fedipod 1.3.0 → 1.3.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fedipod",
-  "version": "1.3.0",
+  "version": "1.3.1",
   "description": "Standalone single-actor ActivityPub agent whose wire face, RDF truth and state all live on a Solid pod (CSS). Bundles a Phanpy UI and a Mastodon client-API facade.",
   "type": "module",
   "license": "MIT",

package/web/app/deliver-relay.mjs

@@ -28,10 +28,13 @@ export class RelayDeliverer extends Deliverer {
   async signedFetch(url, init = {}) {
     const body = typeof init.body === 'string' ? init.body : (init.body ? new TextDecoder().decode(init.body) : '');
     const s = await sign({ url, method: init.method || 'GET', headers: init.headers || {}, body }, this.rsaPrivate, this.keyId);
+    // Every signed header goes to the relay, `accept` included: the signature
+    // covers it, so a relay request missing it carries an invalid signature —
+    // and a read without it gets the HTML page instead of the document.
     const relayReq = {
       url: s.url, method: s.method, body,
       headers: {
-        date: s.headers.date, digest: s.headers.digest,
+        date: s.headers.date, digest: s.headers.digest, accept: s.headers.accept,
         'content-type': s.headers['content-type'], signature: s.headers.signature,
       },
     };

package/web/app/dist/sw.js

@@ -67388,6 +67388,7 @@ var RelayDeliverer = class extends Deliverer {
       headers: {
         date: s.headers.date,
         digest: s.headers.digest,
+        accept: s.headers.accept,
         "content-type": s.headers["content-type"],
         signature: s.headers.signature
       }