxUrl || rec.podHome + 'ap/inbox/',
     actorUrl: rec.actorUrl,                 // the FRONT actor id (what mail is addressed to)
     followersUrl: rec.actorUrl.replace(/actor$/, 'followers'),
     notesPrefix: rec.actorUrl.replace(/ap\/actor$/, 'ap/notes/'),
@@ -330,7 +379,7 @@ async function route(request, ctx) {
   // The run page: a pod owner opting their identity in or out of being run by
   // this server. Meaningful only on a host that embeds the agent; a host that
   // does not simply supplies no page.
-  if (pathname === '/run') {
+  if (pathname === runPath(ctx)) {
     if (request.method !== 'GET' && request.method !== 'HEAD') return { status: 405, headers: {}, body: '' };
     if (!ctx.runPage) return notFound();
     return { status: 200, headers: { 'content-type': 'text/html; charset=utf-8' }, body: ctx.runPage };
@@ -398,6 +447,48 @@ async function route(request, ctx) {
       offersPods: !!ctx.offersPods, version: ctx.version || null });
   }
+  // What a reader's own server speaks, asked here rather than in their
+  // browser: a page cannot probe a stranger's server (no CORS), and the
+  // answer decides how that reader takes part in a forum.
+  if (pathname === '/api/server') {
+    const host = (url.searchParams.get('host') || '').trim().toLowerCase();
+    const open = { 'access-control-allow-origin': '*' };
+    const said = (kind, extra = {}) => ({ ...j(200, { host, kind, ...extra }), headers: { ...j(200, {}).headers, ...open } });
+    // An address at this front is a FediPod account: its client is the
+    // browser here, and no other server holds it. Asked before the shape of
+    // the host, since a front may answer at a name with no dot in it.
+    if (host && host === String(ctx.host || '').toLowerCase()) {
+      const handle = (url.searchParams.get('handle') || '').toLowerCase();
+      const rec = handle ? await ctx.lookup(handle) : null;
+      if (!rec) return said('fedipod');
+      // Where the owner of this pod signs in: the pod says so itself, at the
+      // well-known document every Solid server answers (or redirects to).
+      let issuer = null;
+      try {
+        const res = await safeFetch(new URL('/.well-known/openid-configuration', rec.podHome).href,
+          { headers: { accept: 'application/json' }, redirect: 'follow', signal: AbortSignal.timeout(SERVER_PROBE_MS) },
+          ctx.fetchImpl || fetch);
+        if (res.ok) issuer = JSON.parse(await readCapped(res, SERVER_PROBE_BYTES)).issuer || null;
+      } catch { /* a pod that will not say leaves the reader to type it */ }
+      return said('fedipod', { podHome: rec.podHome, actor: rec.actorUrl, issuer, inbox: identFor(rec).inboxUrl });
+    }
+    if (!/^[a-z0-9.-]+\.[a-z0-9-]+(:\d+)?$/u.test(host)) return said('invalid');
+    const f = ctx.fetchImpl || fetch;
+    const ask = async (path) => {
+      try {
+        const res = await safeFetch(`https://${host}${path}`,
+          { headers: { accept: 'application/json' }, signal: AbortSignal.timeout(SERVER_PROBE_MS) }, f);
+        if (!res.ok) return null;
+        return JSON.parse(await readCapped(res, SERVER_PROBE_BYTES));
+      } catch { return null; }
+    };
+    const masto = await ask('/api/v1/instance');
+    if (masto) return said('mastodon-api', { name: masto.title || masto.domain || host });
+    const lemmy = await ask('/api/v3/site');
+    if (lemmy) return said('lemmy', { name: lemmy.site_view?.site?.name || host });
+    return said('unknown');
+  }
   // Attach: create the account. The user proves control of the pod they claim
   // by presenting a Solid-OIDC token whose WebID lives on that pod — no
   // password reaches the front. On success the directory gets a row and the
@@ -463,10 +554,20 @@ async function route(request, ctx) {
     const claimedActor = typeof body.actorUrl === 'string' && body.actorUrl.startsWith(podHome) ? body.actorUrl : null;
     const actorUrl = fronted ? `${userBase(ctx.frontOrigin, key)}ap/actor` : (claimedActor || podHome + 'ap/actor');
     const hmacSecret = prior?.hmacSecret || crypto.randomBytes(32).toString('base64');
+    // Where the door writes: the row's own tree unless the caller names an
+    // inbox on the same pod — a forum's categories name the forum's.
+    let inboxUrl = null;
+    if (typeof body.inboxUrl === 'string' && body.inboxUrl) {
+      let ok = false;
+      try { ok = new URL(body.inboxUrl).origin === new URL(podHome).origin && body.inboxUrl.endsWith('/'); } catch { ok = false; }
+      if (!ok) return j(400, { error: 'inboxUrl must be a container on the same pod' });
+      inboxUrl = body.inboxUrl;
+    }
     const record = {
       handle, address, podHome, webId: webid, actorUrl,
-      kind: body.kind === 'group' ? 'group' : 'person',
+      kind: body.kind === 'group' ? 'group' : body.kind === 'application' ? 'application' : 'person',
       gatewayWebId: ctx.gatewayWebId || null, hmacSecret,
+      ...(inboxUrl ? { inboxUrl } : {}),
       ...(fronted ? {} : { inboxOnly: true }),
     };
     await ctx.putDirectory(key, record);
@@ -540,15 +641,27 @@ async function route(request, ctx) {
     if (/(^|\/)\.internal(\/|$)/u.test(podUrl.pathname) || /(^|\/)\.\.(\/|$)/u.test(podUrl.pathname)) {
       return j(403, { error: 'that is not a pod address' });
     }
-    const webid = await verifyPodToken(request, pathname, ctx.verifier);
-    if (!webid) return j(401, { error: 'a Solid-OIDC token proving the pod is required' });
     // The pod's own server names its owner when it can, and where it does that
     // is the proof. Where it does not, the WebID must live in EXACTLY this pod
     // — its own pod base equal to podBase, not merely starting with it, which on
     // a path server an ancestor of another's pod would.
     const owners = await podOwners(podBase, ctx.fetchImpl || fetch);
-    const proven = owners.length ? owners.includes(webid) : podBaseOfWebId(webid) === podBase;
-    if (!proven) {
+    const ownsIt = (who) => (owners.length ? owners.includes(who) : podBaseOfWebId(who) === podBase);
+    const token = await verifyPodToken(request, pathname, ctx.verifier);
+    // A server that issued the reader's own session can simply read it. On a
+    // pod server the page, the session and the pod are one origin, and a token
+    // proves nothing the session does not — so opting in cost a round trip to
+    // an identity provider that had just said who they were. A Gateway fronting
+    // somebody else's pod holds no such session and this does nothing there.
+    //
+    // One account can hold several WebIDs, so it is the one that owns this pod
+    // that is taken, not whichever came back first.
+    const session = !token && ctx.webIdsFromSession && sameOriginRequest(request, ctx.frontOrigin)
+      ? (await ctx.webIdsFromSession(request).catch(() => [])).find(ownsIt) || null
+      : null;
+    const webid = token || session;
+    if (!webid) return j(401, { error: 'a Solid-OIDC token proving the pod is required' });
+    if (!ownsIt(webid)) {
       return j(403, { error: 'the token proves a different pod than the one you listed' });
     }
     if (action === 'opt-in') {
@@ -581,7 +694,7 @@ async function route(request, ctx) {
     return { status: 200, headers: { 'content-type': 'text/javascript; charset=utf-8' }, body };
   }
-  // The vendored Solid-OIDC browser library the /run and /admin pages load —
+  // The vendored Solid-OIDC browser library the opt-in and admin pages load —
   // served here because this function owns every path on the domain.
   if (pathname === '/solid-oidc-client.js') {
     if (!ctx.authBundle) return notFound();
@@ -606,10 +719,15 @@ async function route(request, ctx) {
     // is the alias, so a client signing in by the fronted address can find
     // the pod (and its login) without a lookup only the host could answer.
     const podActor = rec.inboxOnly ? [] : [rec.podHome + 'ap/actor'];
-    const out = j(200, jrd({ handle: m[1], host: ctx.host, actor: rec.actorUrl, aliases: podActor, page: profilePageOf(rec) }),
-      'application/jrd+json');
+    const out = j(200, jrd({ handle: m[1], host: ctx.host, actor: rec.actorUrl, aliases: podActor,
+      page: profilePageOf(rec), subscribe: subscribeTemplate(ctx.frontOrigin) }),
+    'application/jrd+json');
     // RFC 7033: a JRD is read from any origin.
     out.headers['access-control-allow-origin'] = '*';
+    // A handle answers the same for everybody, and changes only when a row
+    // does. Every server that has heard of this account asks for it; the edge
+    // can answer most of them.
+    Object.assign(out.headers, publicFor(300));
     return out;
   }
@@ -692,6 +810,14 @@ async function route(request, ctx) {
   // Everything else is a public GET, served by reading the user's pod and
   // rewriting pod ids to the front. The actor also gets its handle and inbox
   // fixed to the front so a consumer cross-checks it consistently.
+  // Public documents are read from any origin — a page on another site, the
+  // forum's own host among them — the way a pod serves them, so the read
+  // carries the open origin and a preflight is answered.
+  const open = { 'access-control-allow-origin': '*' };
+  if (request.method === 'OPTIONS') {
+    return { status: 204, headers: { ...open, 'access-control-allow-methods': 'GET, HEAD, OPTIONS',
+      'access-control-allow-headers': 'Accept', 'access-control-max-age': '86400', allow: 'GET, HEAD, OPTIONS' }, body: null };
+  }
   if (request.method !== 'GET' && request.method !== 'HEAD') return { status: 405, headers: {}, body: '' };
   const podTarget = rec.podHome + up.rest;
   // Media stays on the pod (lib/pod/urls.mjs keeps `media` off the front), but
@@ -705,10 +831,17 @@ async function route(request, ctx) {
   // directly (the CSS server component) has no access control of its own and
   // needs to be told what it may reach. See podHomeProblem above for the other
   // half — a row that names something which is not a pod.
+  // A container is Turtle, a profile page is HTML, everything else here is
+  // ActivityPub. Ask for what the thing can be, not for what most of them are.
+  const container = podTarget.endsWith('/');
+  const page = /\.html?$/u.test(podTarget);
+  const accept = container ? 'text/turtle, */*;q=0.8'
+    : page ? 'text/html, */*;q=0.8'
+      : AP_CT;
   const got = await podRoot.readPublicDocument(
-    ctx.podGet || ((u) => fetch(u, { headers: { accept: AP_CT } })),
-    podTarget, { podHome: rec.podHome });
-  if (got.text === null) return { status: got.status, headers: {}, body: '' };
+    ctx.podGet || ((u) => fetch(u, { headers: { accept } })),
+    podTarget, { podHome: rec.podHome, accept });
+  if (got.text === null) return { status: got.status, headers: open, body: '' };
   let text = got.text;
   text = swap(text, rec.podHome, base);
   if (up.rest === 'ap/actor') {
@@ -720,7 +853,11 @@ async function route(request, ctx) {
       text = JSON.stringify(doc);
     } catch { /* leave the rewritten text as-is if it will not parse */ }
   }
-  return { status: 200, headers: { 'content-type': AP_CT, 'cache-control': 'no-store' }, body: text };
+  // `readPublicDocument` asked for it with no credential, so a document that
+  // came back is one anybody can read — which is what makes it cacheable.
+  return { status: 200,
+    headers: { ...open, 'content-type': got.type || (container ? 'text/turtle' : page ? 'text/html' : AP_CT), ...publicFor(30) },
+    body: text };
 }
 export const _internal = { parseUserPath, identFor, swap, handleProblem, policyFor, policyCache };

package/lib/pod/root.mjs CHANGED Viewed

@@ -94,8 +94,11 @@ export async function probeAnswers(podUrl, fetchImpl = fetch) {
  *
  * ---- asked by: a front publishing a pod's public face under its own name ----
  */
-export async function readPublicDocument(getter, podTarget, { podHome, maxBytes = PUBLIC_DOC_MAX_BYTES } = {}) {
-  const res = await getter(podTarget, { podHome });
+export async function readPublicDocument(getter, podTarget, { podHome, accept = null, maxBytes = PUBLIC_DOC_MAX_BYTES } = {}) {
+  const res = await getter(podTarget, { podHome, accept });
   if (!res || res.status >= 400) return { status: res?.status || 502, text: null };
-  return { status: 200, text: await readCapped(res, maxBytes) };
+  // What the pod called it: a front that relabels an HTML page as JSON hands
+  // a browser something it will not render.
+  const type = res.headers?.get?.('content-type') || null;
+  return { status: 200, text: await readCapped(res, maxBytes), type };
 }

package/lib/pod/transport.mjs CHANGED Viewed

@@ -309,7 +309,7 @@ export class PodTransport {
   // leaves the private trees world-readable. $rdf.sym() also throws on an
   // illegal IRI, so a pod URL with something odd in it fails here rather than
   // silently producing a document that means something else.
-  aclDoc(targetUrl, publicModes, { appendAgents = [], aclUrl = null } = {}) {
+  aclDoc(targetUrl, publicModes, { appendAgents = [], readAgents = [], aclUrl = null } = {}) {
     const url = aclUrl || targetUrl + '.acl';
     const doc = $rdf.sym(url);
     const target = $rdf.sym(targetUrl);
@@ -328,6 +328,10 @@ export class PodTransport {
     // locked to a gateway — public loses Append, the gateway's WebID keeps it.
     appendAgents.forEach((webId, i) =>
       authorize($rdf.sym(url + `#gw${i}`), ACL('agent'), $rdf.sym(webId), ['Append']));
+    // Named agents granted Read but not public: this is how a forum's
+    // moderators read a queue that names people, without it being public.
+    readAgents.forEach((webId, i) =>
+      authorize($rdf.sym(url + `#r${i}`), ACL('agent'), $rdf.sym(webId), ['Read']));
     authorize($rdf.sym(url + '#owner'), ACL('agent'), $rdf.sym(this.webId),
       ['Read', 'Write', 'Control']);
     return $rdf.serialize(doc, g, url, 'text/turtle');

package/lib/server/embed.mjs CHANGED Viewed

@@ -137,6 +137,7 @@ function ensureCredential(home, { podBase, webId }) {
   const rec = {
     webId,
     remotePod: podBase.endsWith('/') ? podBase : podBase + '/',
+    createdAt: new Date().toISOString(),
     root: 'fedipod/',
     keysMode: 'pod',
   };