fedipod 1.11.0 → 1.26.1

package/README.md

@@ -48,14 +48,26 @@ signing key" on that screen and use the password you use now.
 
 ## What you can do
 
-The client is [Phanpy](https://github.com/cheeaun/phanpy) (MIT, by Chee Aun),
-served by fedipod.net. Through it you follow and unfollow, post, reply,
+There are two clients, both served by fedipod.net:
+[Sengi](https://github.com/NicolasConstant/sengi) (MIT, by Nicolas Constant),
+which you get by default, and [Phanpy](https://github.com/cheeaun/phanpy)
+(MIT, by Chee Aun). The links at the top right of every page switch between
+them, at any time; whichever you opened last is the one that opens next time.
+
+You follow and unfollow, post, reply,
 favourite, boost, attach media, edit and delete. Content warnings, polls with
 up to four options and one or several answers, all four visibility levels, a
 conversations view for direct messages, bookmarks, lists, keyword filters,
 pinned posts that other servers can see, blocking and muting, and the custom
 emojis other servers send.
 
+A post can quote another post. Quote is offered on posts whose author allows
+it; the quoted author's server is asked, and the quote shows as pending until
+they answer. Anyone may quote your public posts, nobody your followers-only
+or direct ones, and you are notified when someone does. Emoji reactions from
+Misskey, Sharkey, Pleroma and Akkoma arrive as notifications showing the
+emoji.
+
 **Bluesky.** Connect a Bluesky account, or any other ATProto account, from the
 manage page. Your public posts are mirrored to it, Bluesky replies and
 activity flow into your timeline, and you can like, repost and reply to
@@ -110,6 +122,11 @@ key: it verifies incoming mail, drops the junk, forwards the rest to your pod,
 and hands your browser the app. You can detach from it at any time and attach
 to a gateway of your own. Your address and your data do not change.
 
+**A forum.** FediPod-BB, in `packages/fedipod-bb`, is a discussion board
+whose record lives on a Solid pod: categories are groups, topics are
+context collections, and a website at `/bb/` shows them. Its README says how
+to run one.
+
 ## Other ways to run FediPod
 
 - [The DeviceAgent](device-agent.md) runs on your own machine and
@@ -123,7 +140,6 @@ to a gateway of your own. Your address and your data do not change.
   server as a Community Solid Server component, giving every pod on the server
   the option of a Fediverse account.
 
-
 ## Acknowledgements
 
 This project is inspired by the fantastic [ActivityPods project](https://github.com/activitypods) and is meant to be a lightweight alternative rather than a replacement.  Thanks to [Sébastien](https://github.com/srosset81) and collaborators for all your work.  Thanks to [Damon](https://github.com/outlaw-dame), [Mikhal](https://github.com/mrkvon), [Alain](https://github.com/bourgeoa), and [Sharon](https://github.com/SharonStrats), for testing and encouragement.  Special thanks are due to [Joseph](https://github.com/jg10-mastodon-social) whose client-to-server authentication approach and the netlify/fronted-identity ideas I borrowed from [solid-activitypub-netlify](https://github.com/jg10-mastodon-social/solid-activitypub-netlify) and to [Vincent](https://github.com/Vinnl) and [Emilia](https://github.com/ThisIsMissEm) whose ideas on the multiple Fediverse accounts sparked FediPod's support for it.

package/gateway.md

@@ -158,6 +158,14 @@ fedipod gateway --attach <front-origin> --name <name> --fronted
 Choose at attach time: changing an existing identity's front later renames
 every published id, and the attach refuses it.
 
+**Following from elsewhere.** Each account's WebFinger answer names the front's
+`/authorize_interaction?uri={uri}` page in the link other servers read for it
+(`http://ostatus.org/schema/1.0/subscribe`). That is what a remote **Follow**
+button uses when its reader says they are at this host: the reader lands on
+that page, and the follow is sent by the agent in their own browser. Without
+the link, and without the page, pressing Follow and naming this host ends in
+"not found" on the other server.
+
 **A front is only a doorway.** It never hosts pods and never dictates where
 they live. A host who also wants to offer pods to people who have none runs a
 pod server separately, with the duties that carries — and users may always

package/gui.md

@@ -106,6 +106,18 @@ follows the group's own moderation settings; see [Groups](groups.md).
 **new followers** control switches between waiting for your approval and
 accepting automatically.
 
+## Following from somebody else's server
+
+Every Fediverse profile page has a **Follow** button that asks which server
+you are on. Give it the host your account answers at (`fedipod.net`, say) and
+it hands you to that host's `/authorize_interaction` page, which names who you
+are about to follow and follows them for you — your account, your key, from
+the browser you are signed in to. It is the same door Mastodon has, at the
+same address, so another server needs to know nothing about FediPod to send
+you there. A handle's WebFinger answer is what tells them where it is.
+
+Your own profile page carries that form too, for readers coming the other way.
+
 ## The gateway
 
 The **gateway** row on the record (under **software**) attaches this account

package/lib/client/c2s.mjs

@@ -5,8 +5,12 @@
 // SAME helper the facade and admin surfaces use — this module re-implements
 // no persistence and no delivery, so one write path stays one.
 //
-// GETs on the actor and outbox are redirects: the pod's documents are the
-// canonical ones, and a second renderer here would only drift from them.
+// GETs on the actor and outbox are redirects to the pod's documents wherever
+// those are reachable, which is the Server. Standalone they are not: the actor
+// published there names no address a local client could write to, and on a
+// fronted account the published outbox address is the Gateway's write door,
+// which does not answer a read. So on that build both are served here, to the
+// client already talking to this agent.
 //
 // `dispatch` takes an activity and answers with { status, body, headers }; it
 // touches no request or response. The HTTP handler below is one caller. The
@@ -32,6 +36,9 @@ const MAX_BODY = 512 * 1024;          // same ceiling the inbox drain enforces
 // the pod an unbounded read; the log says when that happened.
 const MAX_INBOX_PAGE = 500;
 
+// How many recorded activities one page of the locally-served outbox carries.
+const MAX_OUTBOX_PAGE = 50;
+
 // §6 names activities; anything else with a type is an object to wrap.
 const ACTIVITY_TYPES = new Set([
   'Create', 'Update', 'Delete', 'Follow', 'Like', 'Announce', 'Undo',
@@ -56,10 +63,15 @@ function readBody(req) {
 }
 
 export class C2S {
-  constructor({ agent, log = console.log, auth }) {
+  constructor({ agent, log = console.log, auth, scheme = null, mount = '' }) {
     this.agent = agent;
     this.log = log;
     this.auth = auth;
+    // What this agent calls itself, for the actor it serves a local client.
+    // The same two values oidc-auth rebuilds the DPoP `htu` from, so the two
+    // surfaces agree on the address a client just used.
+    this.scheme = scheme;
+    this.mount = mount;
   }
 
   get store() { return this.agent.store; }
@@ -157,6 +169,85 @@ export class C2S {
     });
   }
 
+  // The actor a client-to-server client on this machine reads. The same
+  // document the pod holds, but for the fields naming where a write goes —
+  // the outbox and the two OAuth endpoints — and for `id`, which names this
+  // address so the client files its credential here and comes back. The pod's
+  // id stays on as an alias; the two are one identity.
+  // What this agent calls itself, to the client that just asked. The Host
+  // passed the Authorities firewall before any route ran, so whichever alias
+  // the client used is one this agent answers on. The scheme is read off the
+  // connection unless the caller named one: only the Server passes a scheme,
+  // and standalone this listener is its own TLS.
+  localOrigin(req) {
+    const host = req.headers.host;
+    if (!host) return null;
+    const scheme = this.scheme
+      || (req.socket?.encrypted || req.headers['x-forwarded-proto'] === 'https' ? 'https' : 'http');
+    return `${scheme}://${host}${this.mount}/`;
+  }
+
+  /**
+   * The owner's own outbox, from what this agent recorded. The pod holds the
+   * published copy and it stays the canonical one; this is served only where
+   * that copy cannot be read by the client asking.
+   */
+  sendLocalOutbox(res, url, origin) {
+    const id = `${origin}ap/outbox`;
+    const outbox = this.store.read('outbox.json', []);     // newest first
+    const page = url?.searchParams?.get('page') || null;
+    const ct = { 'content-type': 'application/activity+json; charset=utf-8' };
+    if (!page) {
+      return this.send(res, 200, {
+        '@context': wire.AS_CTX, id, type: 'OrderedCollection', totalItems: outbox.length,
+        ...(outbox.length ? { first: `${id}?page=1` } : { orderedItems: [] }),
+      }, ct);
+    }
+    const n = Number(page);
+    if (!Number.isInteger(n) || n < 1) {
+      return this.send(res, 400, { error: 'page is a whole number from 1' });
+    }
+    const start = (n - 1) * MAX_OUTBOX_PAGE;
+    const items = outbox.slice(start, start + MAX_OUTBOX_PAGE);
+    return this.send(res, 200, {
+      '@context': wire.AS_CTX,
+      id: `${id}?page=${n}`,
+      type: 'OrderedCollectionPage',
+      partOf: id,
+      ...(start + items.length < outbox.length ? { next: `${id}?page=${n + 1}` } : {}),
+      // A post is recorded by its object id and published as the Create beside
+      // it — the same mapping the pod's copy uses, from the same helper.
+      orderedItems: items.map(wire.outboxWireItem),
+    }, ct);
+  }
+
+  sendLocalActor(req, res, origin) {
+    const pub = this.agent.publisher;
+    const cfg = pub.config || {};
+    const gw = cfg.gateway;
+    const gwActive = gw && gw.url && gw.mode && gw.mode !== 'off';
+    const doc = pub.actorDocFor({
+      inbox: gwActive ? gw.url : (cfg.inboxUrl || null),
+      clientOrigin: origin,
+    });
+    // A client files its credential under the id it reads here and comes back
+    // to that address for everything after, so this document has to name
+    // itself. The pod's id stays on as an alias rather than being dropped —
+    // the two are one identity. Nothing published ever carries this id: every
+    // activity the dispatcher builds names the pod's actor.
+    const canonical = doc.id;
+    doc.id = `${origin}ap/actor`;
+    doc.alsoKnownAs = [...new Set([...(doc.alsoKnownAs || []), canonical])];
+    const body = JSON.stringify(doc);
+    res.writeHead(200, {
+      'content-type': 'application/activity+json; charset=utf-8',
+      'cache-control': 'no-store',
+      'content-length': Buffer.byteLength(body),
+    });
+    res.end(req.method === 'HEAD' ? undefined : body);
+    return true;
+  }
+
   async handle(req, res, pathname, url) {   // eslint-disable-line no-unused-vars
     if (pathname !== '/ap/outbox' && pathname !== '/ap/actor' && pathname !== '/ap/inbox') return false;
     if (req.method === 'OPTIONS') {
@@ -179,6 +270,12 @@ export class C2S {
       return this.sendInbox(res, url);
     }
     if (req.method === 'GET' || req.method === 'HEAD') {
+      // Where the client surface answers on an address a stranger can reach,
+      // the pod's copies already name it and are the documents. Standalone
+      // they are not reachable by the client asking, so it is answered here.
+      const local = this.agent.publisher?.clientOrigin ? null : this.localOrigin(req);
+      if (local && pathname === '/ap/actor') return this.sendLocalActor(req, res, local);
+      if (local && pathname === '/ap/outbox') return this.sendLocalOutbox(res, url, local);
       // The pod's copy is the document; send the reader there.
       const target = pathname === '/ap/actor' ? this.urls.actor : this.urls.outbox;
       res.writeHead(303, { location: target, 'cache-control': 'no-store' });

package/lib/client/masto/accounts.mjs

@@ -6,8 +6,7 @@
 import crypto from 'node:crypto';
 import * as podMedia from '../../pod/media.mjs';
 import * as social from '../../core/social.mjs';
-import { readBody } from './body.mjs';
-import { readMultipart } from './media.mjs';
+import { readBody, readMultipart } from './body.mjs';
 
 export async function handle(api, ctx) {
   const { req, res, pathname, url, send } = ctx;   // eslint-disable-line no-unused-vars
@@ -226,6 +225,39 @@ export async function handle(api, ctx) {
 
   if (/^\/api\/v1\/accounts\/[a-f0-9]+\/featured_tags$/.test(pathname)) return send(200, []);
 
+  // The instance's own directory is its one account; there is nothing to
+  // suggest and nothing trending, so those screens are empty rather than 404.
+  if (pathname === '/api/v1/directory') return send(200, api.urls?.actor ? [api.account(api.urls.actor)] : []);
+  if (pathname === '/api/v1/suggestions') return send(200, []);
+
+  // The lists this account is on — what "add to list" from a profile reads.
+  const mAccLists = /^\/api\/v1\/accounts\/([a-f0-9]+)\/lists$/.exec(pathname);
+  if (mAccLists && req.method === 'GET') {
+    const actorUrl = api.store.urlFor(mAccLists[1]);
+    if (!actorUrl) return send(404, { error: 'Record not found' });
+    return send(200, api.store.getLists().filter(l => (l.members || []).includes(actorUrl))
+      .map(l => ({ id: l.id, title: l.title, replies_policy: l.repliesPolicy || 'list', exclusive: false })));
+  }
+
+  // The people muted and blocked, as accounts; the domains blocked, as names.
+  if (pathname === '/api/v1/mutes' && req.method === 'GET') {
+    return send(200, (api.store.getMuted().actors || []).map(a => api.account(a)));
+  }
+  if (pathname === '/api/v1/blocks' && req.method === 'GET') {
+    return send(200, (api.store.getBlocklist().actors || []).map(a => api.account(a)));
+  }
+  if (pathname === '/api/v1/domain_blocks') {
+    const b = api.store.getBlocklist();
+    if (req.method === 'GET') return send(200, [...b.domains]);
+    const body = await readBody(req);
+    const domain = String(body.domain || url.searchParams.get('domain') || '').trim().toLowerCase();
+    if (!/^[a-z0-9.-]+\.[a-z]{2,}$/u.test(domain)) return send(422, { error: 'a domain is required' });
+    if (req.method === 'POST' && !b.domains.includes(domain)) b.domains.push(domain);
+    if (req.method === 'DELETE') b.domains = b.domains.filter(d => d !== domain);
+    api.store.setBlocklist(b);
+    return send(200, {});
+  }
+
   // The counts these back are rendered from the same two arrays (see
   // `account`), so a client that shows a number here can always open it.
   const mAccList = /^\/api\/v1\/accounts\/([a-f0-9]+)\/(following|followers)$/.exec(pathname);
@@ -259,9 +291,17 @@ export async function handle(api, ctx) {
   if (mAccStatuses) {
     const actorUrl = api.store.urlFor(mAccStatuses[1]);
     const all = api.store.getStatuses();
-    const pinnedOnly = url.searchParams.get('pinned') === 'true';
+    const q = url.searchParams;
+    const is = (name) => q.get(name) === 'true' || q.get(name) === '1';
+    const pinnedOnly = is('pinned');
+    const tagged = String(q.get('tagged') || '').replace(/^#/, '').toLowerCase();
+    const isBoost = (s) => !!s.via && s.via !== s.actor;
     const { items, headers } = api.page(
-      all.filter(s => s.actor === actorUrl && (!pinnedOnly || s.pinned)), url);
+      all.filter(s => s.actor === actorUrl && (!pinnedOnly || s.pinned))
+        .filter(s => !is('exclude_replies') || !s.inReplyTo)
+        .filter(s => !is('exclude_reblogs') || !isBoost(s))
+        .filter(s => !is('only_media') || (s.attachments || []).length > 0)
+        .filter(s => !tagged || (s.tags || []).some(t => String(t.name).toLowerCase() === tagged)), url);
     return send(200, items.map(s => api.statusOrBoost(s, { all })), headers);
   }
 

package/lib/client/masto/body.mjs

@@ -1,6 +1,6 @@
-// body.mjs — reading what a client sent: JSON or form-encoded bodies, the
-// poll a compose request carries, and the text of a post back out of its
-// HTML.
+// body.mjs — reading what a client sent: JSON, form-encoded or multipart
+// bodies, the poll a compose request carries, and the text of a post back out
+// of its HTML.
 
 
 
@@ -51,6 +51,12 @@ export function readBody(req) {
       const ct = String(req.headers['content-type'] || '');
       try {
         if (ct.includes('application/json')) return resolve(data ? JSON.parse(data) : {});
+        // A multipart body is not a query string: read as one it becomes a
+        // single nonsense key, so every field a client sent that way arrived
+        // undefined. Sengi registers its OAuth client with a FormData, which
+        // is multipart, so /api/v1/apps saw no redirect_uris and handed back
+        // the out-of-band URN, leaving the client nowhere to come back to.
+        if (ct.includes('multipart/form-data')) return resolve(textFields(data, ct));
         // A form-encoded list is the same key repeated, spelled with a
         // trailing `[]`. Reading it as a plain object kept only the last one,
         // so a client sending its poll or its media that way lost all but the
@@ -67,3 +73,84 @@ export function readBody(req) {
     req.on('error', reject);
   });
 }
+
+/**
+ * The text fields of a multipart body that arrived as text. readBody
+ * accumulates the body as a string, so this reads the fields out of that
+ * string rather than out of bytes — which is all a client sending a plain
+ * form this way has in it. A body with a FILE in it is not this reader's:
+ * a text round trip corrupts binary, and the upload endpoints take their
+ * bytes from readMultipart below.
+ */
+function textFields(data, contentType) {
+  const m = /boundary=(?:"([^"]+)"|([^;]+))/.exec(contentType);
+  if (!m) return {};
+  const out = {};
+  for (const part of data.split('--' + (m[1] || m[2]).trim())) {
+    const sep = part.indexOf('\r\n\r\n');
+    if (sep < 0) continue;
+    const head = part.slice(0, sep);
+    const name = /name="([^"]*)"/.exec(head)?.[1];
+    // A file part is skipped rather than kept as mangled text.
+    if (!name || /filename="/.test(head)) continue;
+    const value = part.slice(sep + 4).replace(/\r\n$/, '');
+    if (name.endsWith('[]')) (out[name] ||= []).push(value);
+    else out[name] = value;
+  }
+  return out;
+}
+
+// Minimal multipart/form-data reader for media uploads: string fields plus
+// at most one file part (Mastodon's media endpoints send exactly one).
+export function readMultipart(req, limit = 12e6) {
+  return new Promise((resolve, reject) => {
+    const chunks = [];
+    let n = 0;
+    req.on('data', c => {
+      n += c.length;
+      if (n > limit) { reject(new Error('upload too large')); req.destroy(); return; }
+      chunks.push(c);
+    });
+    req.on('error', reject);
+    req.on('end', () => {
+      try {
+        const m = /boundary=(?:"([^"]+)"|([^;]+))/.exec(String(req.headers['content-type'] || ''));
+        if (!m) return resolve({ fields: {}, file: null });
+        const buf = Buffer.concat(chunks);
+        const boundary = Buffer.from('--' + (m[1] || m[2]).trim());
+        const fields = {};
+        // `file` is the last one seen, which is what the single-file media
+        // upload wants. `files` keys them by field name, because the profile
+        // editor submits an avatar and a header in one request.
+        const files = {};
+        let file = null;
+        let i = buf.indexOf(boundary);
+        while (i >= 0) {
+          const start = i + boundary.length;
+          if (buf.slice(start, start + 2).toString() === '--') break;
+          const next = buf.indexOf(boundary, start);
+          if (next < 0) break;
+          const part = buf.slice(start + 2, next - 2);        // strip the CRLFs framing the part
+          const sep = part.indexOf('\r\n\r\n');
+          if (sep >= 0) {
+            const head = part.slice(0, sep).toString();
+            const body = part.slice(sep + 4);
+            const name = /name="([^"]*)"/.exec(head)?.[1];
+            const filename = /filename="([^"]*)"/.exec(head)?.[1];
+            if (filename !== undefined) {
+              file = {
+                filename,
+                contentType: /content-type:\s*([^\r\n]+)/i.exec(head)?.[1]?.trim() || 'application/octet-stream',
+                data: body,
+              };
+              if (name) files[name] = file;
+            } else if (name) fields[name] = body.toString();
+          }
+          i = next;
+        }
+        resolve({ fields, file, files });
+      } catch (e) { reject(e); }
+    });
+  });
+}
+

package/lib/client/masto/index.mjs

@@ -183,6 +183,7 @@ export class MastoApi {
   acctAction(...a) { return render.acctAction(this, ...a); }
   acctReply(...a) { return render.acctReply(this, ...a); }
   status(...a) { return render.status(this, ...a); }
+  quoteApproval(...a) { return render.quoteApproval(this, ...a); }
   filtersFor(...a) { return render.filtersFor(this, ...a); }
   lookup(...a) { return render.lookup(this, ...a); }
   statusOrBoost(...a) { return render.statusOrBoost(this, ...a); }

package/lib/client/masto/instance.mjs

@@ -14,7 +14,7 @@ const STUBS = new Map(Object.entries({
   '/api/v1/custom_emojis': [],
   '/api/v1/announcements': [],
   '/api/v1/instance/peers': [],
-  '/api/v1/trends/tags': [], '/api/v1/trends/links': [],
+  '/api/v1/trends/links': [],
   '/api/v2/suggestions': [],
   '/api/v1/preferences': {},
 }));   // followed_tags is served live from the tag feed, not stubbed
@@ -49,9 +49,9 @@ export function instanceTitle(api) {
 // A Mastodon Tag object. The client reads `following` in its Followed
 // Hashtags view and toggles it with the follow/unfollow endpoints. No usage
 // history — a single-actor instance has no firehose stats to report.
-export function tagObject(api, name, following, req) {
+export function tagObject(api, name, following, req, history = []) {
   const host = req?.headers?.host || api.host;
-  return { name, url: `https://${host}/tags/${name}`, history: [], following: !!following };
+  return { name, url: `https://${host}/tags/${name}`, history, following: !!following };
 }
 
 export function instanceBlurb(api) {
@@ -59,6 +59,12 @@ export function instanceBlurb(api) {
   return `Solid pod ActivityPub ${kind}`;
 }
 
+// The Mastodon API version this facade answers to. Clients read it for what
+// the server can do beyond the version string: grouped notifications from 2,
+// a filter's blur action from 5, quote posts from 7. Everything up to 7 is
+// served here; nothing past it is claimed.
+const API_VERSIONS = { mastodon: 7 };
+
 export async function handle(api, ctx) {
   const { req, res, pathname, url, send } = ctx;   // eslint-disable-line no-unused-vars
 
@@ -68,6 +74,7 @@ export async function handle(api, ctx) {
     return send(200, {
       uri: api.host, title: api.instanceTitle(), short_description: api.instanceBlurb(),
       description: api.instanceBlurb(), email: '', version: '4.2.0 (compatible; fedipod)',
+      api_versions: API_VERSIONS,
       urls: su ? { streaming_api: su } : {},
       stats: { user_count: 1, status_count: api.store.countStatuses(), domain_count: 1 },
       languages: ['en'], registrations: false, approval_required: false, invites_enabled: false,
@@ -79,6 +86,7 @@ export async function handle(api, ctx) {
     const su = api.streamingUrl(req);
     return send(200, {
       domain: api.host, title: api.instanceTitle(), version: '4.2.0 (compatible; fedipod)',
+      api_versions: API_VERSIONS,
       source_url: 'https://github.com/jeff-zucker/FediPod', description: api.instanceBlurb(),
       usage: { users: { active_month: 1 } },
       thumbnail: { url: TRANSPARENT_PNG },

package/lib/client/masto/media.mjs

@@ -1,10 +1,10 @@
 // media.mjs — an upload on its way to the pod's media container: what an
-// attachment is allowed to be, the multipart reader, and the two media
-// endpoints.
+// attachment is allowed to be and the two media endpoints. The multipart
+// reader moved to body.mjs, which is where a client's body is read.
 
 import crypto from 'node:crypto';
 import * as podMedia from '../../pod/media.mjs';
-import { readBody } from './body.mjs';
+import { readBody, readMultipart } from './body.mjs';
 
 // What an attachment is allowed to BE. Anything else is stored as bytes, which
 // a browser downloads rather than runs.
@@ -34,60 +34,6 @@ export function extensionFor(mediaType, filename = '') {
   return given && (given === sub || sub.startsWith(given) || given.startsWith(sub)) ? given : (sub || 'bin');
 }
 
-// Minimal multipart/form-data reader for media uploads: string fields plus
-// at most one file part (Mastodon's media endpoints send exactly one).
-export function readMultipart(req, limit = 12e6) {
-  return new Promise((resolve, reject) => {
-    const chunks = [];
-    let n = 0;
-    req.on('data', c => {
-      n += c.length;
-      if (n > limit) { reject(new Error('upload too large')); req.destroy(); return; }
-      chunks.push(c);
-    });
-    req.on('error', reject);
-    req.on('end', () => {
-      try {
-        const m = /boundary=(?:"([^"]+)"|([^;]+))/.exec(String(req.headers['content-type'] || ''));
-        if (!m) return resolve({ fields: {}, file: null });
-        const buf = Buffer.concat(chunks);
-        const boundary = Buffer.from('--' + (m[1] || m[2]).trim());
-        const fields = {};
-        // `file` is the last one seen, which is what the single-file media
-        // upload wants. `files` keys them by field name, because the profile
-        // editor submits an avatar and a header in one request.
-        const files = {};
-        let file = null;
-        let i = buf.indexOf(boundary);
-        while (i >= 0) {
-          const start = i + boundary.length;
-          if (buf.slice(start, start + 2).toString() === '--') break;
-          const next = buf.indexOf(boundary, start);
-          if (next < 0) break;
-          const part = buf.slice(start + 2, next - 2);        // strip the CRLFs framing the part
-          const sep = part.indexOf('\r\n\r\n');
-          if (sep >= 0) {
-            const head = part.slice(0, sep).toString();
-            const body = part.slice(sep + 4);
-            const name = /name="([^"]*)"/.exec(head)?.[1];
-            const filename = /filename="([^"]*)"/.exec(head)?.[1];
-            if (filename !== undefined) {
-              file = {
-                filename,
-                contentType: /content-type:\s*([^\r\n]+)/i.exec(head)?.[1]?.trim() || 'application/octet-stream',
-                data: body,
-              };
-              if (name) files[name] = file;
-            } else if (name) fields[name] = body.toString();
-          }
-          i = next;
-        }
-        resolve({ fields, file, files });
-      } catch (e) { reject(e); }
-    });
-  });
-}
-
 export async function handle(api, ctx) {
   const { req, res, pathname, url, send } = ctx;   // eslint-disable-line no-unused-vars
 

package/lib/client/masto/render.mjs

@@ -9,9 +9,25 @@ import { sanitizeHtml, followsNeedApproval, publicHandle } from '../../core/wire
 import { profileUrl, postUrl } from '../../connections/bskyfeed.mjs';
 import { htmlToText } from './body.mjs';
 
-// 1x1 transparent PNG — placeholder avatar/header for accounts without icons.
+// 1x1 transparent PNG — placeholder header, and the instance thumbnail. A
+// banner nobody set should take up no room and show nothing; an avatar is a
+// different matter (below).
 export const TRANSPARENT_PNG = 'data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mNkYPhfDwAChwGA60e6kgAAAABJRU5ErkJggg==';
 
+// The avatar for an account with no icon of its own: a head and shoulders on a
+// slate square, 64x64. It used to be the transparent pixel above, which is
+// correct JSON and invisible on screen — in Sengi's left bar the account button
+// (the one control that opens the account) rendered as an empty square, so
+// clicking it looked like nothing happening.
+//
+// A PNG rather than the SVG this was first written as, and not by preference:
+// Angular sanitizes every `<img src>` binding and trusts raster data URIs only,
+// because an SVG can carry script. An `svg+xml` one comes back out of it as
+// `unsafe:data:image/svg+xml` and draws nothing. Sengi is Angular.
+//
+// Redraw it with `node claude/scratch/make-default-avatar.mjs`.
+export const DEFAULT_AVATAR = 'data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAEAAAABACAYAAACqaXHeAAABd0lEQVR42u3ZoW4CQRDG8Xk6NBLbVCJ5gBpMTQ2iBlFR29RXNsFhz1JHXV9hydfkEkoobW5n2F34i0kIHMfN73ZvdwYbTabpmsMAAAAAAAAAAAAAAAAAAACiY3wzS/ePz+n1bZW6zTZ9fH59h17rPX2mYy4OQEktnl5+JP1b6Bgdey6IcIDb2Ty9r7s/Ez8MfUffbRpACfznrp8aDdEIFjnsh9z5YyMhcjqEAWge5ybfh87VFIDuWM7QPzYVokZBCICWM6/k+9A5mwHQmu4NoHM2A+A5/PenQTMA3sn3AQBTgIcgyyAbIbbCFEOUwzREaInRFKUtDgAAFQLcPSxDCqH9Z4V+o0oAXVhU4ofhiWCtJe+NYKV3e6V3idkAHvv9nDqhKIBnxVeqUrRaav5SvQKrqetTols0GGDdbaoB0LWcFUBP31qS72PoimCtD//caWC1tL1Ltc2ttbXfe08wCKC25HP+OgMAAAAAAAAAAAAAAAAArhNgB1PE/x/JOiuNAAAAAElFTkSuQmCC';
+
 const selfIcon = (api, self, cached) =>
   (self ? api.store.getConfig()?.icon : null) || cached.icon;
 
@@ -49,8 +65,8 @@ export function account(api, actorUrl, { selfAcct } = {}) {
     created_at: (self && api.store.getConfig()?.createdAt) || '2026-01-01T00:00:00.000Z',
     note: (self ? api.store.getConfig()?.summary : cached.summary) || '',
     url: actorUrl, uri: actorUrl,
-    avatar: selfIcon(api, self, cached) || TRANSPARENT_PNG,
-    avatar_static: selfIcon(api, self, cached) || TRANSPARENT_PNG,
+    avatar: selfIcon(api, self, cached) || DEFAULT_AVATAR,
+    avatar_static: selfIcon(api, self, cached) || DEFAULT_AVATAR,
     header: (self ? api.store.getConfig()?.image : null) || TRANSPARENT_PNG,
     header_static: (self ? api.store.getConfig()?.image : null) || TRANSPARENT_PNG,
     // A remote actor's counts are whatever its own collections said when we
@@ -217,7 +233,37 @@ export async function acctReply(api, send, body, parent, visibility) {
   } catch (e) { return send(422, { error: e.message }); }
 }
 
-export function status(api, s, { all } = {}) {
+// The post a status quotes, and how the quote stands: `pending` until the
+// quoted author allows it, `accepted` once they have, `rejected` if they
+// refused. The quoted post is shown whenever it is held — a reader wants to
+// see what was quoted, whatever the state says. One level deep: a quote
+// inside a quote is named by id, not rendered, so the shape stays finite.
+export function quoteJson(api, s, { all, depth = 0 } = {}) {
+  if (!s.quote) return null;
+  const state = s.quoteState || 'pending';
+  const quoted = state !== 'rejected' && (all || api.store.getStatuses()).find(x => x.noteId === s.quote);
+  if (depth > 0) return { state, quoted_status_id: quoted ? api.store.idFor(quoted.noteId) : null };
+  return { state, quoted_status: quoted ? api.status(quoted, { all, depth: depth + 1 }) : null };
+}
+
+// Who may quote a post, in the client's words, and what that means for this
+// account. Our own posts: anyone, when the world can read it; nobody
+// otherwise. Another's: whatever policy the post carried — `unknown` when it
+// carried none, which is what a client hides the quote button on.
+export function quoteApproval(api, s) {
+  if (s.actor === api.urls?.actor) {
+    const open = !s.visibility || s.visibility === 'public' || s.visibility === 'unlisted';
+    return { automatic: open ? ['public'] : [], manual: [], current_user: open ? 'automatic' : 'denied' };
+  }
+  const p = s.quotePolicy;
+  if (!p) return { automatic: [], manual: [], current_user: 'unknown' };
+  const follows = () => api.store.getContacts().following.some(f => f.actor === s.actor && f.accepted);
+  const may = (list) => list.includes('public') || (list.includes('followers') && follows());
+  const current = may(p.automatic) ? 'automatic' : may(p.manual) ? 'manual' : 'denied';
+  return { automatic: p.automatic, manual: p.manual, current_user: current };
+}
+
+export function status(api, s, { all, depth = 0 } = {}) {
   const replies = (all || api.store.getStatuses()).filter(x => x.inReplyTo === s.noteId).length;
   return {
     id: api.store.idFor(s.noteId),
@@ -258,6 +304,8 @@ export function status(api, s, { all } = {}) {
       shortcode: e.shortcode, url: e.url, static_url: e.url, visible_in_picker: false,
     })),
     card: null, poll: s.poll ? api.pollJson(s) : null,
+    quote: quoteJson(api, s, { all, depth }),
+    quote_approval: quoteApproval(api, s),
     // What a filter matched, if any. Mastodon's clients read this and do the
     // hiding or warning; they do NOT match keywords themselves — Phanpy does
     // not — so filters that were stored and served but never applied were a
@@ -346,6 +394,7 @@ export function pushNotify(api, n) {
     mention: 'mentioned you', favourite: 'favourited your post',
     reblog: 'boosted your post', follow: 'followed you',
     'follow-request': 'asked to follow you', move: 'moved account',
+    reaction: `reacted ${n.emoji || ''} to your post`, quote: 'quoted your post',
   };
   const s = n.noteId && api.store.getStatuses().find(x => x.noteId === n.noteId);
   return api.push.notify(n, {
@@ -419,10 +468,18 @@ export function relationship(api, actorUrl) {
 // and a client that does not know the type shows "Unknown notification type"
 // — which is what every Mastodon client did with a follow request here. The
 // stored spelling is left alone so existing state keeps reading.
-export function notificationType(api, t) { return t === 'follow-request' ? 'follow_request' : t; }
+// Mastodon's spellings for what is stored here. A reaction is what Pleroma's
+// API calls an emoji reaction, and what clients render as one.
+export function notificationType(api, t) {
+  return t === 'follow-request' ? 'follow_request' : t === 'reaction' ? 'emoji_reaction' : t;
+}
 
 export function notification(api, n) {
   const out = { id: n.id, type: api.notificationType(n.type), created_at: n.at, account: api.account(n.actor) };
+  if (n.type === 'reaction') {
+    out.emoji = n.emoji;
+    if (n.url) out.emoji_url = n.url;
+  }
   if (n.noteId) {
     const s = api.store.getStatuses().find(x => x.noteId === n.noteId);
     if (s) out.status = api.status(s);