npm - fedipod - Versions diffs - 1.26.1 → 1.27.1 - Mend

fedipod 1.26.1 → 1.27.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (23) hide show

package/lib/client/masto/index.mjs +4 -1
package/lib/client/masto/oauth.mjs +66 -9
package/lib/device/admin/surface.mjs +24 -1
package/lib/device/certs.mjs +18 -2
package/lib/gateway/front-core.mjs +41 -6
package/package.json +1 -1
package/vendor/gate.cjs +6 -3
package/web/admin/oauth-signin.mjs +37 -0
package/web/app/site/admin/client/index.html +2 -2
package/web/app/site/admin/client-phanpy/index.html +2 -2
package/web/app/site/admin/index.html +2 -2
package/web/app/site/admin/oauth-signin.mjs +37 -0
package/web/app/site/admin/setup/index.html +2 -2
package/web/app/site/app/compose/index.html +2 -2
package/web/app/site/app/index.html +2 -2
package/web/app/site/authorize_interaction.html +2 -2
package/web/app/site/bb/index.html +2 -2
package/web/app/site/build.json +1 -1
package/web/app/site/index.html +2 -2
package/web/front/admin.html +0 -1
package/web/front/new-account.html +0 -1
package/web/front/run.html +13 -7
package/web/front/run.js +73 -17

package/lib/client/masto/index.mjs CHANGED Viewed

@@ -31,7 +31,7 @@ export { pollParams } from './body.mjs';
 export { attachmentType, extensionFor } from './media.mjs';
 export class MastoApi {
-  constructor({ agent, log = console.log, allowed = null, scheme = null, embedded = false,
+  constructor({ agent, log = console.log, allowed = null, scheme = null, embedded = false, throughDoor = null,
     mount = '', streaming = true, webPush = true, scheduling = true }) {
     this.agent = agent;
     // The path this identity's surface answers under, when it shares its origin
@@ -45,6 +45,9 @@ export class MastoApi {
     this.embedded = embedded;
     this.log = log;
     this.allowed = allowed;             // authorities a redirect_uri may name
+    // Whether a request already passed the owner's door (its key or cookie):
+    // an owner who opened the management page is the owner at the sign-in too.
+    this.throughDoor = throughDoor;
     // The scheme this identity is reached on, when the socket cannot say —
     // a server behind a TLS proxy terminates cleartext and still is https.
     this.scheme = scheme;

package/lib/client/masto/oauth.mjs CHANGED Viewed

@@ -42,6 +42,42 @@ const escapeHtml = (s) => String(s).replace(/[&<>"']/g, c =>
 const parseRedirects = (v) => (Array.isArray(v) ? v : String(v || '').split(/\s+/))
   .map(s => s.trim()).filter(Boolean);
+// The sign-in page for an account whose owner signs in at their pod: no
+// password of ours exists, and none is asked for. The page carries the
+// client's request in its address, signs the owner in at the pod with the
+// fediverse-account library, and proves that sign-in back to /oauth/authorize.
+function sendPodSigninPage(res, client, webId, mount = '') {
+  let asking = '';
+  if (client && (client.name || client.redirect)) {
+    let where = '';
+    try { where = client.redirect ? new URL(client.redirect).host : ''; } catch { /* oob or blank */ }
+    const who = client.name ? escapeHtml(client.name) : (where ? escapeHtml(where) : 'A client');
+    asking = `<p><strong>${who}</strong> is asking to use your account`
+      + `${where ? `, and will be sent back to <code>${escapeHtml(where)}</code>` : ''}.</p>`;
+  }
+  res.writeHead(200, { 'content-type': 'text/html; charset=utf-8', 'cache-control': 'no-cache' });
+  res.end(`<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">
+<title>Sign in with your pod</title>
+<style>:root{color-scheme:light dark;--heading:#1a4f8a;--btn:#3d6b35;--line:#9a9a9a}
+body{font:20px Arial,Helvetica,sans-serif;max-width:28rem;margin:12vh auto;padding:0 1rem}
+h1{color:var(--heading);font-size:1.5rem}
+code{word-break:break-all;background:rgba(120,120,120,.12);padding:.05em .35em;border-radius:4px}
+button{font:inherit;padding:.6rem 1.1rem;background:var(--btn);color:#fff;border:none;border-radius:9px;cursor:pointer}
+button[hidden]{display:none}
+#signin-status{min-height:1.5em;padding:.6rem .8rem;border:1px solid var(--line);border-radius:8px;margin-top:1rem}
+@media (prefers-color-scheme:dark){:root{--heading:#7fb3e8;--btn:#5a8a4f}}</style></head><body>
+<main>
+<h1>Sign in with your pod</h1>
+${asking}
+<p>This account belongs to <a id="webid" href="${escapeHtml(webId)}">${escapeHtml(webId)}</a>. Sign in at that pod to allow it.</p>
+<p><button type="button" id="signin" hidden>Sign in with your pod</button></p>
+<p id="signin-status" role="status" aria-live="polite"></p>
+</main>
+<script type="module" src="${escapeHtml(mount)}/oauth/session/signin.mjs"></script>
+</body></html>`);
+  return true;
+}
 function sendLoginForm(res, params, error = '', client = null, status = null, headers = {}) {
   const hidden = [...params.entries()].filter(([k]) => k !== 'password')
     .map(([k, v]) => `<input type="hidden" name="${escapeHtml(k)}" value="${escapeHtml(v)}">`).join('\n');
@@ -378,6 +414,21 @@ export async function handle(api, ctx) {
     let body = null;
     if (req.method === 'POST') { body = await readBody(req); params = new URLSearchParams(body); }
     const redirect = params.get('redirect_uri') || '';
+    // The owner's pod sign-in, proved: a Solid-OIDC token with its DPoP proof,
+    // from the WebID this account belongs to. It stands in for the password
+    // everywhere below.
+    let proved = false;
+    if (req.method === 'POST' && req.headers.authorization && req.headers.dpop && api.podAuth) {
+      const proof = await api.podAuth(req, pathname);
+      if (!proof.ok) return send(proof.status || 401, { error: proof.error });
+      proved = true;
+    }
+    const ownerWebId = api.ownerWebId?.() || null;
+    // The way back from the pod's login: no client named, only the pod's
+    // code. The page finishes the sign-in and returns to the client's request.
+    if (req.method === 'GET' && !params.get('client_id') && params.get('code') && params.get('state') && ownerWebId) {
+      return sendPodSigninPage(res, null, ownerWebId, api.mount || '');
+    }
     const app = api.findApp(params.get('client_id') || '');
     // A client that published its own metadata document needs no
     // registration here: the document is its name and says where it may be
@@ -419,14 +470,16 @@ export async function handle(api, ctx) {
     //    port is the owner" is a statement about the machine rather than
     //    about a web page. Anything pointing elsewhere has to be approved by
     //    somebody who knows the password.
-    if (external && !api.store.getConfig()?.uiPassword && !api.redirectAllowed(redirect)) {
+    const client = { name: app?.name || doc?.name || null, redirect, scope: params.get('scope') || 'read' };
+    if (external && !proved && !api.store.getConfig()?.uiPassword && !api.redirectAllowed(redirect)) {
+      // With a pod to sign in at, the owner approves the client there.
+      if (req.method === 'GET' && ownerWebId) return sendPodSigninPage(res, client, ownerWebId, api.mount || '');
       api.log(`authorize refused: no UI password, and "${redirect}" is not an address of this agent`);
       return send(403, {
         error: 'this client asks to be sent somewhere other than this agent, and no password is '
           + 'set to approve that with. Run `fedipod passwd` and try again.',
       });
     }
-    const client = { name: app?.name || doc?.name || null, redirect, scope: params.get('scope') || 'read' };
     if (app) {
       if (!app.redirectUris.includes(redirect)) {
         api.log(`authorize refused: redirect_uri "${redirect}" not registered for ${app.clientId}`);
@@ -448,7 +501,7 @@ export async function handle(api, ctx) {
       api.log(`authorize refused: redirect_uri "${redirect}" is not this agent`);
       return send(400, { error: 'redirect_uri must be an address of this agent' });
     }
-    if (req.method === 'POST') {
+    if (req.method === 'POST' && !proved) {
       if (api.rateLimited()) {
         api.log('authorize rate limited');
         // 429, not 401: a client that reads this as a wrong password will
@@ -460,11 +513,13 @@ export async function handle(api, ctx) {
       if (!pw || !checkPassword(pw, body.password || '')) {
         return sendLoginForm(res, params, 'wrong password — try again', client);
       }
-    } else if (pw) {
+    } else if (pw && !proved) {
       // The login/approve screen names what is asking before the owner types
       // the password — a cross-site client cannot forge past that.
       return sendLoginForm(res, params, '', client);
-    } else if (api.allowed && !api.allowed.isLocalRequest(req)) {
+    } else if (!proved && api.allowed && !api.allowed.isLocalRequest(req) && !api.throughDoor?.(req)) {
+      // With a pod to sign in at, the owner does that instead of a password.
+      if (req.method === 'GET' && ownerWebId) return sendPodSigninPage(res, client, ownerWebId, api.mount || '');
       // No password set, and this request did not come from this machine.
       //
       // The instant-authorize path is honest theatre on loopback: whoever can
@@ -477,10 +532,9 @@ export async function handle(api, ctx) {
       // dispatched before that check ever runs, so it needs its own.
       api.log(`authorize refused: no UI password, and "${req.headers.host}" is not this machine`);
       return send(403, {
-        error: 'this agent answers on an address outside this machine and has no password set — '
-          + (api.embedded
-            ? 'POST {"password":"…"} to the owner door\'s /config with its door secret before logging in'
-            : 'run `fedipod passwd` before logging in over that address'),
+        error: api.embedded
+          ? 'Open your account\'s management page first, then sign in from there.'
+          : 'Signing in from another machine needs a password. On the machine that runs your account, run: fedipod passwd',
       });
     }
     // External clients get a bound code; the local flow keeps code==token.
@@ -493,6 +547,9 @@ export async function handle(api, ctx) {
     const target = new URL(redirect);
     target.searchParams.set('code', code);
     if (params.get('state')) target.searchParams.set('state', params.get('state'));
+    // A proved sign-in came from the page's own request, which cannot follow
+    // a redirect to a client's address; the page is told where to go.
+    if (proved) return send(200, { redirect: target.href });
     res.writeHead(302, { location: target.href });
     res.end();
     return true;

package/lib/device/admin/surface.mjs CHANGED Viewed

@@ -6,6 +6,8 @@
 // served off disk, and the dispatch to the routes modules beside it. Each of
 // those exports get() and post() over the same ctx.
+import fs from 'node:fs';
+import path from 'node:path';
 import { MastoApi } from '../../client/masto/index.mjs';
 import { C2S } from '../../client/c2s.mjs';
 import { makeC2sAuth } from '../../client/oidc-auth.mjs';
@@ -75,12 +77,23 @@ const ROUTES = [owner, setup, lifecycle, gateway, social, connections];
 // meaning inside a server that is not one — and moves the gate: a pod that is
 // a fediverse instance must let strangers reach /api and /oauth, so the gate
 // guards the operator's door (basePath) instead of the whole surface.
+const SESSION_FILES = {
+  '/oauth/session/signin.mjs': 'web/admin/oauth-signin.mjs',
+  '/oauth/session/fedi-login.mjs': 'lib/session/fedi-login.mjs',
+  '/oauth/session/oidc-session.mjs': 'lib/session/oidc-session.mjs',
+};
 export function buildAdminSurface({ agent, gate, allowed, log = console.log,
   port = null, handle = null, embedded = false, basePath = '/', mount = '',
   publicOrigin = null, scheme = null,
   versionOnDisk = () => localVersion(projectRoot) }) {
   const json = (res, status, obj) => sendJson(res, status, obj, allowed);
-  const masto = new MastoApi({ agent, log, allowed, scheme, embedded, mount });
+  const masto = new MastoApi({ agent, log, allowed, scheme, embedded, mount,
+    throughDoor: (req) => Boolean(gate?.upgradeOk?.(req)) });
+  // A client's sign-in can be proved with the owner's pod sign-in instead of a
+  // password: the same verification the post door uses, and the owner it names.
+  masto.podAuth = makeC2sAuth({ agent, log, scheme, mount });
+  masto.ownerWebId = () => agent.remote?.webId || null;
   // The spec's own write API (§6), beside the facade. Its bearer fallback is
   // the facade's token, so the two surfaces share one notion of the operator.
   const c2s = new C2S({ agent, log, scheme, mount,
@@ -172,6 +185,16 @@ export function buildAdminSurface({ agent, gate, allowed, log = console.log,
       if (p === '/ap/outbox' || p === '/ap/actor' || p === '/ap/inbox') {
         if (await c2s.handle(req, res, p, url)) return;
       }
+      // The sign-in page's script and the library it signs in with, outside
+      // the door like the sign-in itself. A fixed list; nothing in the request
+      // names a file.
+      const sessionFile = SESSION_FILES[p];
+      if (sessionFile) {
+        let body;
+        try { body = fs.readFileSync(path.join(projectRoot, sessionFile)); } catch { return json(res, 404, { error: 'not here' }); }
+        res.writeHead(200, { 'content-type': 'text/javascript; charset=utf-8', 'cache-control': 'no-cache' });
+        res.end(body); return;
+      }
       // Where a client looks first to find out how to sign in (RFC 8414), and
       // in front of the door for the same reason C2S is: a client that has to
       // be handed a secret before it can ask how to sign in cannot set itself

package/lib/device/certs.mjs CHANGED Viewed

@@ -71,7 +71,16 @@ function nameConstraintsExtension() {
   return { id: '2.5.29.30', critical: true, value: der.getBytes() };
 }
-function makeCert({ subjectCN, issuer = null, issuerKeyPem = null, isCA = false, days, extraDns = [] }) {
+// The issuer's own key identifier, for the certificate it signs to name. A
+// verifier that finds several CAs under one name — this machine's browser
+// store has held dozens of "FediPod Local CA" from scratch agents — picks by
+// this, and without it picks by name, tries the wrong key and fails.
+const issuerKeyId = (issuerCertPem) => {
+  const ext = forge.pki.certificateFromPem(issuerCertPem).getExtension('subjectKeyIdentifier');
+  return ext?.subjectKeyIdentifier ? forge.util.hexToBytes(ext.subjectKeyIdentifier) : null;
+};
+function makeCert({ subjectCN, issuer = null, issuerKeyPem = null, issuerCertPem = null, isCA = false, days, extraDns = [] }) {
   const keys = forge.pki.rsa.generateKeyPair({ bits: 2048 });
   const cert = forge.pki.createCertificate();
   cert.publicKey = keys.publicKey;
@@ -89,6 +98,9 @@ function makeCert({ subjectCN, issuer = null, issuerKeyPem = null, isCA = false,
     : [{ name: 'basicConstraints', cA: false },
        { name: 'keyUsage', digitalSignature: true, keyEncipherment: true },
        { name: 'extKeyUsage', serverAuth: true },
+       { name: 'subjectKeyIdentifier' },
+       ...(issuerCertPem && issuerKeyId(issuerCertPem)
+         ? [{ name: 'authorityKeyIdentifier', keyIdentifier: issuerKeyId(issuerCertPem) }] : []),
        { name: 'subjectAltName',
          altNames: [...SANS, ...extraDns.map(v => ({ type: 2, value: v }))] }]);
   const signingKey = issuerKeyPem ? forge.pki.privateKeyFromPem(issuerKeyPem) : keys.privateKey;
@@ -131,6 +143,7 @@ export function ensureLocalTls(dir, { log = () => {}, names = [] } = {}) {
   const trust = !!(caKey && caCert);
   const isStale = (k, c) => !k || !c || daysLeft(c) < REMINT_DAYS || !coversLocalhost(c)
     || (trust && !issuedBy(c, caCert))
+    || (trust && !namesIssuerKey(c))
     || names.some(n => !certDnsNames(c).includes(n));
   let key = readPem(dir, FILES.key);
   let cert = readPem(dir, FILES.cert);
@@ -165,7 +178,7 @@ export function ensureLocalTls(dir, { log = () => {}, names = [] } = {}) {
         .filter(n => n !== 'localhost' && n !== '*.localhost');
       const minted = makeCert({
         subjectCN: 'localhost',
-        ...(trust ? { issuer: caSubject(caCert), issuerKeyPem: caKey } : {}),
+        ...(trust ? { issuer: caSubject(caCert), issuerKeyPem: caKey, issuerCertPem: caCert } : {}),
         days: LEAF_DAYS,
         extraDns: carried,
       });
@@ -181,6 +194,9 @@ export function ensureLocalTls(dir, { log = () => {}, names = [] } = {}) {
   return { key, cert, trust, dir, expiresInDays: Math.floor(daysLeft(cert)) };
 }
+const namesIssuerKey = (certPem) => {
+  try { return !!forge.pki.certificateFromPem(certPem).getExtension('authorityKeyIdentifier'); } catch { return false; }
+};
 const caSubject = (caCertPem) => forge.pki.certificateFromPem(caCertPem).subject.attributes
   .map(a => ({ name: a.name, value: a.value }));
 const issuedBy = (certPem, caCertPem) => {

package/lib/gateway/front-core.mjs CHANGED Viewed

@@ -221,11 +221,22 @@ function parseUserPath(pathname) {
 // `netlify-cdn-cache-control` is the edge's own instruction; `cache-control`
 // is what the reader's browser is told. The edge may serve a stale copy while
 // it fetches a fresh one, so nobody waits on the pod for a document that is
-// merely a minute old.
+// merely minutes old. The edge holds a document far longer than a browser
+// is asked to: the edge is what turns a thousand readers into one function
+// call, while a browser that held an actor for ten minutes would show one
+// person a stale profile they had just edited.
+const BROWSER_MAX_AGE = 60;
 const publicFor = (seconds, stale = seconds * 4) => ({
-  'cache-control': `public, max-age=${seconds}`,
+  'cache-control': `public, max-age=${Math.min(seconds, BROWSER_MAX_AGE)}`,
   'netlify-cdn-cache-control': `public, s-maxage=${seconds}, stale-while-revalidate=${stale}`,
 });
+// How long the edge holds a public document, and a handle's WebFinger
+// answer. Every server that has heard of an account asks for its actor and
+// its handle again and again; a post or a collection changes when its owner
+// acts, and ten minutes of edge is what the plan's budget of function calls
+// can afford.
+const PUBLIC_EDGE_SECONDS = 600;
+const WEBFINGER_EDGE_SECONDS = 3600;
 // Where a pod owner opts their identity in. An operator may name it, because
 // the path it takes is one their pod server can no longer serve; the dot says
@@ -382,7 +393,7 @@ async function route(request, ctx) {
   if (pathname === runPath(ctx)) {
     if (request.method !== 'GET' && request.method !== 'HEAD') return { status: 405, headers: {}, body: '' };
     if (!ctx.runPage) return notFound();
-    return { status: 200, headers: { 'content-type': 'text/html; charset=utf-8' }, body: ctx.runPage };
+    return { status: 200, headers: { 'content-type': 'text/html; charset=utf-8', 'cache-control': 'no-cache' }, body: ctx.runPage };
   }
   // The roster page: the host reading who has accounts here. The page signs in
@@ -609,6 +620,28 @@ async function route(request, ctx) {
     return j(200, { results });
   }
+  // Who is here, and which pod of theirs could opt in. The opt-in page asks
+  // this first: on a pod server that issued the reader's session, the answer
+  // names their pod and its address, and the page shows one button instead of
+  // a form. A Gateway holds no such session and says so; the page then asks
+  // for the pod by hand and proves it with a sign-in, as before.
+  if (pathname === '/api/agent' && request.method === 'GET') {
+    if (!ctx.agentControl) return j(501, { error: 'this server does not run identities' });
+    if (!ctx.webIdsFromSession) return j(200, { offered: true, session: 'unknown' });
+    if (!sameOriginRequest(request, ctx.frontOrigin)) return j(200, { offered: true, session: 'none' });
+    const webIds = await ctx.webIdsFromSession(request).catch(() => []);
+    if (!webIds.length) return j(200, { offered: true, session: 'none', loginUrl: '/.account/login/password/' });
+    const pods = [];
+    for (const webId of webIds) {
+      let podBase;
+      try { podBase = podBaseOfWebId(webId); } catch { continue; }
+      let about = null;
+      try { about = ctx.agentControl.describe ? await ctx.agentControl.describe({ podBase }) : null; } catch { about = null; }
+      pods.push({ webId, podBase, ...(about || {}) });
+    }
+    return j(200, { offered: true, session: 'ok', pods });
+  }
   // Runtime opt-in: a pod owner asks the server this front sits on to RUN
   // their identity. Same proof as attach — a Solid-OIDC token — but the
   // ownership check is stricter: the WebID must live UNDER the pod base, not
@@ -691,7 +724,9 @@ async function route(request, ctx) {
   if (mPageScript) {
     const body = ctx.pageScripts?.[`${mPageScript[1]}.js`];
     if (!body) return notFound();
-    return { status: 200, headers: { 'content-type': 'text/javascript; charset=utf-8' }, body };
+    // Revalidated on every load: a page served fresh with a script the
+    // browser kept from last time is the mismatch nobody can see.
+    return { status: 200, headers: { 'content-type': 'text/javascript; charset=utf-8', 'cache-control': 'no-cache' }, body };
   }
   // The vendored Solid-OIDC browser library the opt-in and admin pages load —
@@ -727,7 +762,7 @@ async function route(request, ctx) {
     // A handle answers the same for everybody, and changes only when a row
     // does. Every server that has heard of this account asks for it; the edge
     // can answer most of them.
-    Object.assign(out.headers, publicFor(300));
+    Object.assign(out.headers, publicFor(WEBFINGER_EDGE_SECONDS));
     return out;
   }
@@ -856,7 +891,7 @@ async function route(request, ctx) {
   // `readPublicDocument` asked for it with no credential, so a document that
   // came back is one anybody can read — which is what makes it cacheable.
   return { status: 200,
-    headers: { ...open, 'content-type': got.type || (container ? 'text/turtle' : page ? 'text/html' : AP_CT), ...publicFor(30) },
+    headers: { ...open, 'content-type': got.type || (container ? 'text/turtle' : page ? 'text/html' : AP_CT), ...publicFor(PUBLIC_EDGE_SECONDS) },
     body: text };
 }

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "fedipod",
-  "version": "1.26.1",
+  "version": "1.27.1",
   "description": "Standalone single-actor ActivityPub agent whose wire face, RDF truth and state all live on a Solid pod (CSS). Bundles a Phanpy UI and a Mastodon client-API facade.",
   "type": "module",
   "license": "MIT",

package/vendor/gate.cjs CHANGED Viewed

@@ -7,8 +7,11 @@
 // authorized when it carries the secret:
 //   1. header `x-dk-token` — the Electron shell injects this on app traffic, or
 //   2. cookie `dk-token` — a browser "blessed" via the token URL, or
-//   3. query `?dk-token=<secret>` — answered with a SameSite=Strict cookie and
-//      a redirect to the same URL minus the param (the blessing flow), or
+//   3. query `?dk-token=<secret>` — answered with a SameSite=Lax cookie and
+//      a redirect to the same URL minus the param (the blessing flow). Lax,
+//      not Strict: a link from another site — the pod server's own opt-in
+//      page among them — must arrive with the cookie it was just handed, and
+//      Lax still withholds it from cross-site POSTs and subresources; or
 //   4. (opt-in, proxy only) an Origin/Referer on the allowOrigins list — app
 //      pages in a blessed browser call the proxy with plain fetch(), which
 //      doesn't attach cookies cross-port; a hostile page can't forge Origin.
@@ -105,7 +108,7 @@ function makeGate(token, { allowOrigins = [], publicEndpoints = false, secureCoo
         // Path scopes the cookie to this identity's own door: on a shared
         // origin (suffix pods) two co-tenants must not clobber each other's,
         // and a whole-origin cookie would. Defaults to '/'.
-        'set-cookie': `${COOKIE}=${t}; Path=${cookiePath}; HttpOnly; SameSite=Strict; Max-Age=31536000`
+        'set-cookie': `${COOKIE}=${t}; Path=${cookiePath}; HttpOnly; SameSite=Lax; Max-Age=31536000`
           + (secureCookie ? '; Secure' : ''),
         'location': url.pathname + url.search,
       });

package/web/admin/oauth-signin.mjs ADDED Viewed

@@ -0,0 +1,37 @@
+// oauth-signin.mjs — a client asked this account to sign its owner in. The
+// owner signs in at their own pod, with the fediverse-account library, and the
+// page proves that sign-in to the account with one signed request; the account
+// then hands the client its code. No password of ours anywhere.
+import { fediLogin } from './fedi-login.mjs';
+const $ = (id) => document.getElementById(id);
+const say = (text, error = false) => { const s = $('signin-status'); s.textContent = text; s.setAttribute('role', error ? 'alert' : 'status'); };
+const webId = $('webid').href;
+const here = location.origin + location.pathname;
+const login = fediLogin({ dbName: 'fedipod-signin', clientName: 'FediPod sign-in', redirectUri: here });
+// Back from the pod: this finishes the sign-in and returns to the client's
+// request, which carries the client's own parameters.
+try { await login.resume(); } catch (e) { say(e.message, true); }
+async function prove() {
+  const s = await login.getSession();
+  if (!s) return false;
+  if (s.webId !== webId) { say(`You signed in as ${s.webId}, but this account belongs to ${webId}. Sign out there and sign in as the owner.`, true); return true; }
+  say('Signing you in…');
+  const res = await s.fetch(here, {
+    method: 'POST', headers: { 'content-type': 'application/x-www-form-urlencoded' },
+    body: location.search.replace(/^\?/u, ''),
+  });
+  const d = await res.json().catch(() => ({}));
+  if (res.ok && d.redirect) { location.href = d.redirect; return true; }
+  if (res.ok && d.code) { say(`Your authorization code: ${d.code}`); return true; }
+  say(d.error || `The account refused the sign-in (HTTP ${res.status}).`, true);
+  return true;
+}
+if (location.search.includes('client_id=') && !(await prove())) $('signin').hidden = false;
+$('signin').addEventListener('click', async () => {
+  say('Taking you to your pod…');
+  try { await login.login(webId, { returnTo: location.href, redirectUri: here }); } catch (e) { say(e.message, true); }
+});

package/web/app/site/admin/client/index.html CHANGED Viewed

@@ -19,8 +19,8 @@ main { flex: 1 1 auto; min-height: 0; display: flex; }
 </style>
 <link rel="stylesheet" href="../bar.css">
 <style>#actor-pick{display:none!important}</style>
-<meta name="fedipod-version" content="1.26.1">
-<meta name="fedipod-build" content="a59138536e01">
+<meta name="fedipod-version" content="1.27.1">
+<meta name="fedipod-build" content="709aafeeaee1">
 <script src="/update.js" defer></script>
 <script src="/admin/client-pick.js"></script>
 </head>

package/web/app/site/admin/client-phanpy/index.html CHANGED Viewed

@@ -19,8 +19,8 @@ main { flex: 1 1 auto; min-height: 0; display: flex; }
 </style>
 <link rel="stylesheet" href="../bar.css">
 <style>#actor-pick{display:none!important}</style>
-<meta name="fedipod-version" content="1.26.1">
-<meta name="fedipod-build" content="a59138536e01">
+<meta name="fedipod-version" content="1.27.1">
+<meta name="fedipod-build" content="709aafeeaee1">
 <script src="/update.js" defer></script>
 <script src="/admin/client-pick.js"></script>
 </head>

package/web/app/site/admin/index.html CHANGED Viewed

@@ -168,8 +168,8 @@ pre { overflow-x: auto; background: #0001; padding: .6rem; border-radius: .3rem;
 <link rel="stylesheet" href="bar.css?v=3">
 <link rel="stylesheet" href="window.css">
 <style>#gw-shape-front,#do-drain,#do-log,#actor-pick{display:none!important}</style>
-<meta name="fedipod-version" content="1.26.1">
-<meta name="fedipod-build" content="a59138536e01">
+<meta name="fedipod-version" content="1.27.1">
+<meta name="fedipod-build" content="709aafeeaee1">
 <script src="/update.js" defer></script>
 <script src="/admin/client-pick.js"></script>
 </head>

package/web/app/site/admin/oauth-signin.mjs ADDED Viewed

@@ -0,0 +1,37 @@
+// oauth-signin.mjs — a client asked this account to sign its owner in. The
+// owner signs in at their own pod, with the fediverse-account library, and the
+// page proves that sign-in to the account with one signed request; the account
+// then hands the client its code. No password of ours anywhere.
+import { fediLogin } from './fedi-login.mjs';
+const $ = (id) => document.getElementById(id);
+const say = (text, error = false) => { const s = $('signin-status'); s.textContent = text; s.setAttribute('role', error ? 'alert' : 'status'); };
+const webId = $('webid').href;
+const here = location.origin + location.pathname;
+const login = fediLogin({ dbName: 'fedipod-signin', clientName: 'FediPod sign-in', redirectUri: here });
+// Back from the pod: this finishes the sign-in and returns to the client's
+// request, which carries the client's own parameters.
+try { await login.resume(); } catch (e) { say(e.message, true); }
+async function prove() {
+  const s = await login.getSession();
+  if (!s) return false;
+  if (s.webId !== webId) { say(`You signed in as ${s.webId}, but this account belongs to ${webId}. Sign out there and sign in as the owner.`, true); return true; }
+  say('Signing you in…');
+  const res = await s.fetch(here, {
+    method: 'POST', headers: { 'content-type': 'application/x-www-form-urlencoded' },
+    body: location.search.replace(/^\?/u, ''),
+  });
+  const d = await res.json().catch(() => ({}));
+  if (res.ok && d.redirect) { location.href = d.redirect; return true; }
+  if (res.ok && d.code) { say(`Your authorization code: ${d.code}`); return true; }
+  say(d.error || `The account refused the sign-in (HTTP ${res.status}).`, true);
+  return true;
+}
+if (location.search.includes('client_id=') && !(await prove())) $('signin').hidden = false;
+$('signin').addEventListener('click', async () => {
+  say('Taking you to your pod…');
+  try { await login.login(webId, { returnTo: location.href, redirectUri: here }); } catch (e) { say(e.message, true); }
+});

package/web/app/site/admin/setup/index.html CHANGED Viewed

@@ -54,8 +54,8 @@ button:disabled { opacity: .5; cursor: default; }
 </style>
 <link rel="stylesheet" href="../bar.css">
 <style>#actor-pick{display:none!important}</style>
-<meta name="fedipod-version" content="1.26.1">
-<meta name="fedipod-build" content="a59138536e01">
+<meta name="fedipod-version" content="1.27.1">
+<meta name="fedipod-build" content="709aafeeaee1">
 <script src="/update.js" defer></script>
 </head>
 <body>

package/web/app/site/app/compose/index.html CHANGED Viewed

@@ -12,8 +12,8 @@
     <link rel="modulepreload" crossorigin href="../assets/chunk-aKtaBQYM.js">
     <link rel="modulepreload" crossorigin href="../assets/pwa-viewport-ogKbF51K.js">
-  <link rel="manifest" href="./manifest.webmanifest"><meta name="fedipod-version" content="1.26.1">
-<meta name="fedipod-build" content="a59138536e01">
+  <link rel="manifest" href="./manifest.webmanifest"><meta name="fedipod-version" content="1.27.1">
+<meta name="fedipod-build" content="709aafeeaee1">
 <script src="/update.js" defer></script>
 </head>
   <body>

package/web/app/site/app/index.html CHANGED Viewed

@@ -65,8 +65,8 @@
     <link rel="modulepreload" crossorigin href="./assets/ICONS-DIPJeU0C.js">
     <link rel="modulepreload" crossorigin href="./assets/ScheduledAtField-D-Abfo4J.js">
-  <link rel="manifest" href="./manifest.webmanifest"><meta name="fedipod-version" content="1.26.1">
-<meta name="fedipod-build" content="a59138536e01">
+  <link rel="manifest" href="./manifest.webmanifest"><meta name="fedipod-version" content="1.27.1">
+<meta name="fedipod-build" content="709aafeeaee1">
 <script src="/update.js" defer></script>
 </head>
   <body>

package/web/app/site/authorize_interaction.html CHANGED Viewed

@@ -35,8 +35,8 @@
   .hint { color: var(--sub); }
 </style>
 <script src="/authorize_interaction.js" defer></script>
-<meta name="fedipod-version" content="1.26.1">
-<meta name="fedipod-build" content="a59138536e01">
+<meta name="fedipod-version" content="1.27.1">
+<meta name="fedipod-build" content="709aafeeaee1">
 <script src="/update.js" defer></script>
 </head>
 <body>

package/web/app/site/bb/index.html CHANGED Viewed

@@ -211,8 +211,8 @@
   /* At the foot of the page, centred, clear of whatever is above it. */
   footer.foot { margin: 1rem auto 0; color: var(--sub); font-size: 16px; text-align: center; }
 </style>
-<meta name="fedipod-version" content="1.26.1">
-<meta name="fedipod-build" content="a59138536e01">
+<meta name="fedipod-version" content="1.27.1">
+<meta name="fedipod-build" content="709aafeeaee1">
 <script src="/update.js" defer></script>
 </head>
 <body>

package/web/app/site/build.json CHANGED Viewed

	@@ -1 +1 @@
1	- {"build":"~~a59138536e01~~","version":"1.26.1","at":"2026-09-~~20T18~~:26:18.~~671Z~~"}
1	+ {"build":"709aafeeaee1","version":"1.27.1","at":"2026-09-21T23:13:33.708Z"}

package/web/app/site/index.html CHANGED Viewed

@@ -72,8 +72,8 @@ button:disabled { opacity: .55; cursor: default; }
 a { color: var(--accent); }
 [hidden] { display: none !important; }
 </style>
-<meta name="fedipod-version" content="1.26.1">
-<meta name="fedipod-build" content="a59138536e01">
+<meta name="fedipod-version" content="1.27.1">
+<meta name="fedipod-build" content="709aafeeaee1">
 <script src="/update.js" defer></script>
 </head>
 <body>

package/web/front/admin.html CHANGED Viewed

@@ -49,6 +49,5 @@ accounts that only use it as their gateway. Sign in as the server's admin to see
 </table>
 <script type="module" src="/admin.js"></script>
-<i>(cc) 4.0 By, Jeff Zucker, 2026</i>
 </body>
 </html>

package/web/front/new-account.html CHANGED Viewed

@@ -31,6 +31,5 @@ FediPod is experimental and free to use.  See the <a href="https://github.com/je
 </p>
 <script src="/new-account.js"></script>
-<i style="text-align:right">(cc) 4.0 By, Jeff Zucker, 2026</i>
 </body>
 </html>

package/web/front/run.html CHANGED Viewed

@@ -3,7 +3,7 @@
 <head>
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1">
-<title>FediPod — run your identity on this server</title>
+<title>FediPod — turn your pod into a Fediverse account</title>
 <link rel="icon" href="/icons/gateway.svg" type="image/svg+xml">
 <style>
   :root { color-scheme: light dark; --line:#d9d4c7; --dim:#45443d; --accent:#6a8a5a; }
@@ -15,20 +15,27 @@
   input[type=text], input[type=url] { width: 100%; padding: .5rem .6rem; font: inherit;
     border: 1px solid var(--line); border-radius: 8px; box-sizing: border-box; }
   .hint { color: var(--dim); font-size: .95rem; }
+  .pod { border: 1px solid var(--line); border-radius: 9px; padding: .9rem 1.1rem; margin: .8rem 0; }
+  .pod p { margin: .3rem 0; }
+  .pod .actions { margin-top: .8rem; }
   .primary { background: var(--accent); color: #fff; border: none; border-radius: 9px;
     padding: .6rem 1.1rem; font: inherit; cursor: pointer; }
   button { font: inherit; }
   .primary[disabled], button[disabled] { opacity: .5; cursor: not-allowed; }
   [hidden] { display: none !important; }
   code { background: rgba(120,120,120,.12); padding: .05em .35em; border-radius: 4px; }
+  .pod code { background: #fff3c4; color: #1a1a1a; font-size: 16px; }
+  @media (prefers-color-scheme: dark) { .pod code { background: #5a4a00; color: #fff; } }
   pre { background: rgba(120,120,120,.12); padding: .7rem .9rem; border-radius: 8px; overflow-x: auto; }
 </style>
 </head>
 <body>
-<h1>Run your identity on this server</h1>
-<p class="lede">If your pod is hosted by this server, the server can run your Fediverse identity
-for you: it accepts follows, delivers your posts and serves your Mastodon app, with nothing for
-you to keep running. Sign in with your pod to prove it is yours.</p>
+<h1>Turn your pod into a Fediverse account</h1>
+<p class="lede">Users with pods on this server may opt-in below to create a Fediverse account
+that stores your data on your pod. You'll be able to interact with Mastodon and users of other
+Fediverse services straight from your pod.</p>
+<section id="run-known" hidden aria-live="polite"></section>
 <form id="run-form">
   <p class="field">
@@ -43,10 +50,9 @@ you to keep running. Sign in with your pod to prove it is yours.</p>
     <button type="button" id="run-continue" class="primary" disabled>Sign in with your pod &amp; opt in</button>
     <button type="button" id="run-leave">Stop running it here</button>
   </p>
-  <p class="hint" id="run-note" hidden></p>
 </form>
+<p class="hint" id="run-note" hidden></p>
 <script type="module" src="/run.js"></script>
-<i>(cc) 4.0 By, Jeff Zucker, 2026</i>
 </body>
 </html>

package/web/front/run.js CHANGED Viewed

@@ -23,22 +23,80 @@ try {
   session = new SessionCore({ redirect_uris: [HERE], client_name: 'FediPod gateway' });
 } catch { /* leave null — the "did not load" notes below fire */ }
-// Offered only where this server actually runs identities. An
-// unauthenticated probe tells the two apart: 501 = not offered here,
-// anything else = offered (a real opt-in still needs the signed-in proof).
+// What this server knows before anything is typed. 501: it runs no
+// identities. A pod server that issued the reader's session names their pod
+// and its address, and the page shows one button per pod. Not signed in
+// there: one button, to its login. A Gateway knows nothing: the form below.
 let offered = true;
+const say = (tag, text) => { const e = document.createElement(tag); e.textContent = text; return e; };
 (async () => {
-  const res = await fetch('/api/agent', { method: 'POST',
-    headers: { 'content-type': 'application/json' }, body: '{}' }).catch(() => null);
+  const res = await fetch('/api/agent', { credentials: 'same-origin', headers: { accept: 'application/json' } }).catch(() => null);
+  const d = res && res.ok ? await res.json().catch(() => ({})) : {};
+  const n = $('run-note');
   if (!res || res.status === 501) {
     offered = false;
-    const n = $('run-note');
     n.hidden = false;
     n.textContent = 'This server does not run identities. Your agent stays where it is.';
+  } else if (d.session === 'none') {
+    $('run-form').hidden = true;
+    showSignIn(d.loginUrl);
+  } else if (d.session === 'ok' && Array.isArray(d.pods) && d.pods.length) {
+    $('run-form').hidden = true;
+    showPods(d.pods);
   }
   runFormCheck();
 })();
+async function refreshKnown() {
+  const res = await fetch('/api/agent', { credentials: 'same-origin', headers: { accept: 'application/json' } }).catch(() => null);
+  const d = res && res.ok ? await res.json().catch(() => ({})) : {};
+  if (d.session === 'ok' && Array.isArray(d.pods) && d.pods.length) showPods(d.pods);
+}
+function showSignIn(loginUrl) {
+  const k = $('run-known');
+  k.hidden = false;
+  k.replaceChildren();
+  k.append(say('p', 'You are not signed in at this server.'));
+  if (loginUrl) {
+    const go = say('button', 'Sign in');
+    go.type = 'button'; go.className = 'primary';
+    go.onclick = () => { location.href = loginUrl; };
+    const p = document.createElement('p'); p.className = 'actions'; p.append(go);
+    k.append(p, say('p', 'Sign in, then come back to this page.'));
+    k.lastChild.className = 'hint';
+  }
+}
+function showPods(pods) {
+  const k = $('run-known');
+  k.hidden = false;
+  k.replaceChildren();
+  for (const pod of pods) {
+    const box = document.createElement('div'); box.className = 'pod';
+    // The names stand out from the sentences around them.
+    const line = (before, id, after = '.') => { const p = say('p', before); p.append(say('code', id), after); return p; };
+    box.append(line('Solid Identity (WebID): ', pod.webId, ''));
+    const actions = document.createElement('p'); actions.className = 'actions';
+    box.append(line('Fediverse Identity: ', pod.address, ''));
+    if (pod.running) {
+      const links = say('p', 'Manage your account: ');
+      const m = say('a', pod.manage.split('?')[0]); m.href = pod.manage;
+      links.append(m);
+      box.append(links);
+      const stop = say('button', 'Close this Fediverse account'); stop.type = 'button'; stop.className = 'primary';
+      stop.onclick = () => runStart('opt-out', pod.podBase);
+      actions.append(stop);
+    } else {
+      const go = say('button', 'Create a Fediverse account'); go.type = 'button'; go.className = 'primary';
+      go.onclick = () => runStart('opt-in', pod.podBase);
+      actions.append(go);
+    }
+    box.append(actions);
+    k.append(box);
+  }
+}
 function runFormCheck() {
   let ok = false;
   try { ok = /^https?:$/.test(new URL($('run-pod-url').value.trim()).protocol); } catch { /* not yet */ }
@@ -63,9 +121,9 @@ $('run-issuer').addEventListener('input', runFormCheck);
 // a filled-in form, with nothing to say why.
 runFormCheck();
-const runStart = async (action) => {
+const runStart = async (action, podBase = null) => {
   const n = $('run-note');
-  const u = new URL($('run-pod-url').value.trim());
+  const u = new URL(podBase || $('run-pod-url').value.trim());
   if (u.pathname === '') u.pathname = '/';
   if (!u.pathname.endsWith('/')) u.pathname += '/';
   u.search = ''; u.hash = '';
@@ -103,16 +161,14 @@ async function showReply(res, p) {
     // back from the server and one comes from sessionStorage, and pasting any
     // of them into innerHTML means whatever markup they contain is rendered.
     // Only the fixed wording is markup here; everything variable is text.
-    const say = (tag, text) => { const e = document.createElement(tag); e.textContent = text; return e; };
-    n.textContent = 'Your identity runs here now. This is your door secret — ';
-    n.append(say('b', 'save it now'));
-    n.append(', it is shown only this once. It opens your admin pages at ');
-    n.append(say('code', p.podBase.replace(/\/$/, '') + d.doorPath));
-    n.append(':', say('pre', d.doorSecret));
-    n.append('To check it works:', say('pre', d.command));
-    n.append('Lost it? Opt in again — that mints a fresh one and retires this one.');
+    const manage = `${p.podBase.replace(/\/$/, '')}${d.doorPath}?dk-token=${encodeURIComponent(d.doorSecret)}`;
+    n.textContent = 'Your Fediverse account is ready. Manage it at ';
+    const a = say('a', p.podBase.replace(/\/$/, '') + d.doorPath); a.href = manage;
+    n.append(a, '.');
+    refreshKnown();
   } else if (res && res.status === 200) {
-    n.textContent = 'Done — this server no longer runs that identity. Your pod and its data are untouched.';
+    n.textContent = 'Your Fediverse account is closed. Your pod and its data are untouched.';
+    refreshKnown();
   } else {
     n.textContent = (p.action === 'opt-in' ? 'opt-in' : 'opt-out') + ' failed: '
       + (d.error || (res ? 'HTTP ' + res.status : 'no response'));