fedipod 1.30.0 → 1.32.0

package/README.md

@@ -72,7 +72,7 @@ client-to-server, dokieli for one, can post as you. It sends to the outbox
 address in your actor document, which your WebID profile also names, signed in
 at your pod. The post goes out the next time you open fedipod.net.
 
-**The manage page.** `manage account` in the bar opens it: your profile,
+**The manage page.** `manage`, in the bar's account group, opens it: your profile,
 aliases, the gateway, key rotation, recovering posts, parking, moving to
 another server, retiring, and clearing a backlog. It is the same interface
 the DeviceAgent has, described in [the admin interface](gui.md).

package/gateway.md

@@ -153,6 +153,43 @@ on the setup page). Setup reads the account on the pod, keeps its state and
 key there, attaches at the new gateway, and completes the move when the
 agent first acts. See [the DeviceAgent](device-agent.md).
 
+## Accounts that go quiet
+
+A gateway holds no mail. Every delivery it accepts is written into your pod
+inbox, and your agent reads it from there. A BrowserAgent reads only while
+its page is open, so an account nobody opens grows on its pod without limit
+and comes back to a drain of everything at once. fedipod.net keeps two facts
+about each browser account — when its owner last signed in or posted, and
+how much content has arrived since — and acts on them.
+
+**Paused.** After about 5,000 posts, replies, likes, boosts and edits since
+you were last here, or when you say so on the manage page, the door accepts
+content and discards it. Follows, unfollows, account moves, deletions and
+blocks still reach your pod. Signing in ends an automatic pause by itself; a
+pause you set lasts until you lift it.
+
+**Closed.** After six months without a sign-in, or when you say so on the
+manage page, the address is closed for good: its handle, its actor and its
+door answer 410 Gone, other servers drop the account the next time they look,
+and nobody can take the name. Nothing on your pod is touched. An address that
+had already moved to another gateway keeps answering as moved.
+
+Only accounts opened from a browser are counted. A DeviceAgent behind the
+gateway drains its own inbox as it runs, and is never paused or closed by
+time. Accounts from before this was built are counted from their next
+sign-in. A gateway operator sets the cap and the window with
+`FEDIPOD_PAUSE_ITEMS` and `FEDIPOD_CLOSE_DAYS`.
+
+## Notices
+
+Whoever runs the gateway can write notices to everyone with an account
+there. A bell at the right end of the bar, on the record page and in the
+client, shows how many this browser has not opened yet; the list gives the
+titles and each one opens on its own. The operator writes, changes and
+removes them at `/notices`, signed in as the admin the way the roster is.
+A notice is a title and plain text: a blank line starts a paragraph, and a
+web address becomes a link.
+
 ## What the gateway can see
 
 It reads only public data to decide what concerns you: your published

package/gui.md

@@ -1,11 +1,11 @@
 # The Admin interface
 
-In the browser version at fedipod.net, `manage account` in the bar opens this
+In the browser version at fedipod.net, `manage`, in the bar's account group, opens this
 same page for your account. The rest of this page describes it as the
 DeviceAgent serves it; the controls are the same, minus the manual inbox
 drain and the local log, which a browser does not have.
 
-Open `https://localhost:8030/` while any agent is running — it forwards you to the agent — then choose `manage account` and select the actor you want from the local actors dropdown.
+Open `https://localhost:8030/` while any agent is running — it forwards you to the agent — then choose `manage` in the bar's account group and select the actor you want from the local actors dropdown.
 Picking an actor marked "(stopped)" starts its agent, then opens its page.
 
 The software row names the version the agent is running. When the copy on the machine is further ahead — after an update, or after pulling a checkout — it says so and asks for a restart, because an agent goes on serving the code it started with until it is restarted.

package/lib/gateway/front-core.mjs

@@ -21,6 +21,8 @@ import { readCapped, safeFetch, isLoopbackHost } from '../shared/safefetch.mjs';
 import * as podRoot from '../pod/root.mjs';
 import * as podPolicy from '../pod/policy.mjs';
 import { podBaseOfWebId } from '../pod/urls.mjs';
+import { routeQuietApi, noteOpened, noteReceived, closedState, accountState, closedAnswer } from './quiet.mjs';
+import { routeNoticesApi } from './notices.mjs';
 
 // The one WebFinger document, spelled out here rather than imported from
 // wire.mjs: wire drags the agent's whole HTML pipeline (sanitize-html and
@@ -276,7 +278,7 @@ const sameOriginRequest = (request, origin) => {
 
 // Top-level paths a handle may not take, so a name never shadows a route.
 const RESERVED = new Set(['u', 'api', 'signup', 'new-account', 'run', 'admin', 'roster', 'gateway',
-  'gw', 'well-known', 'inbox', 'outbox', 'actor', 'install']);
+  'gw', 'well-known', 'inbox', 'outbox', 'actor', 'install', 'notices']);
 
 // Why a handle is unusable, or null when it is fine. Lowercase letters, digits
 // and hyphens; 2–30 chars; not edge-hyphenated; not a reserved route.
@@ -332,6 +334,7 @@ function identFor(rec, policy = null) {
 //   listDirectory() -> { handle: record }  every row, for the admin roster
 //   removeDirectory(handle) -> boolean     drop a row; false when a seeded row remains
 //   podPut(url, body, ct) -> boolean      append to a user's pod (per-user cred inside)
+//   readReceived / writeReceived / dropReceived, pauseItems, closeDays — see quiet.mjs
 //   podGet(url, { podHome }) -> Response   read a user's pod (public reads; plain fetch
 //                                          is fine). `podHome` is the row's own pod, for
 //                                          an adapter that reads a store directly and so
@@ -409,14 +412,13 @@ async function route(request, ctx) {
     return { status: 200, headers: { 'content-type': 'text/html; charset=utf-8', 'cache-control': 'no-cache' }, body: ctx.runPage };
   }
 
-  // The roster page: the host reading who has accounts here. The page signs in
-  // and calls the roster API below; a deploy with no admin supplies no page.
-  // Off /admin, which is the owner's own record page on every agent.
-  if (pathname === '/roster') {
-    if (request.method !== 'GET' && request.method !== 'HEAD') return { status: 405, headers: {}, body: '' };
-    if (!ctx.adminPage) return notFound();
-    return { status: 200, headers: { 'content-type': 'text/html; charset=utf-8' }, body: ctx.adminPage };
-  }
+  // The roster page (/roster, off /admin, which is the owner's own record
+  // page on every agent) is served with the notices page, in notices.mjs.
+
+  // Notices from the operator to every account here, and the page they are
+  // written on (notices.mjs).
+  const notices = await routeNoticesApi(request, pathname, ctx, { j, verifyPodToken, publicFor, notFound });
+  if (notices) return notices;
 
   // The roster: every directory row, secrets stripped, for the host's own
   // eyes. The reader proves themself the way attach proves a pod — a
@@ -432,6 +434,7 @@ async function route(request, ctx) {
         handle: r.handle, kind: r.kind || 'person', fronted: !r.inboxOnly,
         podHome: r.podHome, webId: r.webId || null, actorUrl: r.actorUrl,
         address: r.address || `@${r.handle}@${ctx.host}`,
+        openedAt: r.openedAt || null, pausedAt: r.pausedAt || null, closedAt: r.closedAt || null,
       }))
       .sort((a, b) => (a.address || a.handle).localeCompare(b.address || b.handle));
     return j(200, { host: ctx.host, accounts });
@@ -639,6 +642,10 @@ async function route(request, ctx) {
     return withApiCors(j(200, { ok: true, handle, movedTo, movedAt }));
   }
 
+  // The owner's say over an account that goes quiet (quiet.mjs).
+  const quiet = await routeQuietApi(request, pathname, ctx, { j, verifyPodToken, webidUnderPod });
+  if (quiet) return quiet;
+
   // The relay: the front sends requests a browser has already signed. A page
   // may not set the Date or Host header, and both are inside an HTTP
   // signature, so a browser-run agent signs and hands the request here; the
@@ -659,6 +666,8 @@ async function route(request, ctx) {
     if (!owner) { console.log(`relay @${handle}: token is for ${webid}, not this account's pod`); return withApiCors(j(403, { error: "the token proves a different pod than this account's" })); }
     const items = Array.isArray(body.requests) ? body.requests : [];
     if (!items.length) return withApiCors(j(400, { error: 'requests must be a non-empty list' }));
+    // Acting through the relay is being here. Hourly at most; see noteOpened.
+    await noteOpened(ctx, handle, rec).catch((e) => console.log(`relay @${handle}: stamp not written: ${e?.message || e}`));
     if (items.length > RELAY_MAX_REQUESTS) return withApiCors(j(400, { error: `at most ${RELAY_MAX_REQUESTS} requests per call` }));
     const results = await Promise.all(items.map((it) => relayOne(it, rec, ctx.fetchImpl || fetch)));
     // One line per relayed request, so a lookup that fails on the far side is
@@ -767,7 +776,7 @@ async function route(request, ctx) {
   //
   // The name is matched against a literal list, so nothing about the request
   // chooses a file.
-  const mPageScript = /^\/(new-account|run|admin)\.js$/u.exec(pathname);
+  const mPageScript = /^\/(new-account|run|admin|notices)\.js$/u.exec(pathname);
   if (mPageScript) {
     const body = ctx.pageScripts?.[`${mPageScript[1]}.js`];
     if (!body) return notFound();
@@ -797,6 +806,9 @@ async function route(request, ctx) {
     if (!m || m[2] !== ctx.host) return notFound();
     const rec = await ctx.lookup(m[1]);
     if (!rec) return notFound();
+    // A closed address is gone, and says so rather than pretending never to
+    // have existed: the name stays taken.
+    if ((await closedState(ctx, m[1], rec)).closed) return closedAnswer({ 'access-control-allow-origin': '*' });
     // A fronted identity's documents live on its pod; the pod's own actor id
     // is the alias, so a client signing in by the fronted address can find
     // the pod (and its login) without a lookup only the host could answer.
@@ -837,19 +849,25 @@ async function route(request, ctx) {
   // An account that moved to another gateway (see /api/move): where its ids
   // live now. The actor below answers as a stub; everything else redirects.
   const movedBase = rec.movedTo ? rec.movedTo.replace(/ap\/actor$/u, '') : null;
-  const gone = (headers = {}) => ({ status: 410, headers: { ...headers, 'content-type': 'application/json', 'cache-control': 'no-store' },
-    body: JSON.stringify({ error: `this account has moved to ${rec.movedTo}` }) });
+  // A closed address (see "accounts that go quiet" above): every id under it
+  // is gone. Asked after moved, which a close does not undo.
+  const closed = movedBase ? false : (await closedState(ctx, up.handle, rec)).closed;
+  const gone = (headers = {}, why = `this account has moved to ${rec.movedTo}`) => closedAnswer(headers, why);
+  const CLOSED = 'this address is closed';
 
   // Inbox: verify at the door, forward to the user's pod inbox. This is the
   // gateway, per user.
   if (up.rest === 'ap/inbox/' || up.rest === 'ap/inbox') {
     if (request.method !== 'POST') return { status: 405, headers: {}, body: '' };
     if (movedBase) { console.log(`door @${up.handle}: delivery → 410 (moved)`); return gone(); }
+    if (closed) { console.log(`door @${up.handle}: delivery → 410 (closed)`); return gone({}, CLOSED); }
     const policy = await policyFor(rec, ctx.fetchImpl || fetch);
-    const { status, reason } = await handleDelivery(request, identFor(rec, policy),
-      { podPut: (u, b, ct) => ctx.podPut(up.handle, u, b, ct), fetchImpl: ctx.fetchImpl });
+    const standing = await accountState(ctx, up.handle, rec);
+    const { status, reason, content, bytes } = await handleDelivery(request, identFor(rec, policy),
+      { podPut: (u, b, ct) => ctx.podPut(up.handle, u, b, ct), fetchImpl: ctx.fetchImpl, paused: standing.paused });
     // One line per delivery, so "did it arrive at the door" has an answer.
     console.log(`door @${up.handle}: delivery → ${status} (${reason})`);
+    if (status === 202 && content) await noteReceived(ctx, up.handle, rec, bytes);
     return { status, headers: {}, body: '' };
   }
 
@@ -876,6 +894,7 @@ async function route(request, ctx) {
         'accept-post': 'application/ld+json, application/activity+json' }, body: null };
     }
     if (movedBase && request.method === 'POST') return gone(cors);
+    if (closed && request.method === 'POST') return gone(cors, CLOSED);
     if (movedBase && (request.method === 'GET' || request.method === 'HEAD')) {
       return { status: 301, headers: { ...cors, location: movedBase + up.rest, 'cache-control': 'no-store' }, body: '' };
     }
@@ -916,6 +935,7 @@ async function route(request, ctx) {
   if (movedBase && up.rest !== 'ap/actor') {
     return { status: 301, headers: { ...open, location: movedBase + up.rest, 'cache-control': 'no-store' }, body: '' };
   }
+  if (closed) return gone(open, CLOSED);
   const podTarget = rec.podHome + up.rest;
   // Media stays on the pod (lib/pod/urls.mjs keeps `media` off the front), but
   // the id rewrite below turns media links onto the front like every other

package/lib/gateway/gateway-core.mjs

@@ -19,9 +19,11 @@ import * as inbox from '../pod/inbox.mjs';
 const DEFAULT_MAX_BYTES = 512 * 1024;   // mirror intake.mjs MAX_ITEM_BYTES
 
 // Control activities are the message itself and must always pass — you want
-// Follows from strangers. Only CONTENT is subject to the concerns-us drop.
-const CONTROL = new Set(['Follow', 'Undo', 'Accept', 'Reject', 'Delete', 'Move',
+// Follows from strangers. Only CONTENT is subject to the concerns-us drop,
+// and to a pause: an account nobody is reading still takes its follows.
+export const CONTROL = new Set(['Follow', 'Undo', 'Accept', 'Reject', 'Delete', 'Move',
   'Add', 'Remove', 'Block']);
+export const isControl = (type) => CONTROL.has(type);
 
 const idOf = (v) => (typeof v === 'string' ? v : v?.id) || null;
 const sha256hex = (s) => crypto.createHash('sha256').update(s).digest('hex');
@@ -64,8 +66,13 @@ function concernsUsAtEdge(activity, ident) {
 // resolved identity policy: { inboxUrl, actorUrl, followersUrl, notesPrefix,
 // following, blocklist, kind, gatewayWebId, hmacSecret }. `podPut(url, body,
 // contentType) → boolean` appends to the pod with the gateway's credential.
-// Returns { status, reason } — the adapter turns it into an HTTP response.
-export async function handleDelivery(request, ident, { podPut, fetchImpl = fetch, maxBytes = DEFAULT_MAX_BYTES } = {}) {
+// `paused` says nobody is reading this inbox: content is accepted and
+// discarded (the same quiet 202 a blocked sender gets, so nothing retries
+// and nothing counts a failure against this host), control still lands.
+// Returns { status, reason } — the adapter turns it into an HTTP response —
+// and, for a delivery that reached the pod, `content` (whether it was
+// content rather than control) and `bytes`, so the caller can keep count.
+export async function handleDelivery(request, ident, { podPut, fetchImpl = fetch, maxBytes = DEFAULT_MAX_BYTES, paused = false } = {}) {
   // Read the body once from a clone; the original, unconsumed, goes to the
   // verifier (which needs the body for the Digest check).
   let raw;
@@ -80,7 +87,9 @@ export async function handleDelivery(request, ident, { podPut, fetchImpl = fetch
   // Edge drops — silent 202 so a rejected sender does not retry a delivery we
   // will never accept. None of these becomes a pod write.
   if (isBlocked(actor, ident.blocklist)) return { status: 202, reason: 'blocked' };
-  if (!CONTROL.has(activity.type) && !concernsUsAtEdge(activity, ident)) {
+  const content = !CONTROL.has(activity.type);
+  if (content && paused) return { status: 202, reason: 'paused' };
+  if (content && !concernsUsAtEdge(activity, ident)) {
     return { status: 202, reason: 'does not concern us' };
   }
 
@@ -107,7 +116,7 @@ export async function handleDelivery(request, ident, { podPut, fetchImpl = fetch
   // holding any state.
   if (!okA) return { status: 502, reason: 'pod inbox write failed' };
   if (receipt) await inbox.writeReceiptBeside(podPut, ident.inboxUrl, hash, receipt);
-  return { status: 202, reason: v.verified ? 'verified' : 'buffered-unverified' };
+  return { status: 202, reason: v.verified ? 'verified' : 'buffered-unverified', content, bytes: Buffer.byteLength(raw) };
 }
 
 // The outbox door: the owner's own post, taken on their behalf.

package/lib/gateway/notices.mjs

@@ -0,0 +1,84 @@
+// notices.mjs — notices from whoever runs the front, to every account here.
+//
+// The operator writes them on the /notices page, proved as the admin the way
+// the roster is; every page of ours asks GET /api/notices once per load and
+// shows a bell when there are any. A notice is a title, a plain-text body and
+// a time. The body is never markup: the pages render it as text.
+//
+// Kept beside the directory, in a store the adapter supplies:
+//   listNotices() -> { id: notice }     putNotice(id, notice)     deleteNotice(id)
+// A front that supplies none has no notices to offer, and says so.
+
+import crypto from 'node:crypto';
+
+const TITLE_MAX = 120;
+const BODY_MAX = 4000;
+const NOTICES_EDGE_SECONDS = 60;
+
+const clean = (v, max) => String(v ?? '').replace(/\r\n?/gu, '\n').trim().slice(0, max);
+const newest = (a, b) => String(b.at || '').localeCompare(String(a.at || ''));
+
+export async function listNotices(ctx) {
+  const all = ctx.listNotices ? await ctx.listNotices() : {};
+  return Object.values(all || {}).filter(Boolean).sort(newest);
+}
+
+// GET is public: what every account is shown. POST is the admin's alone. The
+// /notices page is where the admin writes them; it signs in like the roster.
+// Returns a response, or null when the path is neither.
+export async function routeNoticesApi(request, pathname, ctx, { j, verifyPodToken, publicFor, notFound }) {
+  // The two admin pages: the roster (who has accounts here) and the notices.
+  // Each signs in and calls its API; a deploy with no admin supplies no page.
+  const page = pathname === '/notices' ? ctx.noticesPage : pathname === '/roster' ? ctx.adminPage : undefined;
+  if (page !== undefined) {
+    if (request.method !== 'GET' && request.method !== 'HEAD') return { status: 405, headers: {}, body: '' };
+    if (!page) return notFound();
+    return { status: 200, headers: { 'content-type': 'text/html; charset=utf-8' }, body: page };
+  }
+  if (pathname !== '/api/notices') return null;
+  const open = { 'access-control-allow-origin': '*' };
+  if (request.method === 'OPTIONS') {
+    return { status: 204, headers: { ...open, 'access-control-allow-methods': 'GET, OPTIONS',
+      'access-control-allow-headers': 'Accept', allow: 'GET, POST, OPTIONS' }, body: null };
+  }
+  if (request.method === 'GET') {
+    if (!ctx.listNotices) return j(501, { error: 'this front keeps no notices' });
+    const out = j(200, { notices: await listNotices(ctx) });
+    Object.assign(out.headers, open, publicFor(NOTICES_EDGE_SECONDS));
+    return out;
+  }
+  if (request.method !== 'POST') return { status: 405, headers: {}, body: '' };
+  if (!ctx.putNotice || !ctx.deleteNotice || !ctx.adminWebId) return j(501, { error: 'this front keeps no notices' });
+  const webid = await verifyPodToken(request, pathname, ctx.verifier);
+  if (!webid) return j(401, { error: 'a Solid-OIDC token is required' });
+  if (webid !== ctx.adminWebId) return j(403, { error: 'that WebID is not the admin of this front' });
+  let body;
+  try { body = JSON.parse(await request.clone().text()); } catch { return j(400, { error: 'bad JSON' }); }
+  const action = String(body.action || '');
+  const all = (ctx.listNotices ? await ctx.listNotices() : {}) || {};
+  if (action === 'delete') {
+    const id = String(body.id || '');
+    if (!all[id]) return j(404, { error: 'no such notice' });
+    await ctx.deleteNotice(id);
+    console.log(`front: notice ${id} deleted by the admin`);
+    return j(200, { ok: true, id, deleted: true });
+  }
+  if (action !== 'create' && action !== 'update') return j(400, { error: 'action must be create, update or delete' });
+  const title = clean(body.title, TITLE_MAX);
+  const text = clean(body.body, BODY_MAX);
+  if (!title) return j(400, { error: 'a title is required' });
+  if (!text) return j(400, { error: 'a body is required' });
+  const now = new Date().toISOString();
+  let notice;
+  if (action === 'create') {
+    const id = `${Date.now().toString(36)}-${crypto.randomBytes(4).toString('hex')}`;
+    notice = { id, title, body: text, at: now, updatedAt: now };
+  } else {
+    const prior = all[String(body.id || '')];
+    if (!prior) return j(404, { error: 'no such notice' });
+    notice = { ...prior, title, body: text, updatedAt: now };
+  }
+  await ctx.putNotice(notice.id, notice);
+  console.log(`front: notice ${notice.id} ${action}d by the admin`);
+  return j(action === 'create' ? 201 : 200, { ok: true, notice });
+}

package/lib/gateway/quiet.mjs

@@ -0,0 +1,184 @@
+// quiet.mjs — accounts that go quiet: what the front knows about an account
+// nobody opens, and what its owner may say about it. The router in
+// front-core.mjs asks closedState/accountState at the door and on every
+// public read, stamps noteOpened from the relay, counts noteReceived after
+// a forwarded delivery, and hands /api/open, /api/pause and /api/close here.
+
+// ---- accounts that go quiet -------------------------------------------------
+//
+// The gateway holds no mail: every delivery it takes is two writes into the
+// owner's pod inbox, read only when their browser is open. An account nobody
+// opens grows on its pod without limit, and its owner comes back to a drain
+// of everything at once. So the front keeps two facts about each browser
+// account — when its owner was last here, and how much content has arrived
+// since — and acts on them.
+//
+// `openedAt` is written when the owner signs in (POST /api/open, always) and
+// while they act through the relay (at most hourly). The count of content
+// deliveries since then lives in its own record, keyed by handle AND
+// openedAt: a fresh stamp starts a fresh count with nothing to reset, and a
+// delivery's write can never overwrite a sign-in's. Two deliveries landing
+// together may each read the same total and one increment is lost — the cap
+// comes out slightly soft, never too strict.
+//
+// PAUSED: the count has reached the cap, or the owner said so. Content is
+// accepted and discarded, control (follows, unfollows, moves, deletions,
+// blocks) still lands. The owner's next sign-in ends a cap pause by itself; a
+// pause they set lasts until they lift it.
+//
+// CLOSED: the owner said so, or nothing has opened the account for the close
+// window. Found closed by time, it is written down so it stays closed. From
+// then on the door, the actor and the handle answer 410 — never a failure
+// code, which senders retry and count against this whole host, and never a
+// success, which would keep them sending. Nothing on the pod is touched. An
+// address that moved (see /api/move) keeps answering as moved; closing does
+// not take that away.
+//
+// Only an account whose owner has signed in from a browser carries
+// `openedAt`. A DeviceAgent behind this door never does: it drains its own
+// inbox as it runs, so it is never counted, never paused and never closed by
+// time. Accounts from before this was built are counted from their next
+// sign-in.
+export const DEFAULT_PAUSE_ITEMS = 5000;
+export const DEFAULT_CLOSE_DAYS = 183;                // six months
+const OPEN_STAMP_EVERY_MS = 60 * 60_000;              // the relay's stamp, at most hourly
+const pauseItemsOf = (ctx) => (Number(ctx.pauseItems) > 0 ? Number(ctx.pauseItems) : DEFAULT_PAUSE_ITEMS);
+const closeDaysOf = (ctx) => (Number(ctx.closeDays) > 0 ? Number(ctx.closeDays) : DEFAULT_CLOSE_DAYS);
+const receivedKey = (key, rec) => `${key}/${rec.openedAt}`;
+
+export async function receivedSince(ctx, key, rec) {
+  if (!ctx.readReceived || !rec.openedAt) return { items: 0, bytes: 0 };
+  const got = await ctx.readReceived(receivedKey(key, rec)).catch(() => null);
+  return { items: Number(got?.items) || 0, bytes: Number(got?.bytes) || 0 };
+}
+
+// One more content delivery reached the pod. Nothing to count against until
+// the owner has been here once.
+export async function noteReceived(ctx, key, rec, bytes) {
+  if (!ctx.readReceived || !ctx.writeReceived || !rec.openedAt) return;
+  const so = await receivedSince(ctx, key, rec);
+  await ctx.writeReceived(receivedKey(key, rec), { items: so.items + 1, bytes: so.bytes + (Number(bytes) || 0) })
+    .catch((e) => console.log(`front @${key}: count not written: ${e?.message || e}`));
+}
+
+// The owner is here. `always` is a sign-in; the relay stamps at most hourly,
+// so a busy hour of posting is one write. The count that went with the old
+// stamp is dropped: it is over, and a store should not keep one per hour.
+export async function noteOpened(ctx, key, rec, { always = false } = {}) {
+  if (!ctx.putDirectory) return rec;
+  if (!always && rec.openedAt && Date.now() - Date.parse(rec.openedAt) < OPEN_STAMP_EVERY_MS) return rec;
+  const next = { ...rec, openedAt: new Date().toISOString() };
+  await ctx.putDirectory(key, next);
+  if (rec.openedAt && ctx.dropReceived) await ctx.dropReceived(receivedKey(key, rec)).catch(() => {});
+  return next;
+}
+
+// Closed, and why. Reads no count: this is asked on every public read.
+export async function closedState(ctx, key, rec) {
+  if (rec.movedTo) return { closed: false };
+  if (rec.closedAt) return { closed: true, closedAt: rec.closedAt, closedBy: rec.closedBy || 'owner' };
+  if (rec.openedAt && Date.now() - Date.parse(rec.openedAt) > closeDaysOf(ctx) * 86400_000) {
+    const closedAt = new Date().toISOString();
+    if (ctx.putDirectory) await ctx.putDirectory(key, { ...rec, closedAt, closedBy: 'quiet' });
+    console.log(`front @${key}: closed — nothing opened it since ${rec.openedAt}`);
+    return { closed: true, closedAt, closedBy: 'quiet' };
+  }
+  return { closed: false };
+}
+
+// The whole standing of an account, for the door and for its owner's page.
+export async function accountState(ctx, key, rec) {
+  const c = await closedState(ctx, key, rec);
+  const received = c.closed ? { items: 0, bytes: 0 } : await receivedSince(ctx, key, rec);
+  const cap = pauseItemsOf(ctx);
+  const pausedBy = c.closed ? null : rec.pausedAt ? 'owner' : received.items >= cap ? 'quiet' : null;
+  return {
+    closed: c.closed, closedAt: c.closedAt || null, closedBy: c.closedBy || null,
+    paused: !!pausedBy, pausedBy, pausedAt: rec.pausedAt || null,
+    openedAt: rec.openedAt || null, received, pauseItems: cap, closeDays: closeDaysOf(ctx),
+  };
+}
+
+// A 410 with a reason, the shape every closed or moved id answers with.
+export const closedAnswer = (headers = {}, why = 'this address is closed') => ({
+  status: 410, headers: { ...headers, 'content-type': 'application/json', 'cache-control': 'no-store' },
+  body: JSON.stringify({ error: why }) });
+
+// The owner of a row, proved the way the relay proves them: a pod token whose
+// WebID is the row's, or lives on the row's pod for a row from before WebIDs
+// were recorded.
+async function provedOwner(request, pathname, ctx, rec, { j, verifyPodToken, webidUnderPod }) {
+  const webid = await verifyPodToken(request, pathname, ctx.verifier);
+  if (!webid) return { error: j(401, { error: 'a Solid-OIDC token proving the pod is required' }) };
+  const owner = rec.webId ? webid === rec.webId : webidUnderPod(webid, rec.podHome);
+  if (!owner) return { error: j(403, { error: "the token proves a different pod than this account's" }) };
+  return { webid };
+}
+
+// The owner's three routes. `deps` are front-core's own JSON reply and
+// token check, handed in so this module stays free of the router's privates.
+// Returns a response, or null when the path is not one of these.
+export async function routeQuietApi(request, pathname, ctx, deps) {
+  const { j } = deps;
+  if (request.method !== 'POST' || !['/api/open', '/api/pause', '/api/close'].includes(pathname)) return null;
+  // The owner is here: their browser says so as it opens the account. The
+  // answer is the account's standing at this gateway, which the manage page
+  // shows. A closed address is told so and nothing is written.
+  if (pathname === '/api/open' && request.method === 'POST') {
+    if (!ctx.putDirectory) return j(501, { error: 'this front keeps no directory' });
+    let body;
+    try { body = JSON.parse(await request.clone().text()); } catch { return j(400, { error: 'bad JSON' }); }
+    const handle = String(body.handle || '').toLowerCase();
+    let rec = await ctx.lookup(handle);
+    if (!rec) return j(404, { error: 'no such account' });
+    const who = await provedOwner(request, pathname, ctx, rec, deps);
+    if (who.error) return who.error;
+    const before = await closedState(ctx, handle, rec);
+    if (before.closed) return j(410, { error: 'this address is closed', closedAt: before.closedAt, closedBy: before.closedBy });
+    rec = await noteOpened(ctx, handle, rec, { always: true });
+    return j(200, { ok: true, handle, ...await accountState(ctx, handle, rec) });
+  }
+
+  // The owner pausing their own account, or lifting the pause they set.
+  if (pathname === '/api/pause' && request.method === 'POST') {
+    if (!ctx.putDirectory) return j(501, { error: 'this front keeps no directory' });
+    let body;
+    try { body = JSON.parse(await request.clone().text()); } catch { return j(400, { error: 'bad JSON' }); }
+    const handle = String(body.handle || '').toLowerCase();
+    let rec = await ctx.lookup(handle);
+    if (!rec) return j(404, { error: 'no such account' });
+    const who = await provedOwner(request, pathname, ctx, rec, deps);
+    if (who.error) return who.error;
+    const before = await closedState(ctx, handle, rec);
+    if (before.closed) return j(410, { error: 'this address is closed', closedAt: before.closedAt });
+    if (typeof body.paused !== 'boolean') return j(400, { error: 'paused must be true or false' });
+    if (body.paused && !rec.pausedAt) rec = { ...rec, pausedAt: new Date().toISOString() };
+    if (!body.paused && rec.pausedAt) { rec = { ...rec }; delete rec.pausedAt; }
+    // Lifting a pause is a sign-in's worth of "I am here": the count starts over.
+    if (!body.paused) rec = { ...rec, openedAt: new Date().toISOString() };
+    await ctx.putDirectory(handle, rec);
+    console.log(`front @${handle}: ${body.paused ? 'paused' : 'resumed'} by its owner`);
+    return j(200, { ok: true, handle, ...await accountState(ctx, handle, rec) });
+  }
+
+  // The owner closing their address for good. Repeating it changes nothing.
+  if (pathname === '/api/close' && request.method === 'POST') {
+    if (!ctx.putDirectory) return j(501, { error: 'this front keeps no directory' });
+    let body;
+    try { body = JSON.parse(await request.clone().text()); } catch { return j(400, { error: 'bad JSON' }); }
+    const handle = String(body.handle || '').toLowerCase();
+    let rec = await ctx.lookup(handle);
+    if (!rec) return j(404, { error: 'no such account' });
+    const who = await provedOwner(request, pathname, ctx, rec, deps);
+    if (who.error) return who.error;
+    if (body.confirm !== true) return j(400, { error: 'closing is for good — send confirm: true' });
+    if (!rec.closedAt) {
+      rec = { ...rec, closedAt: new Date().toISOString(), closedBy: 'owner' };
+      await ctx.putDirectory(handle, rec);
+      console.log(`front @${handle}: closed by its owner`);
+    }
+    return j(200, { ok: true, handle, ...await accountState(ctx, handle, rec) });
+  }
+
+  return null;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fedipod",
-  "version": "1.30.0",
+  "version": "1.32.0",
   "description": "Standalone single-actor ActivityPub agent whose wire face, RDF truth and state all live on a Solid pod (CSS). Bundles a Phanpy UI and a Mastodon client-API facade.",
   "type": "module",
   "license": "MIT",

package/scripts/stage-site.mjs

@@ -86,7 +86,7 @@ const shell = (text, c) => text
   .replace('src="../../"', `src="${c.path}"`)
   .replace('<script src="client.js"></script>',
     c.login ? '<script src="/admin/client/client.js"></script>' : '')
-  .replace('>sign out</a>', `>sign out</a>${clientBar()}`)
+  .replace('<span id="account-pick">', `${clientBar()}\n  <span id="account-pick">`)
   .replace('</head>', '<script src="/admin/client-pick.js"></script>\n</head>')
   .replace('</body>', `${clientNews()}</body>`);
 
@@ -136,7 +136,7 @@ const copyAdmin = (from, to) => { fs.mkdirSync(to, { recursive: true });
       // A sign-out beside "manage account", on every bar. It clears the FediPod
       // session, the client's stored account, browser-stored connected keys, and
       // the worker — the /?signout page (boot.js) does the teardown.
-      .replace('>manage account</a>', '>manage account</a>\n  <a id="bar-signout" href="/?signout" title="   Sign out of FediPod and clear this browser">sign out</a>')
+      .replace(/(<a id="bar-manage"[^>]*>manage<\/a>)/u, '$1\n  <a id="bar-signout" href="/?signout" title="   Sign out of FediPod and clear this browser">sign out</a>')
       .replace('</head>', '<style>#actor-pick{display:none!important}</style>\n</head>');
     text = withUpdate(text);
     if (/[/\\]client$/.test(from)) {
@@ -147,7 +147,7 @@ const copyAdmin = (from, to) => { fs.mkdirSync(to, { recursive: true });
     } else if (/[/\\]admin$/.test(from)) {
       // The record page carries the same client control as the shells: it is
       // the page the owner is on when they want to change which client opens.
-      text = text.replace('>sign out</a>', `>sign out</a>${clientBar()}`)
+      text = text.replace('<span id="account-pick">', `${clientBar()}\n  <span id="account-pick">`)
         .replace('</head>', '<script src="/admin/client-pick.js"></script>\n</head>')
   .replace('</body>', `${clientNews()}</body>`);
       // Hide controls the browser build does not carry: the manual drain (it
@@ -197,6 +197,9 @@ fs.writeFileSync(path.join(site, '_redirects'), [
   '/api/roster             /.netlify/functions/front  200',
   '/api/revoke             /.netlify/functions/front  200',
   '/api/agent              /.netlify/functions/front  200',
+  '/api/notices            /.netlify/functions/front  200',
+  '/notices                /.netlify/functions/front  200',
+  '/notices.js             /.netlify/functions/front  200',
   '/u/*                    /.netlify/functions/front  200',
   '/.well-known/*          /.netlify/functions/front  200',
   '/@*                     /.netlify/functions/front  200',