fedipod 1.29.2 → 1.32.0

package/web/admin/notices-bar.js

@@ -0,0 +1,90 @@
+// notices-bar.js — the notices bell in the bar, on every page of ours.
+//
+// Whoever runs the site writes notices (the /notices page, admin only); every
+// signed-in account sees the bell. This asks /api/notices once per page load,
+// hides the bell where the site has none to offer (a DeviceAgent's own pages
+// answer no such thing), lists the titles, and opens one notice at a time.
+// Which notices this browser has already opened is this browser's business
+// alone, so it lives in localStorage and nowhere else.
+//
+// Every element here is declared in the page's markup; this fills them.
+(() => {
+  const bell = document.getElementById('bar-notices');
+  const list = document.getElementById('notices-list');
+  const view = document.getElementById('notice-view');
+  if (!bell || !list || !view) return;
+  const $ = (id) => document.getElementById(id);
+  const SEEN = 'fedipod-notices-seen';
+  const readSeen = () => { try { return JSON.parse(localStorage.getItem(SEEN) || '[]'); } catch { return []; } };
+  const writeSeen = (ids) => { try { localStorage.setItem(SEEN, JSON.stringify(ids.slice(-200))); } catch { /* keeps no site data */ } };
+
+  const when = (iso) => { try { return new Date(iso).toLocaleDateString(undefined, { year: 'numeric', month: 'short', day: 'numeric' }); } catch { return ''; } };
+
+  // A notice's body is plain text: paragraphs at blank lines, and a bare
+  // https link becomes a link. Nothing in it is ever read as markup.
+  const renderBody = (el, text) => {
+    el.textContent = '';
+    for (const para of String(text || '').split(/\n\s*\n/u)) {
+      const p = document.createElement('p');
+      for (const part of para.split(/(https?:\/\/[^\s<>"']+)/u)) {
+        if (/^https?:\/\//u.test(part)) {
+          const a = document.createElement('a');
+          a.href = part; a.textContent = part; a.target = '_blank'; a.rel = 'noopener';
+          p.append(a);
+        } else p.append(part);
+      }
+      el.append(p);
+    }
+  };
+
+  let notices = [];
+  const render = () => {
+    const seen = new Set(readSeen());
+    const fresh = notices.filter((n) => !seen.has(n.id)).length;
+    $('bar-notices-count').textContent = fresh ? String(fresh) : '';
+    bell.dataset.new = String(fresh);
+    bell.setAttribute('aria-label', fresh ? `Notices, ${fresh} new` : 'Notices');
+    const ul = $('notices-items');
+    ul.textContent = '';
+    if (!notices.length) {
+      const p = document.createElement('p'); p.className = 'none'; p.textContent = 'No notices.';
+      ul.append(p);
+      return;
+    }
+    for (const n of notices) {
+      const li = document.createElement('li');
+      if (!seen.has(n.id)) li.classList.add('new');
+      const b = document.createElement('button');
+      b.type = 'button'; b.className = 'notice-open'; b.textContent = n.title;
+      b.addEventListener('click', () => open(n));
+      const w = document.createElement('span'); w.className = 'when'; w.textContent = when(n.at);
+      li.append(b, w);
+      ul.append(li);
+    }
+  };
+
+  const open = (n) => {
+    $('notice-view-title').textContent = n.title;
+    $('notice-view-when').textContent = when(n.at);
+    renderBody($('notice-view-body'), n.body);
+    const seen = readSeen();
+    if (!seen.includes(n.id)) { seen.push(n.id); writeSeen(seen); }
+    render();
+    list.close();
+    view.showModal();
+  };
+
+  bell.addEventListener('click', () => { render(); list.showModal(); });
+  $('notices-close').addEventListener('click', () => list.close());
+  $('notice-view-close').addEventListener('click', () => { view.close(); list.showModal(); });
+
+  fetch(location.origin + '/api/notices', { headers: { accept: 'application/json' } })
+    .then((r) => (r.ok ? r.json() : null))
+    .then((j) => {
+      if (!j || !Array.isArray(j.notices)) return;
+      notices = j.notices;
+      render();
+      bell.hidden = false;
+    })
+    .catch(() => { /* no site notices here; the bell stays hidden */ });
+})();

package/web/admin/record.js

@@ -94,6 +94,7 @@ function resetConfirm() {
   for (const k of Object.keys(LIFECYCLE)) $(`warn-${k}`)?.hidden !== undefined && ($(`warn-${k}`).hidden = true);
   $('confirm-handle').value = '';
   $('confirm-handle-move').value = '';
+  $('confirm-handle-close').value = '';
   $('move-target').value = '';
 }
 function closePanels(keep = null) {

package/web/admin/setup/index.html

@@ -59,8 +59,16 @@ button:disabled { opacity: .5; cursor: default; }
 <nav id="bar" aria-label="Site">
   <h1 class="name">FediPod</h1>
   <span id="bar-handle"></span>
-  <a id="bar-fediverse" href="../client/" title="   Open the client and read your timeline">visit account</a>
-  <a id="bar-manage" href="../" title="   The record: what this actor is, and what you can do to it">manage account</a>
+  <!-- The account group, styled like the client group beside it: one label,
+       then the places to go. The browser build adds "sign out" to it. -->
+  <span id="account-pick"><span id="account-now">account:</span>
+  <a id="bar-fediverse" href="../client/" title="   Open the client and read your timeline">visit</a>
+  <a id="bar-manage" href="../" title="   The record: what this actor is, and what you can do to it">manage</a>
+  </span>
+  <!-- Notices from whoever runs this site. Shown only when the site has any
+       (notices-bar.js asks /api/notices); the count is how many are new here. -->
+  <button type="button" id="bar-notices" hidden aria-haspopup="dialog" aria-controls="notices-list"
+    title="   Notices from the operator of this site">&#128276;<span id="bar-notices-count" aria-live="polite"></span></button>
   <a id="bar-add" href="../?new=1" title="   Set up another actor on this machine, with its own pod" aria-current="page">add new account</a>
 </nav>
 <main id="page">
@@ -210,5 +218,24 @@ button:disabled { opacity: .5; cursor: default; }
 <script src="../bar.js"></script>
 <script src="../common.js"></script>
 <script src="setup.js"></script>
+
+<!-- The notices: the list, and one notice open. Declared here and filled by
+     notices-bar.js from /api/notices; nothing in them is markup from a notice. -->
+<dialog id="notices-list" aria-labelledby="notices-title">
+  <section>
+    <h2 id="notices-title">Notices</h2>
+    <ul id="notices-items"></ul>
+    <p class="row"><button type="button" id="notices-close" class="primary" title="   Close the list of notices">Close</button></p>
+  </section>
+</dialog>
+<dialog id="notice-view" aria-labelledby="notice-view-title">
+  <section>
+    <h2 id="notice-view-title"></h2>
+    <p class="when" id="notice-view-when"></p>
+    <div id="notice-view-body"></div>
+    <p class="row"><button type="button" id="notice-view-close" class="primary" title="   Back to the list of notices">Close</button></p>
+  </section>
+</dialog>
+<script src="../notices-bar.js"></script>
 </body>
 </html>

package/web/admin/upkeep.js

@@ -76,6 +76,9 @@ const LIFECYCLE = {
   retire: { path: '/retire', title: 'Retire this identity', go: 'Retire it', danger: true, done: (r) => `retired ${r.deletedAt}: Delete delivered to ${r.inboxes} inbox(es)` },
   move: { path: '/move', title: 'Transfer this account away', go: 'Transfer it', focus: 'move-target',
     done: (r) => `transferred to ${r.target}: Move delivered to ${r.inboxes} inbox(es), unfollowed ${r.unfollowed}/${r.following}` },
+  // The address at the gateway, not the identity: the pod keeps everything.
+  'close-address': { path: '/gateway/close', title: 'Close this address', go: 'Close it', danger: true, focus: 'confirm-handle-close',
+    done: (r) => (r.closed ? 'closed — this address is gone for good; everything on your pod is untouched' : 'not closed') },
 };
 let pending = null;
 
@@ -119,7 +122,8 @@ $('confirm-form').addEventListener('submit', async (ev) => {
   const what = pending;
   const body = what === 'retire' ? { confirm: $('confirm-handle').value.trim() }
     : what === 'move' ? { target: $('move-target').value.trim(), confirm: $('confirm-handle-move').value.trim() }
-      : {};
+      : what === 'close-address' ? { confirm: $('confirm-handle-close').value.trim() }
+        : {};
   if (what === 'move' && !body.target) { say('name the account to transfer to', 'err'); return; }
   $('confirm-go').disabled = true;
   say(`${what} — this talks to the pod and to other servers, so it takes a moment`);

package/web/app/admin-facade.mjs

@@ -33,6 +33,7 @@ export const ADMIN_PATHS = new Set([
   '/deadletter', '/blocks', '/profiles', '/modqueue', '/log', '/fediacct', '/describe', '/follow',
   '/atproto', '/atproto/connect', '/atproto/disconnect',
   '/rebuild', '/move', '/retire', '/inbox/prune', '/park', '/revive', '/takeover',
+  '/gateway/pause', '/gateway/close',
   '/fediacct/connect', '/fediacct/disconnect', '/fediacct/callback',
 ]);
 
@@ -138,6 +139,10 @@ export class AdminFacade {
             configured: !!(g && g.url), url: g?.url || null, webId: g?.webId || null,
             frontActor: g?.frontActor || null, mode: g?.mode || 'off', hasSecret: !!g?.hmacSecret,
             stats: a.store.read('gateway-stats.json', { verified: 0, unverified: 0, lastAt: null }),
+            // The account's standing at the gateway — paused, closed — as the
+            // gateway last said it (agent.mjs tellGateway). The record page
+            // shows its pause and close controls only when this is here.
+            standing: a.gatewayStanding || null,
           });
         }
         case '/deadletter': return json(200, { items: a.store.getDeadLetters() });
@@ -264,6 +269,25 @@ export class AdminFacade {
         return json(200, { ok: true, mode: a.status().mode });
       }
 
+      // The account's standing at its gateway: paused by its owner, or closed
+      // for good (front-core: accounts that go quiet). Both go to the gateway
+      // with the pod session as proof, and its answer is the new standing.
+      case '/gateway/pause': {
+        if (typeof body.paused !== 'boolean') return json(400, { error: 'paused must be true or false' });
+        if (!a.pauseAtGateway || !a.gatewayApi) return json(501, { error: 'this account is not at a gateway' });
+        const r = await a.pauseAtGateway(body.paused);
+        if (!r) return json(502, { error: 'the gateway could not be reached' });
+        return json(r.status === 200 ? 200 : r.status, r);
+      }
+      case '/gateway/close': {
+        const handle = String(a.store.getConfig()?.handle || '').toLowerCase();
+        if (!handle || String(body.confirm || '').toLowerCase() !== handle) return json(400, { error: 'type the handle to confirm' });
+        if (!a.closeAtGateway || !a.gatewayApi) return json(501, { error: 'this account is not at a gateway' });
+        const r = await a.closeAtGateway();
+        if (!r) return json(502, { error: 'the gateway could not be reached' });
+        return json(r.status === 200 ? 200 : r.status, r);
+      }
+
       // Going quiet, and coming back. The record page's active/parked select.
       case '/park': {
         if (!await a.requestTakeover?.()) return json(503, { error: 'another device is active for this pod — park from there' });

package/web/app/agent.mjs

@@ -137,10 +137,35 @@ export class BrowserAgent {
     return true;
   }
 
+  // One call to the gateway's owner API, proved with the pod session. What
+  // comes back on 200 or 410 is the account's standing there, kept for the
+  // manage page; anything else is logged and forgotten.
+  async tellGateway(what, body) {
+    if (!this.gatewayApi) return null;
+    let res;
+    try {
+      res = await this.sessionFetch(`${this.gatewayApi}/${what}`, {
+        method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(body),
+      });
+    } catch (e) { this.log(`gateway ${what}: ${e.message}`); return null; }
+    const json = await res.json().catch(() => ({}));
+    const out = { status: res.status, ...json };
+    if (res.status === 200 || res.status === 410) this.gatewayStanding = out;
+    else this.log(`gateway ${what}: ${res.status} ${json.error || ''}`);
+    return out;
+  }
+  openAtGateway() { return this.tellGateway('open', { handle: this.doorKey }); }
+  pauseAtGateway(paused) { return this.tellGateway('pause', { handle: this.doorKey, paused: !!paused }); }
+  closeAtGateway() { return this.tellGateway('close', { handle: this.doorKey, confirm: true }); }
+  static OPEN_EVERY_MS = 60 * 60_000;
+
   // Become the active agent: renew the lease, then start what a viewer skips —
   // publish the face, drain the inbox, run the mirrors.
   async goActive() {
     this.viewer = false;
+    // Reading here is being here: the gateway hears so once an hour.
+    clearInterval(this._openTimer);
+    this._openTimer = setInterval(() => { this.openAtGateway(); }, BrowserAgent.OPEN_EVERY_MS);
     this.lease.onLost = () => this.demote();
     this.lease.startRenewal();
     try {
@@ -179,6 +204,7 @@ export class BrowserAgent {
     this.viewer = true;
     this.log('another device took over — read-only here');
     this.lease.stopRenewal();
+    clearInterval(this._openTimer); this._openTimer = null;
     this.intake?.stop?.();
     // The delivery queue as well. Its timer starts in the Deliverer's
     // constructor and nothing here ever switched it off, so a demoted device
@@ -322,6 +348,28 @@ export class BrowserAgent {
       onGone: () => this.publisher.publishCollections({ followers: true }),
     });
 
+    // The gateway this account's mail comes through, and the account's own
+    // standing there — paused, closed, how much arrived unread (front-core:
+    // accounts that go quiet). The gateway is told on every sign-in and
+    // hourly while this device is active: that is what keeps an account
+    // somebody reads from counting as a quiet one. Only a closed address
+    // stops the boot; a gateway that cannot be reached is no reason to
+    // refuse a sign-in.
+    this.gatewayApi = null;
+    try { if (config.gateway?.url) this.gatewayApi = `${new URL(config.gateway.url).origin}/api`; } catch { this.gatewayApi = null; }
+    this.doorKey = doorKeyOf(config.gateway?.url) || config.handle;
+    this.gatewayStanding = null;
+    const standing = await this.openAtGateway();
+    if (standing?.status === 410) {
+      const host = (() => { try { return new URL(this.gatewayApi).host; } catch { return 'the gateway'; } })();
+      const address = this.doorKey.includes('@') ? `@${this.doorKey}` : `@${this.doorKey}@${host}`;
+      const why = standing.closedBy === 'owner' ? 'you closed it' : 'nothing opened it for six months';
+      const e = new Error(`${address} is closed at ${host}: ${why}, and a closed address does not come back.`
+        + ` Everything on your pod is untouched. The sign-in used here was ${webId}.`);
+      e.code = 'address-closed';
+      throw e;
+    }
+
     this.publisher = new Publisher({
       config: this.store.getConfig(), remote: this.remote, store: this.store,
       deliverer: this.deliverer, publicKeyPem: keys.rsaPublicPem, assertionKey: null, log: this.log,

package/web/app/boot.mjs

@@ -179,6 +179,7 @@ async function issuerForPod(pod) {
 async function podForFrontedAddress(handle) {
   const res = await fetch(`/.well-known/webfinger?resource=${encodeURIComponent(`acct:${handle}@${location.host}`)}`,
     { headers: { accept: 'application/jrd+json, application/json' } }).catch(() => null);
+  if (res?.status === 410) throw new Error(`@${handle}@${location.host} is closed: nothing on the pod behind it was touched, but the address is gone for good.`);
   if (!res || res.status >= 400) throw new Error(`nobody at this site is called @${handle}@${location.host}`);
   const doc = await res.json().catch(() => ({}));
   const podActorId = (doc.aliases || []).find((a) => /\/ap\/actor$/u.test(String(a)));
@@ -352,6 +353,7 @@ if (typeof document !== 'undefined') (async () => {
         'no-account-here': { title: 'No FediPod account in that pod', retry: 'Create one on this pod', go: () => showIdentity() },
         'no-account': { title: 'No FediPod account in that pod', retry: 'Create one on this pod', go: () => showIdentity() },
         'device-account': { title: 'This account is run from a device', retry: 'Use another pod', go: signIn },
+        'address-closed': { title: 'This address is closed', retry: 'Sign in with another account', go: signIn },
       }[e.code];
 
       // A sign-in the pod would not take: renew it here, and if the pod will

package/web/app/dist/boot.js

@@ -33662,6 +33662,7 @@ async function podForFrontedAddress(handle) {
     `/.well-known/webfinger?resource=${encodeURIComponent(`acct:${handle}@${location.host}`)}`,
     { headers: { accept: "application/jrd+json, application/json" } }
   ).catch(() => null);
+  if (res?.status === 410) throw new Error(`@${handle}@${location.host} is closed: nothing on the pod behind it was touched, but the address is gone for good.`);
   if (!res || res.status >= 400) throw new Error(`nobody at this site is called @${handle}@${location.host}`);
   const doc = await res.json().catch(() => ({}));
   const podActorId = (doc.aliases || []).find((a) => /\/ap\/actor$/u.test(String(a)));
@@ -33809,7 +33810,8 @@ if (typeof document !== "undefined") (async () => {
         // login and the identity screen lands here.
         "no-account-here": { title: "No FediPod account in that pod", retry: "Create one on this pod", go: () => showIdentity() },
         "no-account": { title: "No FediPod account in that pod", retry: "Create one on this pod", go: () => showIdentity() },
-        "device-account": { title: "This account is run from a device", retry: "Use another pod", go: signIn }
+        "device-account": { title: "This account is run from a device", retry: "Use another pod", go: signIn },
+        "address-closed": { title: "This address is closed", retry: "Sign in with another account", go: signIn }
       }[e.code];
       if (e.code === "sign-in-refused" && once("fedipod-renewing")) {
         $("loading").hidden = true;