npm - fedipod - Versions diffs - 1.26.1 → 1.27.3 - Mend

fedipod 1.26.1 → 1.27.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (29) hide show

package/lib/client/masto/index.mjs +4 -1
package/lib/client/masto/oauth.mjs +66 -9
package/lib/core/publisher/collections.mjs +6 -1
package/lib/core/publisher/index.mjs +1 -0
package/lib/device/admin/surface.mjs +24 -1
package/lib/device/certs.mjs +18 -2
package/lib/gateway/front-core.mjs +41 -6
package/package.json +1 -1
package/run-agent.mjs +14 -0
package/vendor/gate.cjs +6 -3
package/web/admin/oauth-signin.mjs +37 -0
package/web/app/dist/sw.js +58 -7
package/web/app/dist/sw.js.map +2 -2
package/web/app/site/admin/client/index.html +2 -2
package/web/app/site/admin/client-phanpy/index.html +2 -2
package/web/app/site/admin/index.html +2 -2
package/web/app/site/admin/oauth-signin.mjs +37 -0
package/web/app/site/admin/setup/index.html +2 -2
package/web/app/site/app/compose/index.html +2 -2
package/web/app/site/app/index.html +2 -2
package/web/app/site/authorize_interaction.html +2 -2
package/web/app/site/bb/index.html +2 -2
package/web/app/site/build.json +1 -1
package/web/app/site/index.html +2 -2
package/web/app/site/sw.js +58 -7
package/web/front/admin.html +0 -1
package/web/front/new-account.html +0 -1
package/web/front/run.html +13 -7
package/web/front/run.js +73 -17

package/lib/client/masto/index.mjs CHANGED Viewed

@@ -31,7 +31,7 @@ export { pollParams } from './body.mjs';
 export { attachmentType, extensionFor } from './media.mjs';
 export class MastoApi {
-  constructor({ agent, log = console.log, allowed = null, scheme = null, embedded = false,
+  constructor({ agent, log = console.log, allowed = null, scheme = null, embedded = false, throughDoor = null,
     mount = '', streaming = true, webPush = true, scheduling = true }) {
     this.agent = agent;
     // The path this identity's surface answers under, when it shares its origin
@@ -45,6 +45,9 @@ export class MastoApi {
     this.embedded = embedded;
     this.log = log;
     this.allowed = allowed;             // authorities a redirect_uri may name
+    // Whether a request already passed the owner's door (its key or cookie):
+    // an owner who opened the management page is the owner at the sign-in too.
+    this.throughDoor = throughDoor;
     // The scheme this identity is reached on, when the socket cannot say —
     // a server behind a TLS proxy terminates cleartext and still is https.
     this.scheme = scheme;

package/lib/client/masto/oauth.mjs CHANGED Viewed

@@ -42,6 +42,42 @@ const escapeHtml = (s) => String(s).replace(/[&<>"']/g, c =>
 const parseRedirects = (v) => (Array.isArray(v) ? v : String(v || '').split(/\s+/))
   .map(s => s.trim()).filter(Boolean);
+// The sign-in page for an account whose owner signs in at their pod: no
+// password of ours exists, and none is asked for. The page carries the
+// client's request in its address, signs the owner in at the pod with the
+// fediverse-account library, and proves that sign-in back to /oauth/authorize.
+function sendPodSigninPage(res, client, webId, mount = '') {
+  let asking = '';
+  if (client && (client.name || client.redirect)) {
+    let where = '';
+    try { where = client.redirect ? new URL(client.redirect).host : ''; } catch { /* oob or blank */ }
+    const who = client.name ? escapeHtml(client.name) : (where ? escapeHtml(where) : 'A client');
+    asking = `<p><strong>${who}</strong> is asking to use your account`
+      + `${where ? `, and will be sent back to <code>${escapeHtml(where)}</code>` : ''}.</p>`;
+  }
+  res.writeHead(200, { 'content-type': 'text/html; charset=utf-8', 'cache-control': 'no-cache' });
+  res.end(`<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">
+<title>Sign in with your pod</title>
+<style>:root{color-scheme:light dark;--heading:#1a4f8a;--btn:#3d6b35;--line:#9a9a9a}
+body{font:20px Arial,Helvetica,sans-serif;max-width:28rem;margin:12vh auto;padding:0 1rem}
+h1{color:var(--heading);font-size:1.5rem}
+code{word-break:break-all;background:rgba(120,120,120,.12);padding:.05em .35em;border-radius:4px}
+button{font:inherit;padding:.6rem 1.1rem;background:var(--btn);color:#fff;border:none;border-radius:9px;cursor:pointer}
+button[hidden]{display:none}
+#signin-status{min-height:1.5em;padding:.6rem .8rem;border:1px solid var(--line);border-radius:8px;margin-top:1rem}
+@media (prefers-color-scheme:dark){:root{--heading:#7fb3e8;--btn:#5a8a4f}}</style></head><body>
+<main>
+<h1>Sign in with your pod</h1>
+${asking}
+<p>This account belongs to <a id="webid" href="${escapeHtml(webId)}">${escapeHtml(webId)}</a>. Sign in at that pod to allow it.</p>
+<p><button type="button" id="signin" hidden>Sign in with your pod</button></p>
+<p id="signin-status" role="status" aria-live="polite"></p>
+</main>
+<script type="module" src="${escapeHtml(mount)}/oauth/session/signin.mjs"></script>
+</body></html>`);
+  return true;
+}
 function sendLoginForm(res, params, error = '', client = null, status = null, headers = {}) {
   const hidden = [...params.entries()].filter(([k]) => k !== 'password')
     .map(([k, v]) => `<input type="hidden" name="${escapeHtml(k)}" value="${escapeHtml(v)}">`).join('\n');
@@ -378,6 +414,21 @@ export async function handle(api, ctx) {
     let body = null;
     if (req.method === 'POST') { body = await readBody(req); params = new URLSearchParams(body); }
     const redirect = params.get('redirect_uri') || '';
+    // The owner's pod sign-in, proved: a Solid-OIDC token with its DPoP proof,
+    // from the WebID this account belongs to. It stands in for the password
+    // everywhere below.
+    let proved = false;
+    if (req.method === 'POST' && req.headers.authorization && req.headers.dpop && api.podAuth) {
+      const proof = await api.podAuth(req, pathname);
+      if (!proof.ok) return send(proof.status || 401, { error: proof.error });
+      proved = true;
+    }
+    const ownerWebId = api.ownerWebId?.() || null;
+    // The way back from the pod's login: no client named, only the pod's
+    // code. The page finishes the sign-in and returns to the client's request.
+    if (req.method === 'GET' && !params.get('client_id') && params.get('code') && params.get('state') && ownerWebId) {
+      return sendPodSigninPage(res, null, ownerWebId, api.mount || '');
+    }
     const app = api.findApp(params.get('client_id') || '');
     // A client that published its own metadata document needs no
     // registration here: the document is its name and says where it may be
@@ -419,14 +470,16 @@ export async function handle(api, ctx) {
     //    port is the owner" is a statement about the machine rather than
     //    about a web page. Anything pointing elsewhere has to be approved by
     //    somebody who knows the password.
-    if (external && !api.store.getConfig()?.uiPassword && !api.redirectAllowed(redirect)) {
+    const client = { name: app?.name || doc?.name || null, redirect, scope: params.get('scope') || 'read' };
+    if (external && !proved && !api.store.getConfig()?.uiPassword && !api.redirectAllowed(redirect)) {
+      // With a pod to sign in at, the owner approves the client there.
+      if (req.method === 'GET' && ownerWebId) return sendPodSigninPage(res, client, ownerWebId, api.mount || '');
       api.log(`authorize refused: no UI password, and "${redirect}" is not an address of this agent`);
       return send(403, {
         error: 'this client asks to be sent somewhere other than this agent, and no password is '
           + 'set to approve that with. Run `fedipod passwd` and try again.',
       });
     }
-    const client = { name: app?.name || doc?.name || null, redirect, scope: params.get('scope') || 'read' };
     if (app) {
       if (!app.redirectUris.includes(redirect)) {
         api.log(`authorize refused: redirect_uri "${redirect}" not registered for ${app.clientId}`);
@@ -448,7 +501,7 @@ export async function handle(api, ctx) {
       api.log(`authorize refused: redirect_uri "${redirect}" is not this agent`);
       return send(400, { error: 'redirect_uri must be an address of this agent' });
     }
-    if (req.method === 'POST') {
+    if (req.method === 'POST' && !proved) {
       if (api.rateLimited()) {
         api.log('authorize rate limited');
         // 429, not 401: a client that reads this as a wrong password will
@@ -460,11 +513,13 @@ export async function handle(api, ctx) {
       if (!pw || !checkPassword(pw, body.password || '')) {
         return sendLoginForm(res, params, 'wrong password — try again', client);
       }
-    } else if (pw) {
+    } else if (pw && !proved) {
       // The login/approve screen names what is asking before the owner types
       // the password — a cross-site client cannot forge past that.
       return sendLoginForm(res, params, '', client);
-    } else if (api.allowed && !api.allowed.isLocalRequest(req)) {
+    } else if (!proved && api.allowed && !api.allowed.isLocalRequest(req) && !api.throughDoor?.(req)) {
+      // With a pod to sign in at, the owner does that instead of a password.
+      if (req.method === 'GET' && ownerWebId) return sendPodSigninPage(res, client, ownerWebId, api.mount || '');
       // No password set, and this request did not come from this machine.
       //
       // The instant-authorize path is honest theatre on loopback: whoever can
@@ -477,10 +532,9 @@ export async function handle(api, ctx) {
       // dispatched before that check ever runs, so it needs its own.
       api.log(`authorize refused: no UI password, and "${req.headers.host}" is not this machine`);
       return send(403, {
-        error: 'this agent answers on an address outside this machine and has no password set — '
-          + (api.embedded
-            ? 'POST {"password":"…"} to the owner door\'s /config with its door secret before logging in'
-            : 'run `fedipod passwd` before logging in over that address'),
+        error: api.embedded
+          ? 'Open your account\'s management page first, then sign in from there.'
+          : 'Signing in from another machine needs a password. On the machine that runs your account, run: fedipod passwd',
       });
     }
     // External clients get a bound code; the local flow keeps code==token.
@@ -493,6 +547,9 @@ export async function handle(api, ctx) {
     const target = new URL(redirect);
     target.searchParams.set('code', code);
     if (params.get('state')) target.searchParams.set('state', params.get('state'));
+    // A proved sign-in came from the page's own request, which cannot follow
+    // a redirect to a client's address; the page is told where to go.
+    if (proved) return send(200, { redirect: target.href });
     res.writeHead(302, { location: target.href });
     res.end();
     return true;

package/lib/core/publisher/collections.mjs CHANGED Viewed

@@ -15,7 +15,7 @@ import * as podPrivate from '../../pod/private.mjs';
 // still gets everything, so a missed call site degrades to the old cost rather
 // than silently publishing nothing.
 export const ALL_COLLECTIONS = { followers: true, following: true, outbox: true, acls: true,
-  pending: true, blocked: true };
+  pending: true, blocked: true, featured: true };
 // Publish the collections a change actually TOUCHED.
 //
@@ -152,6 +152,11 @@ export async function publishCollections(publisher, which = ALL_COLLECTIONS) {
   }
   if (which.pending) await publisher.publishPending();
   if (which.blocked) await publisher.publishBlocked();
+  // The pinned posts, written even when there are none. The actor names this
+  // collection, and a server showing the profile reads it whether or not
+  // anything was ever pinned; with no document there the pod refused every
+  // reader, a refusal nothing caches, and every server asked again.
+  if (which.featured) await publisher.publishFeatured();
   if (which.outbox) {
     const outbox = publisher.store.read('outbox.json', []);
     // Reconcile reads every published page, which is the expensive part of a

package/lib/core/publisher/index.mjs CHANGED Viewed

@@ -321,6 +321,7 @@ export class Publisher {
       ['notes', urls.notes],
       ['followers', urls.followers],
       ['following', urls.following],
+      ['featured', urls.featured],
       ['outbox', urls.outbox],
     ];
     const unreachable = [];

package/lib/device/admin/surface.mjs CHANGED Viewed

@@ -6,6 +6,8 @@
 // served off disk, and the dispatch to the routes modules beside it. Each of
 // those exports get() and post() over the same ctx.
+import fs from 'node:fs';
+import path from 'node:path';
 import { MastoApi } from '../../client/masto/index.mjs';
 import { C2S } from '../../client/c2s.mjs';
 import { makeC2sAuth } from '../../client/oidc-auth.mjs';
@@ -75,12 +77,23 @@ const ROUTES = [owner, setup, lifecycle, gateway, social, connections];
 // meaning inside a server that is not one — and moves the gate: a pod that is
 // a fediverse instance must let strangers reach /api and /oauth, so the gate
 // guards the operator's door (basePath) instead of the whole surface.
+const SESSION_FILES = {
+  '/oauth/session/signin.mjs': 'web/admin/oauth-signin.mjs',
+  '/oauth/session/fedi-login.mjs': 'lib/session/fedi-login.mjs',
+  '/oauth/session/oidc-session.mjs': 'lib/session/oidc-session.mjs',
+};
 export function buildAdminSurface({ agent, gate, allowed, log = console.log,
   port = null, handle = null, embedded = false, basePath = '/', mount = '',
   publicOrigin = null, scheme = null,
   versionOnDisk = () => localVersion(projectRoot) }) {
   const json = (res, status, obj) => sendJson(res, status, obj, allowed);
-  const masto = new MastoApi({ agent, log, allowed, scheme, embedded, mount });
+  const masto = new MastoApi({ agent, log, allowed, scheme, embedded, mount,
+    throughDoor: (req) => Boolean(gate?.upgradeOk?.(req)) });
+  // A client's sign-in can be proved with the owner's pod sign-in instead of a
+  // password: the same verification the post door uses, and the owner it names.
+  masto.podAuth = makeC2sAuth({ agent, log, scheme, mount });
+  masto.ownerWebId = () => agent.remote?.webId || null;
   // The spec's own write API (§6), beside the facade. Its bearer fallback is
   // the facade's token, so the two surfaces share one notion of the operator.
   const c2s = new C2S({ agent, log, scheme, mount,
@@ -172,6 +185,16 @@ export function buildAdminSurface({ agent, gate, allowed, log = console.log,
       if (p === '/ap/outbox' || p === '/ap/actor' || p === '/ap/inbox') {
         if (await c2s.handle(req, res, p, url)) return;
       }
+      // The sign-in page's script and the library it signs in with, outside
+      // the door like the sign-in itself. A fixed list; nothing in the request
+      // names a file.
+      const sessionFile = SESSION_FILES[p];
+      if (sessionFile) {
+        let body;
+        try { body = fs.readFileSync(path.join(projectRoot, sessionFile)); } catch { return json(res, 404, { error: 'not here' }); }
+        res.writeHead(200, { 'content-type': 'text/javascript; charset=utf-8', 'cache-control': 'no-cache' });
+        res.end(body); return;
+      }
       // Where a client looks first to find out how to sign in (RFC 8414), and
       // in front of the door for the same reason C2S is: a client that has to
       // be handed a secret before it can ask how to sign in cannot set itself

package/lib/device/certs.mjs CHANGED Viewed

@@ -71,7 +71,16 @@ function nameConstraintsExtension() {
   return { id: '2.5.29.30', critical: true, value: der.getBytes() };
 }
-function makeCert({ subjectCN, issuer = null, issuerKeyPem = null, isCA = false, days, extraDns = [] }) {
+// The issuer's own key identifier, for the certificate it signs to name. A
+// verifier that finds several CAs under one name — this machine's browser
+// store has held dozens of "FediPod Local CA" from scratch agents — picks by
+// this, and without it picks by name, tries the wrong key and fails.
+const issuerKeyId = (issuerCertPem) => {
+  const ext = forge.pki.certificateFromPem(issuerCertPem).getExtension('subjectKeyIdentifier');
+  return ext?.subjectKeyIdentifier ? forge.util.hexToBytes(ext.subjectKeyIdentifier) : null;
+};
+function makeCert({ subjectCN, issuer = null, issuerKeyPem = null, issuerCertPem = null, isCA = false, days, extraDns = [] }) {
   const keys = forge.pki.rsa.generateKeyPair({ bits: 2048 });
   const cert = forge.pki.createCertificate();
   cert.publicKey = keys.publicKey;
@@ -89,6 +98,9 @@ function makeCert({ subjectCN, issuer = null, issuerKeyPem = null, isCA = false,
     : [{ name: 'basicConstraints', cA: false },
        { name: 'keyUsage', digitalSignature: true, keyEncipherment: true },
        { name: 'extKeyUsage', serverAuth: true },
+       { name: 'subjectKeyIdentifier' },
+       ...(issuerCertPem && issuerKeyId(issuerCertPem)
+         ? [{ name: 'authorityKeyIdentifier', keyIdentifier: issuerKeyId(issuerCertPem) }] : []),
        { name: 'subjectAltName',
          altNames: [...SANS, ...extraDns.map(v => ({ type: 2, value: v }))] }]);
   const signingKey = issuerKeyPem ? forge.pki.privateKeyFromPem(issuerKeyPem) : keys.privateKey;
@@ -131,6 +143,7 @@ export function ensureLocalTls(dir, { log = () => {}, names = [] } = {}) {
   const trust = !!(caKey && caCert);
   const isStale = (k, c) => !k || !c || daysLeft(c) < REMINT_DAYS || !coversLocalhost(c)
     || (trust && !issuedBy(c, caCert))
+    || (trust && !namesIssuerKey(c))
     || names.some(n => !certDnsNames(c).includes(n));
   let key = readPem(dir, FILES.key);
   let cert = readPem(dir, FILES.cert);
@@ -165,7 +178,7 @@ export function ensureLocalTls(dir, { log = () => {}, names = [] } = {}) {
         .filter(n => n !== 'localhost' && n !== '*.localhost');
       const minted = makeCert({
         subjectCN: 'localhost',
-        ...(trust ? { issuer: caSubject(caCert), issuerKeyPem: caKey } : {}),
+        ...(trust ? { issuer: caSubject(caCert), issuerKeyPem: caKey, issuerCertPem: caCert } : {}),
         days: LEAF_DAYS,
         extraDns: carried,
       });
@@ -181,6 +194,9 @@ export function ensureLocalTls(dir, { log = () => {}, names = [] } = {}) {
   return { key, cert, trust, dir, expiresInDays: Math.floor(daysLeft(cert)) };
 }
+const namesIssuerKey = (certPem) => {
+  try { return !!forge.pki.certificateFromPem(certPem).getExtension('authorityKeyIdentifier'); } catch { return false; }
+};
 const caSubject = (caCertPem) => forge.pki.certificateFromPem(caCertPem).subject.attributes
   .map(a => ({ name: a.name, value: a.value }));
 const issuedBy = (certPem, caCertPem) => {

package/lib/gateway/front-core.mjs CHANGED Viewed

@@ -221,11 +221,22 @@ function parseUserPath(pathname) {
 // `netlify-cdn-cache-control` is the edge's own instruction; `cache-control`
 // is what the reader's browser is told. The edge may serve a stale copy while
 // it fetches a fresh one, so nobody waits on the pod for a document that is
-// merely a minute old.
+// merely minutes old. The edge holds a document far longer than a browser
+// is asked to: the edge is what turns a thousand readers into one function
+// call, while a browser that held an actor for ten minutes would show one
+// person a stale profile they had just edited.
+const BROWSER_MAX_AGE = 60;
 const publicFor = (seconds, stale = seconds * 4) => ({
-  'cache-control': `public, max-age=${seconds}`,
+  'cache-control': `public, max-age=${Math.min(seconds, BROWSER_MAX_AGE)}`,
   'netlify-cdn-cache-control': `public, s-maxage=${seconds}, stale-while-revalidate=${stale}`,
 });
+// How long the edge holds a public document, and a handle's WebFinger
+// answer. Every server that has heard of an account asks for its actor and
+// its handle again and again; a post or a collection changes when its owner
+// acts, and ten minutes of edge is what the plan's budget of function calls
+// can afford.
+const PUBLIC_EDGE_SECONDS = 600;
+const WEBFINGER_EDGE_SECONDS = 3600;
 // Where a pod owner opts their identity in. An operator may name it, because
 // the path it takes is one their pod server can no longer serve; the dot says
@@ -382,7 +393,7 @@ async function route(request, ctx) {
   if (pathname === runPath(ctx)) {
     if (request.method !== 'GET' && request.method !== 'HEAD') return { status: 405, headers: {}, body: '' };
     if (!ctx.runPage) return notFound();
-    return { status: 200, headers: { 'content-type': 'text/html; charset=utf-8' }, body: ctx.runPage };
+    return { status: 200, headers: { 'content-type': 'text/html; charset=utf-8', 'cache-control': 'no-cache' }, body: ctx.runPage };
   }
   // The roster page: the host reading who has accounts here. The page signs in
@@ -609,6 +620,28 @@ async function route(request, ctx) {
     return j(200, { results });
   }
+  // Who is here, and which pod of theirs could opt in. The opt-in page asks
+  // this first: on a pod server that issued the reader's session, the answer
+  // names their pod and its address, and the page shows one button instead of
+  // a form. A Gateway holds no such session and says so; the page then asks
+  // for the pod by hand and proves it with a sign-in, as before.
+  if (pathname === '/api/agent' && request.method === 'GET') {
+    if (!ctx.agentControl) return j(501, { error: 'this server does not run identities' });
+    if (!ctx.webIdsFromSession) return j(200, { offered: true, session: 'unknown' });
+    if (!sameOriginRequest(request, ctx.frontOrigin)) return j(200, { offered: true, session: 'none' });
+    const webIds = await ctx.webIdsFromSession(request).catch(() => []);
+    if (!webIds.length) return j(200, { offered: true, session: 'none', loginUrl: '/.account/login/password/' });
+    const pods = [];
+    for (const webId of webIds) {
+      let podBase;
+      try { podBase = podBaseOfWebId(webId); } catch { continue; }
+      let about = null;
+      try { about = ctx.agentControl.describe ? await ctx.agentControl.describe({ podBase }) : null; } catch { about = null; }
+      pods.push({ webId, podBase, ...(about || {}) });
+    }
+    return j(200, { offered: true, session: 'ok', pods });
+  }
   // Runtime opt-in: a pod owner asks the server this front sits on to RUN
   // their identity. Same proof as attach — a Solid-OIDC token — but the
   // ownership check is stricter: the WebID must live UNDER the pod base, not
@@ -691,7 +724,9 @@ async function route(request, ctx) {
   if (mPageScript) {
     const body = ctx.pageScripts?.[`${mPageScript[1]}.js`];
     if (!body) return notFound();
-    return { status: 200, headers: { 'content-type': 'text/javascript; charset=utf-8' }, body };
+    // Revalidated on every load: a page served fresh with a script the
+    // browser kept from last time is the mismatch nobody can see.
+    return { status: 200, headers: { 'content-type': 'text/javascript; charset=utf-8', 'cache-control': 'no-cache' }, body };
   }
   // The vendored Solid-OIDC browser library the opt-in and admin pages load —
@@ -727,7 +762,7 @@ async function route(request, ctx) {
     // A handle answers the same for everybody, and changes only when a row
     // does. Every server that has heard of this account asks for it; the edge
     // can answer most of them.
-    Object.assign(out.headers, publicFor(300));
+    Object.assign(out.headers, publicFor(WEBFINGER_EDGE_SECONDS));
     return out;
   }
@@ -856,7 +891,7 @@ async function route(request, ctx) {
   // `readPublicDocument` asked for it with no credential, so a document that
   // came back is one anybody can read — which is what makes it cacheable.
   return { status: 200,
-    headers: { ...open, 'content-type': got.type || (container ? 'text/turtle' : page ? 'text/html' : AP_CT), ...publicFor(30) },
+    headers: { ...open, 'content-type': got.type || (container ? 'text/turtle' : page ? 'text/html' : AP_CT), ...publicFor(PUBLIC_EDGE_SECONDS) },
     body: text };
 }

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "fedipod",
-  "version": "1.26.1",
+  "version": "1.27.3",
   "description": "Standalone single-actor ActivityPub agent whose wire face, RDF truth and state all live on a Solid pod (CSS). Bundles a Phanpy UI and a Mastodon client-API facade.",
   "type": "module",
   "license": "MIT",

package/run-agent.mjs CHANGED Viewed

@@ -497,6 +497,18 @@ export class Agent {
     return true;
   }
+  // The featured collection was once written only on the first pin, so an
+  // account from before then has none, and every server that shows the
+  // profile is refused and asks again. One authenticated GET; the empty
+  // collection goes up when the pod lacks it. True when it had to.
+  async ensureFeaturedPublished() {
+    const doc = await this.remote.getJson(this.urls.featured);
+    if (doc?.id) return false;
+    this.log('featured collection missing from the pod — publishing it');
+    await this.publisher.publishFeatured();
+    return true;
+  }
   // Read-only mode: refresh the state cache periodically, and take over the
   // moment the active agent's lease frees.
   startViewer() {
@@ -588,6 +600,8 @@ export class Agent {
     if (repair) {
       this.ensureActorPublished()
         .catch(e => this.log(`actor check failed: ${e.message}`));
+      this.ensureFeaturedPublished()
+        .catch(e => this.log(`featured check failed: ${e.message}`));
       // The human page, rewritten only when what it shows has changed: one
       // local digest compare, and a write the first time after an upgrade.
       this.publisher.publishProfilePage()

package/vendor/gate.cjs CHANGED Viewed

@@ -7,8 +7,11 @@
 // authorized when it carries the secret:
 //   1. header `x-dk-token` — the Electron shell injects this on app traffic, or
 //   2. cookie `dk-token` — a browser "blessed" via the token URL, or
-//   3. query `?dk-token=<secret>` — answered with a SameSite=Strict cookie and
-//      a redirect to the same URL minus the param (the blessing flow), or
+//   3. query `?dk-token=<secret>` — answered with a SameSite=Lax cookie and
+//      a redirect to the same URL minus the param (the blessing flow). Lax,
+//      not Strict: a link from another site — the pod server's own opt-in
+//      page among them — must arrive with the cookie it was just handed, and
+//      Lax still withholds it from cross-site POSTs and subresources; or
 //   4. (opt-in, proxy only) an Origin/Referer on the allowOrigins list — app
 //      pages in a blessed browser call the proxy with plain fetch(), which
 //      doesn't attach cookies cross-port; a hostile page can't forge Origin.
@@ -105,7 +108,7 @@ function makeGate(token, { allowOrigins = [], publicEndpoints = false, secureCoo
         // Path scopes the cookie to this identity's own door: on a shared
         // origin (suffix pods) two co-tenants must not clobber each other's,
         // and a whole-origin cookie would. Defaults to '/'.
-        'set-cookie': `${COOKIE}=${t}; Path=${cookiePath}; HttpOnly; SameSite=Strict; Max-Age=31536000`
+        'set-cookie': `${COOKIE}=${t}; Path=${cookiePath}; HttpOnly; SameSite=Lax; Max-Age=31536000`
           + (secureCookie ? '; Secure' : ''),
         'location': url.pathname + url.search,
       });

package/web/admin/oauth-signin.mjs ADDED Viewed

@@ -0,0 +1,37 @@
+// oauth-signin.mjs — a client asked this account to sign its owner in. The
+// owner signs in at their own pod, with the fediverse-account library, and the
+// page proves that sign-in to the account with one signed request; the account
+// then hands the client its code. No password of ours anywhere.
+import { fediLogin } from './fedi-login.mjs';
+const $ = (id) => document.getElementById(id);
+const say = (text, error = false) => { const s = $('signin-status'); s.textContent = text; s.setAttribute('role', error ? 'alert' : 'status'); };
+const webId = $('webid').href;
+const here = location.origin + location.pathname;
+const login = fediLogin({ dbName: 'fedipod-signin', clientName: 'FediPod sign-in', redirectUri: here });
+// Back from the pod: this finishes the sign-in and returns to the client's
+// request, which carries the client's own parameters.
+try { await login.resume(); } catch (e) { say(e.message, true); }
+async function prove() {
+  const s = await login.getSession();
+  if (!s) return false;
+  if (s.webId !== webId) { say(`You signed in as ${s.webId}, but this account belongs to ${webId}. Sign out there and sign in as the owner.`, true); return true; }
+  say('Signing you in…');
+  const res = await s.fetch(here, {
+    method: 'POST', headers: { 'content-type': 'application/x-www-form-urlencoded' },
+    body: location.search.replace(/^\?/u, ''),
+  });
+  const d = await res.json().catch(() => ({}));
+  if (res.ok && d.redirect) { location.href = d.redirect; return true; }
+  if (res.ok && d.code) { say(`Your authorization code: ${d.code}`); return true; }
+  say(d.error || `The account refused the sign-in (HTTP ${res.status}).`, true);
+  return true;
+}
+if (location.search.includes('client_id=') && !(await prove())) $('signin').hidden = false;
+$('signin').addEventListener('click', async () => {
+  say('Taking you to your pod…');
+  try { await login.login(webId, { returnTo: location.href, redirectUri: here }); } catch (e) { say(e.message, true); }
+});

package/web/app/dist/sw.js CHANGED Viewed

@@ -45643,7 +45643,8 @@ var ALL_COLLECTIONS = {
   outbox: true,
   acls: true,
   pending: true,
-  blocked: true
+  blocked: true,
+  featured: true
 };
 async function publishOutbox(publisher, outbox, { acls = false, force = false } = {}) {
   const { urls } = publisher;
@@ -45742,6 +45743,7 @@ async function publishCollections(publisher, which = ALL_COLLECTIONS) {
   }
   if (which.pending) await publisher.publishPending();
   if (which.blocked) await publisher.publishBlocked();
+  if (which.featured) await publisher.publishFeatured();
   if (which.outbox) {
     const outbox = publisher.store.read("outbox.json", []);
     const known2 = publisher.store.read("published.json", {}).outboxIndex;
@@ -57345,6 +57347,7 @@ var Publisher = class {
       ["notes", urls.notes],
       ["followers", urls.followers],
       ["following", urls.following],
+      ["featured", urls.featured],
       ["outbox", urls.outbox]
     ];
     const unreachable = [];
@@ -65852,6 +65855,39 @@ function checkPassword(rec, password) {
 }
 var escapeHtml = (s) => String(s).replace(/[&<>"']/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[c]);
 var parseRedirects = (v) => (Array.isArray(v) ? v : String(v || "").split(/\s+/)).map((s) => s.trim()).filter(Boolean);
+function sendPodSigninPage(res, client, webId, mount = "") {
+  let asking = "";
+  if (client && (client.name || client.redirect)) {
+    let where = "";
+    try {
+      where = client.redirect ? new URL(client.redirect).host : "";
+    } catch {
+    }
+    const who = client.name ? escapeHtml(client.name) : where ? escapeHtml(where) : "A client";
+    asking = `<p><strong>${who}</strong> is asking to use your account${where ? `, and will be sent back to <code>${escapeHtml(where)}</code>` : ""}.</p>`;
+  }
+  res.writeHead(200, { "content-type": "text/html; charset=utf-8", "cache-control": "no-cache" });
+  res.end(`<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">
+<title>Sign in with your pod</title>
+<style>:root{color-scheme:light dark;--heading:#1a4f8a;--btn:#3d6b35;--line:#9a9a9a}
+body{font:20px Arial,Helvetica,sans-serif;max-width:28rem;margin:12vh auto;padding:0 1rem}
+h1{color:var(--heading);font-size:1.5rem}
+code{word-break:break-all;background:rgba(120,120,120,.12);padding:.05em .35em;border-radius:4px}
+button{font:inherit;padding:.6rem 1.1rem;background:var(--btn);color:#fff;border:none;border-radius:9px;cursor:pointer}
+button[hidden]{display:none}
+#signin-status{min-height:1.5em;padding:.6rem .8rem;border:1px solid var(--line);border-radius:8px;margin-top:1rem}
+@media (prefers-color-scheme:dark){:root{--heading:#7fb3e8;--btn:#5a8a4f}}</style></head><body>
+<main>
+<h1>Sign in with your pod</h1>
+${asking}
+<p>This account belongs to <a id="webid" href="${escapeHtml(webId)}">${escapeHtml(webId)}</a>. Sign in at that pod to allow it.</p>
+<p><button type="button" id="signin" hidden>Sign in with your pod</button></p>
+<p id="signin-status" role="status" aria-live="polite"></p>
+</main>
+<script type="module" src="${escapeHtml(mount)}/oauth/session/signin.mjs"><\/script>
+</body></html>`);
+  return true;
+}
 function sendLoginForm(res, params, error2 = "", client = null, status2 = null, headers = {}) {
   const hidden = [...params.entries()].filter(([k]) => k !== "password").map(([k, v]) => `<input type="hidden" name="${escapeHtml(k)}" value="${escapeHtml(v)}">`).join("\n");
   let asking = "<p>Enter the agent password to authorize this client.</p>";
@@ -66120,6 +66156,16 @@ async function handle(api, ctx) {
       params = new URLSearchParams(body);
     }
     const redirect = params.get("redirect_uri") || "";
+    let proved = false;
+    if (req.method === "POST" && req.headers.authorization && req.headers.dpop && api.podAuth) {
+      const proof = await api.podAuth(req, pathname);
+      if (!proof.ok) return send(proof.status || 401, { error: proof.error });
+      proved = true;
+    }
+    const ownerWebId = api.ownerWebId?.() || null;
+    if (req.method === "GET" && !params.get("client_id") && params.get("code") && params.get("state") && ownerWebId) {
+      return sendPodSigninPage(res, null, ownerWebId, api.mount || "");
+    }
     const app = api.findApp(params.get("client_id") || "");
     const doc = app ? null : await api.resolveClientDocument(params.get("client_id") || "");
     const external = !!app || !!doc;
@@ -66127,13 +66173,14 @@ async function handle(api, ctx) {
       api.log(`authorize refused: cross-site navigation to the mint from ${req.headers.referer || "nowhere"}`);
       return send(403, { error: "a cross-site navigation may not authorize a client" });
     }
-    if (external && !api.store.getConfig()?.uiPassword && !api.redirectAllowed(redirect)) {
+    const client = { name: app?.name || doc?.name || null, redirect, scope: params.get("scope") || "read" };
+    if (external && !proved && !api.store.getConfig()?.uiPassword && !api.redirectAllowed(redirect)) {
+      if (req.method === "GET" && ownerWebId) return sendPodSigninPage(res, client, ownerWebId, api.mount || "");
       api.log(`authorize refused: no UI password, and "${redirect}" is not an address of this agent`);
       return send(403, {
         error: "this client asks to be sent somewhere other than this agent, and no password is set to approve that with. Run `fedipod passwd` and try again."
       });
     }
-    const client = { name: app?.name || doc?.name || null, redirect, scope: params.get("scope") || "read" };
     if (app) {
       if (!app.redirectUris.includes(redirect)) {
         api.log(`authorize refused: redirect_uri "${redirect}" not registered for ${app.clientId}`);
@@ -66152,7 +66199,7 @@ async function handle(api, ctx) {
       api.log(`authorize refused: redirect_uri "${redirect}" is not this agent`);
       return send(400, { error: "redirect_uri must be an address of this agent" });
     }
-    if (req.method === "POST") {
+    if (req.method === "POST" && !proved) {
       if (api.rateLimited()) {
         api.log("authorize rate limited");
         return sendLoginForm(
@@ -66167,12 +66214,13 @@ async function handle(api, ctx) {
       if (!pw || !checkPassword(pw, body.password || "")) {
         return sendLoginForm(res, params, "wrong password \u2014 try again", client);
       }
-    } else if (pw) {
+    } else if (pw && !proved) {
       return sendLoginForm(res, params, "", client);
-    } else if (api.allowed && !api.allowed.isLocalRequest(req)) {
+    } else if (!proved && api.allowed && !api.allowed.isLocalRequest(req) && !api.throughDoor?.(req)) {
+      if (req.method === "GET" && ownerWebId) return sendPodSigninPage(res, client, ownerWebId, api.mount || "");
       api.log(`authorize refused: no UI password, and "${req.headers.host}" is not this machine`);
       return send(403, {
-        error: "this agent answers on an address outside this machine and has no password set \u2014 " + (api.embedded ? `POST {"password":"\u2026"} to the owner door's /config with its door secret before logging in` : "run `fedipod passwd` before logging in over that address")
+        error: api.embedded ? "Open your account's management page first, then sign in from there." : "Signing in from another machine needs a password. On the machine that runs your account, run: fedipod passwd"
       });
     }
     const code = external ? api.mintCode({
@@ -66186,6 +66234,7 @@ async function handle(api, ctx) {
     const target = new URL(redirect);
     target.searchParams.set("code", code);
     if (params.get("state")) target.searchParams.set("state", params.get("state"));
+    if (proved) return send(200, { redirect: target.href });
     res.writeHead(302, { location: target.href });
     res.end();
     return true;
@@ -68091,6 +68140,7 @@ var MastoApi = class _MastoApi {
     allowed = null,
     scheme = null,
     embedded = false,
+    throughDoor = null,
     mount = "",
     streaming = true,
     webPush = true,
@@ -68101,6 +68151,7 @@ var MastoApi = class _MastoApi {
     this.embedded = embedded;
     this.log = log2;
     this.allowed = allowed;
+    this.throughDoor = throughDoor;
     this.scheme = scheme;
     this.streaming = streaming;
     this.webPush = webPush;