fedipod 1.36.6 → 1.40.0

package/web/app/boot.mjs

@@ -14,13 +14,15 @@
 //                 fedipodMoveIn(answers) brings the address here.
 //   Returning:    fedipodSignin({ address }) — redirect to the pod's login.
 //   On every load: fedipodOnLoad() — finish a redirect, or restore, then boot.
-import { signUp, moveIn, readAccount, handleProblem, AP_ROOT } from './signup.mjs';
+import { signUp, moveIn, readAccount, handleProblem } from './signup.mjs';
+import { podRootPath, chosenRoot } from '../../lib/core/place.mjs';
 import * as podActor from '../../lib/pod/actor.mjs';
 import * as podState from '../../lib/pod/state.mjs';
 import { podBaseOfWebId } from '../../lib/pod/urls.mjs';
 import { resourceExists } from '../../lib/pod/root.mjs';
 import { BrowserRemotePod } from './pod-remote.mjs';
 import { beginLogin, completeLogin, getSession, signOut } from './oidc-session.mjs';
+import { deleteWarm } from './warm-start.mjs';
 import { generateKeys, unwrapKeys, isKeyEnvelope } from './keystore.mjs';
 import { cacheOpenedKeys } from './keys-browser.mjs';
 
@@ -76,16 +78,15 @@ async function bootWorker({ reset = false } = {}) {
 async function readAccountState() {
   const session = await getSession();
   if (!session) throw new Error('Sign in first.');
-  const podFromWebId = podBaseOfWebId(session.webId);   // a suffix-based host, or its own host
-  const state = `${podFromWebId}${AP_ROOT}ap-state/`;
+  // Wherever its owner put it: the type index says, or it is an older account
+  // at `fedipod/` (signup.mjs readAccount).
+  const here = await readAccount(session);
+  if (!here) throw new Error(`could not find a FediPod account on ${podBaseOfWebId(session.webId)}`);
   const remote = new BrowserRemotePod(session, { webId: session.webId, role: 'signup', log: () => {} });
-  const urls = { state };
-  const [cfg, doc] = await Promise.all([
-    podState.readConfig(remote, urls), podState.readKeys(remote, urls),
-  ]);
-  if (!cfg) throw new Error(`could not read this account's config under ${state}`);
-  const actorUrl = `${cfg.remotePod}${cfg.root || AP_ROOT}ap/actor`;
-  return { remote, urls, cfg, doc, actorUrl };
+  const urls = { state: `${here.pod}${here.root}ap-state/` };
+  const doc = await podState.readKeys(remote, urls);
+  const actorUrl = `${here.config.remotePod || here.pod}${here.config.root || here.root}ap/actor`;
+  return { remote, urls, cfg: here.config, doc, actorUrl };
 }
 
 window.fedipodUnlock = async (password) => {
@@ -161,22 +162,33 @@ export function parseAddress(input) {
   if (!handle || !host || !host.includes('.')) return null;
   return { handle, host };
 }
-async function issuerForPod(pod) {
+async function issuerForActor(actorUrl) {
   // The pod's actor says where a client signs in (oauthAuthorizationEndpoint's
-  // origin); failing that, the account provider is the pod host's parent
-  // domain for a subdomain pod, and the host itself for a pod on a path.
+  // origin). Failing that: a host that answers OpenID discovery itself is the
+  // provider (a suffixed pod), and otherwise the provider is
+  // the pod host's parent domain (a subdomain pod).
   try {
-    const authz = await podActor.readIssuer(`${pod}${AP_ROOT}ap/actor`);
+    const authz = await podActor.readIssuer(actorUrl);
     if (authz) return new URL(authz).origin;
   } catch { /* fall through */ }
-  const u = new URL(pod);
-  if (u.pathname !== '/') return u.origin;
+  const u = new URL(actorUrl);
+  const own = await fetch(`${u.origin}/.well-known/openid-configuration`, { headers: { accept: 'application/json' } }).catch(() => null);
+  if (own?.ok) return u.origin;
   const parent = u.host.split('.').slice(1).join('.');
   return `https://${parent || u.host}`;
 }
+// An address on a pod names its actor through the pod host's own WebFinger;
+// an older pod that does not answer is taken to keep it at `fedipod/`.
+async function actorForPodAddress(handle, host) {
+  const res = await fetch(`https://${host}/.well-known/webfinger?resource=${encodeURIComponent(`acct:${handle}@${host}`)}`,
+    { headers: { accept: 'application/jrd+json, application/json' } }).catch(() => null);
+  const doc = res?.ok ? await res.json().catch(() => ({})) : {};
+  const self = (doc.links || []).find((l) => l.rel === 'self' && /activity\+json|ld\+json/u.test(l.type || ''));
+  return self?.href || `https://${host}/fedipod/ap/actor`;
+}
 // An address at this site names a fronted identity. Its documents live on a
 // pod this site's WebFinger names as an alias — the pod's own actor id.
-async function podForFrontedAddress(handle) {
+async function actorForFrontedAddress(handle) {
   const res = await fetch(`/.well-known/webfinger?resource=${encodeURIComponent(`acct:${handle}@${location.host}`)}`,
     { headers: { accept: 'application/jrd+json, application/json' } }).catch(() => null);
   if (res?.status === 410) throw new Error(`@${handle}@${location.host} is closed: nothing on the pod behind it was touched, but the address is gone for good.`);
@@ -184,19 +196,17 @@ async function podForFrontedAddress(handle) {
   const doc = await res.json().catch(() => ({}));
   const podActorId = (doc.aliases || []).find((a) => /\/ap\/actor$/u.test(String(a)));
   if (!podActorId) throw new Error(`@${handle}@${location.host} lives here but names no pod to sign in to`);
-  const tail = `${AP_ROOT}ap/actor`;
-  if (!podActorId.endsWith(tail)) throw new Error(`the pod actor ${podActorId} is not where a FediPod pod keeps one`);
-  return podActorId.slice(0, -tail.length);
+  return podActorId;
 }
 window.fedipodSignin = async ({ address }) => {
   const parsed = parseAddress(address);
   if (!parsed) throw new Error('Enter your address as @you@yourpod (for example @alice@alice.solidcommunity.net).');
   const bad = handleProblem(parsed.handle);
   if (bad) throw new Error(bad);
-  const pod = parsed.host === location.host.toLowerCase()
-    ? await podForFrontedAddress(parsed.handle)
-    : `https://${parsed.host}/`;
-  const issuer = await issuerForPod(pod);
+  const actor = parsed.host === location.host.toLowerCase()
+    ? await actorForFrontedAddress(parsed.handle)
+    : await actorForPodAddress(parsed.handle, parsed.host);
+  const issuer = await issuerForActor(actor);
   const { authorizationUrl } = await beginLogin({ issuer, redirectUri: REDIRECT });
   location.href = authorizationUrl;
 };
@@ -238,6 +248,8 @@ window.fedipodSignOut = async () => {
     let req; try { req = indexedDB.deleteDatabase('fedipod-accounts'); } catch { res(); return; }
     req.onsuccess = req.onerror = req.onblocked = () => res();
   });
+  // The copy of the account's state kept for worker restarts goes with it.
+  await deleteWarm();
 };
 window.fedipodHandleProblem = handleProblem;
 
@@ -445,6 +457,10 @@ if (typeof document !== 'undefined') (async () => {
     $('loading').hidden = true; $('hero').hidden = true; $('landing').hidden = true; $('running').hidden = true;
     $('brand').hidden = false; $('pane-form').hidden = false;
     $('signed-pod').textContent = signedPod;
+    // The container that holds `fedipod/`: the pod's own root unless they say
+    // otherwise. A move keeps the place the account already has.
+    $('container').placeholder = podRootPath(signedPod);
+    $('container-field').hidden = !!moveFrom;
     $('movein-note').hidden = !moveFrom;
     if (moveFrom) {
       $('movein-from').textContent = moveFrom.address;
@@ -484,7 +500,13 @@ if (typeof document !== 'undefined') (async () => {
   const pathPod = () => { try { return new URL(signedPod).pathname !== '/'; } catch { return false; } };
   // A move between gateways is an address at a gateway: no choice either.
   const shape = () => ((pathPod() || moveFrom) ? 'front' : f().shape.value);
-  const answers = () => ({ handle: f().handle.value.trim().toLowerCase(), shape: shape() });
+  const answers = () => ({ handle: f().handle.value.trim().toLowerCase(), shape: shape(), container: f().container.value.trim() });
+  // Where the data will be, in full, as the person types.
+  const previewPlace = () => {
+    if (!signedPod) return;
+    const r = chosenRoot(signedPod, f().container.value);
+    $('place').textContent = r.problem ? '…' : signedPod + r.root;
+  };
   const previewAddr = () => {
     const handle = f().handle.value.trim().toLowerCase();
     let host = '';
@@ -507,7 +529,7 @@ if (typeof document !== 'undefined') (async () => {
     $('register-link').href = url || '#';
     $('register-link').textContent = providerHost() ? `Create your pod at ${providerHost()}` : 'Create your pod at your provider';
   };
-  for (const el of $('form').elements) for (const evt of ['input', 'change']) el.addEventListener(evt, () => { applyMode(); applyShape(); previewAddr(); });
+  for (const el of $('form').elements) for (const evt of ['input', 'change']) el.addEventListener(evt, () => { applyMode(); applyShape(); previewAddr(); previewPlace(); });
   applyMode();
 
   // Step machine: one screen at a time, each gated by its own validation.
@@ -516,7 +538,7 @@ if (typeof document !== 'undefined') (async () => {
   const goStep = (n) => {
     STEP_IDS.forEach((id, i) => { $(id).hidden = i !== n - 1; });
     $('err-1').textContent = ''; $('form-error').textContent = '';
-    if (n === 2) { applyShape(); previewAddr(); }
+    if (n === 2) { applyShape(); previewAddr(); previewPlace(); $('index-ask').hidden = true; }
     if (FOCUS[n]) $(FOCUS[n]).focus();
   };
   const validateStep1 = () => {
@@ -526,6 +548,10 @@ if (typeof document !== 'undefined') (async () => {
   const validateStep2 = () => {
     const hp = window.fedipodHandleProblem(f().handle.value.trim().toLowerCase());
     if (hp) return `Fediverse handle: ${hp}`;
+    if (!moveFrom) {
+      const where = chosenRoot(signedPod, f().container.value).problem;
+      if (where) return `Where to store it: ${where}`;
+    }
     return null;
   };
   $('create').addEventListener('click', showForm);
@@ -549,12 +575,12 @@ if (typeof document !== 'undefined') (async () => {
   $('run-retry').addEventListener('click', () => backToForm($('run-error').textContent));
   $('run-back').addEventListener('click', () => { showLanding(); goStep(1); });
 
-  const LABELS = { pod: 'Checking your pod', keys: 'Making your signing key', gateway: 'Connecting your mail door' };
+  const LABELS = { pod: 'Checking your pod', keys: 'Making your signing key', gateway: 'Connecting your mail door',
+    place: 'Recording where your account lives' };
   const MOVE_LABELS = { pod: 'Reading your account on your pod', gateway: 'Taking your address here', keys: 'Moving your key and account record' };
-  $('form').addEventListener('submit', async (e) => {
-    e.preventDefault(); $('form-error').textContent = '';
-    const e2 = validateStep2(); if (e2) { $('form-error').textContent = e2; goStep(2); return; }
-    const a = answers();
+  // Run the setup. `createIndex` is the person's yes to a new public type index.
+  const run = async (createIndex = false) => {
+    const a = { ...answers(), ...(createIndex ? { createIndex: true } : {}) };
     $('pane-form').hidden = true; $('running').hidden = false;
     $('running-title').textContent = 'Setting up…'; $('run-error').textContent = ''; $('run-actions').hidden = true;
     const steps = $('steps'); steps.textContent = ''; const mark = {};
@@ -566,10 +592,27 @@ if (typeof document !== 'undefined') (async () => {
       location.href = '/admin/client/';
     }
     catch (err) {
+      // No type index: nothing has been written. Ask, on the form.
+      if (err?.code === 'needs-index') {
+        backToForm();
+        $('index-ask').hidden = false;
+        $('index-yes').focus();
+        return;
+      }
       $('running-title').textContent = 'Setup did not finish';
       $('run-error').textContent = err.message || String(err);
       $('run-actions').hidden = false;                // the way out of the failure screen
     }
+  };
+  $('form').addEventListener('submit', async (e) => {
+    e.preventDefault(); $('form-error').textContent = '';
+    const e2 = validateStep2(); if (e2) { $('form-error').textContent = e2; goStep(2); return; }
+    await run();
+  });
+  $('index-yes').addEventListener('click', () => { $('index-ask').hidden = true; run(true); });
+  $('index-no').addEventListener('click', () => {
+    $('index-ask').hidden = true;
+    $('form-error').textContent = 'Sign-up stopped. Nothing was written to your pod.';
   });
 
   if (pendingIdentity) await showIdentity();

package/web/app/copy-mode.mjs

@@ -0,0 +1,223 @@
+// copy-mode.mjs — the browser agent working from its account's copy at the
+// gateway (lib/gateway/copy.mjs, lib/gateway/state-api.mjs), for an account the
+// gateway keeps running.
+//
+// The state documents are read and written at the gateway instead of on the
+// pod, and the lease that says which agent acts is the copy's. What stays on
+// the pod (the key, connected-account passwords) is still read there. The
+// gateway writes the copy to the pod every fifteen minutes.
+import { HttpStorage, StateApiStorage, podOnly } from '../../lib/core/storage.mjs';
+import { Lease } from '../../lib/core/lease.mjs';
+
+// A token this much short of its end is renewed before it is used again.
+const RENEW_BEFORE_MS = 2 * 3600_000;
+
+/**
+ * Ask the gateway for this account's copy, making it if there is none yet.
+ * `handle` names the account when the agent knows it. Returns the copy
+ * ({ handle, base, token, expiresAt }) or null, in which case the account
+ * works from its pod.
+ */
+export async function openCopy(agent, frontOrigin, { handle = null, kept = null } = {}) {
+  if (kept && kept.expiresAt - Date.now() > RENEW_BEFORE_MS) return kept;
+  if (!agent.sessionFetch || !frontOrigin) return null;
+  let res;
+  try {
+    res = await agent.sessionFetch(`${frontOrigin.replace(/\/$/u, '')}/api/state/open`, {
+      method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(handle ? { handle } : {}),
+    });
+  } catch (e) { agent.log(`the account's copy: ${e.message}`); return null; }
+  if (res.status !== 200) {
+    // 404, 409 and 501 are answers (no copy for this account here); anything
+    // else is worth saying.
+    if (![404, 409, 501].includes(res.status)) agent.log(`the account's copy: the gateway answered ${res.status}`);
+    return null;
+  }
+  const copy = await res.json().catch(() => null);
+  return copy?.base && copy?.token
+    ? { handle: copy.handle, base: copy.base, token: copy.token, expiresAt: copy.expiresAt, podHome: copy.podHome || null }
+    : null;
+}
+
+// Every request to the copy carries its token, read at the time of asking so a
+// renewed one is used at once.
+const tokenFetch = (agent) => (u, i = {}) => fetch(u, {
+  ...i, headers: { ...(i.headers || {}), authorization: `Bearer ${agent.copy.token}` },
+});
+
+/** The store's storage, and the lease, for working from the copy. */
+export function copyStorage(agent, podState) {
+  const s = new StateApiStorage(agent.copy.base, {
+    fetchImpl: (u, i) => fetch(u, i), token: agent.copy.token, holder: agent.holderId, pod: podState,
+    // Refused: another agent (an app at the gateway, another browser) took
+    // the lease. This one stops acting at once rather than at its next renewal.
+    onRefused: () => standDown(agent),
+  });
+  Object.defineProperty(s, 'token', { get: () => agent.copy.token, set() {} });
+  return s;
+}
+
+export function copyLeaseOf(agent) {
+  return new Lease({ url: `${agent.copy.base}lease.json`, fetchImpl: tokenFetch(agent), log: agent.log, id: agent.holderId });
+}
+
+// Swap the lease the agent and its drain go by.
+function useLease(agent, lease) {
+  agent.lease.stopRenewal();
+  agent.lease = lease;
+  if (agent.intake) agent.intake.lease = lease;
+  lease.onLost = () => agent.demote();
+}
+
+/**
+ * Before this browser acts: is the copy's lease still its own? An app at the
+ * gateway may have taken it and let it go since. Free again, it is taken back
+ * and the copy read afresh, so the action starts from what the app wrote.
+ * Held by somebody else, the browser stands down and the caller takes over as
+ * from any other device. True when this browser holds it now.
+ */
+export async function ensureCopyLease(agent) {
+  const cur = await agent.lease.readFresh().catch(() => null);
+  if (!cur || typeof cur !== 'object') return true;           // unreadable: the copy refuses if it is wrong
+  if (cur.holder === agent.lease.id && Date.now() < cur.expiresAt) return true;
+  // Held by another agent: this browser stands down, dropping what it had
+  // queued, and the caller takes over, reading the copy afresh.
+  if (Date.now() < cur.expiresAt) { agent.demote(); await agent.store.discardPending(); return false; }
+  // Free: an app acted and let it go. Writes queued here since are older than
+  // what the app wrote, so they are dropped, not sent.
+  agent._ensuring = true;
+  try {
+    await agent.store.discardPending();
+    if (!await agent.lease.acquire()) { agent.demote(); return false; }
+    await agent.store.load({ force: true });
+    agent.lease.startRenewal();
+    return true;
+  } finally { agent._ensuring = false; }
+}
+
+/**
+ * Another agent took the lease: an app acting at the gateway, which gives it
+ * back as soon as it is done. This browser stops acting at once, then takes
+ * the lease back when it is free, reading the copy afresh first (goActive), so
+ * it is not left watching for the viewer poll's five minutes. Another browser
+ * that took over keeps it, and the viewer poll carries on as before.
+ */
+export function standDown(agent) {
+  if (agent._retaking || agent._ensuring) return;
+  if (!agent.viewer) agent.demote();
+  agent._retaking = (async () => {
+    try {
+      // What was queued before the other agent acted is older than what it wrote.
+      await agent.store.discardPending();
+      for (const wait of [3000, 20_000]) {
+        await new Promise((r) => setTimeout(r, wait));
+        if (!agent.viewer) return;
+        const cur = await agent.lease.readFresh().catch(() => null);
+        // Held by anyone but the gateway (copy.mjs: GATEWAY_HOLDER) is another browser's.
+        if (cur && typeof cur === 'object' && cur.holder !== 'gateway' && Date.now() < cur.expiresAt) return;
+        if (await agent.lease.acquire()) {
+          clearTimeout(agent._viewerTimer); agent._viewerTimer = null;
+          // Read what the app wrote, then carry on as a restart moments later
+          // would: no republishing, one drain, the inbox watched again.
+          await agent.store.load({ force: true });
+          const now = Date.now();
+          await agent.goActive({ warm: { hereAt: now, drainedAt: 0, wakeAt: now, resubscribe: true } });
+          agent.log('took the account back from the gateway');
+          return;
+        }
+      }
+    } finally { agent._retaking = null; }
+  })();
+}
+
+/**
+ * Move a running agent from its pod onto the copy: everything written, the
+ * pod's lease let go, the copy made from the pod, and the agent carried over
+ * holding the copy's lease. Returns whether it moved; when it could not, the
+ * agent takes the pod's lease back and goes on as it was.
+ */
+export async function moveIntoCopy(agent, frontOrigin) {
+  if (agent.copy) return true;
+  await agent.store.commit();
+  await agent.lease.release();
+  const copy = await openCopy(agent, frontOrigin, { handle: agent.doorKey });
+  if (!copy) {
+    if (await agent.lease.acquire()) agent.lease.startRenewal();
+    return false;
+  }
+  agent.copy = copy;
+  const lease = copyLeaseOf(agent);
+  if (!await lease.acquire()) { agent.log('the account\'s copy is held by another agent; reading only'); }
+  agent.store.attach(copyStorage(agent, new HttpStorage(agent.urls.state, (u, i) => agent.remote.fetch(u, i))));
+  await agent.store.load({ force: true });
+  useLease(agent, lease);
+  if (lease.heldUntil) lease.startRenewal(); else agent.demote();
+  agent.log('working from the account\'s copy at the gateway');
+  return true;
+}
+
+/**
+ * Back to the pod: everything written, the copy's lease let go, the gateway
+ * asked to write the copy to the pod and give it up, and the agent carried
+ * back onto the pod. Returns { ok } or { ok: false, why }.
+ */
+export async function leaveCopy(agent) {
+  if (!agent.copy) return { ok: true };
+  await agent.store.commit();
+  await agent.lease.release();
+  const res = await tokenFetch(agent)(`${agent.copy.base}leave`, { method: 'POST' }).catch((e) => ({ status: 0, e }));
+  if (res.status !== 200) {
+    if (await agent.lease.acquire()) agent.lease.startRenewal();
+    return { ok: false, why: `the gateway could not write the copy to the pod (${res.status || res.e?.message})` };
+  }
+  agent.copy = null;
+  const podFetch = (u, i) => agent.remote.fetch(u, i);
+  const lease = new Lease({ url: `${agent.urls.state}lease.json`, fetchImpl: podFetch, log: agent.log, id: agent.holderId });
+  agent.store.attach(new HttpStorage(agent.urls.state, podFetch));
+  await agent.store.load({ force: true });
+  useLease(agent, lease);
+  if (await lease.acquire()) lease.startRenewal(); else agent.demote();
+  agent.log('working from the pod again');
+  return { ok: true };
+}
+
+/**
+ * The gateway has a new identity, and this account's copy was kept under the
+ * old one, which the new one cannot write back for (the owner's rules name the
+ * old). The owner's own browser does it: every document in the copy written to
+ * the pod as the owner, the pod's lease taken, the gateway told to forget the
+ * copy, and the agent carried back onto the pod. Its rules then name the new
+ * identity as any first start does (setKeeper), and a new copy is made.
+ * Returns { ok } or { ok: false, why }; nothing is forgotten unless everything
+ * reached the pod.
+ */
+export async function handOverCopy(agent) {
+  if (!agent.copy) return { ok: true };
+  await agent.store.commit();
+  const podFetch = (u, i) => agent.remote.fetch(u, i);
+  const pod = new HttpStorage(agent.urls.state, podFetch);
+  const docs = agent.store.names().filter((n) => !podOnly(n)).map((n) => [n, agent.store.read(n, null)]).filter(([, v]) => v !== null);
+  for (const [name, value] of docs) {
+    const w = await pod.write(name, JSON.stringify(value, null, 2) + '\n', 'application/json');
+    if (!w.ok) return { ok: false, why: `${name} could not be written to the pod (${w.why})` };
+  }
+  const podLease = new Lease({ url: `${agent.urls.state}lease.json`, fetchImpl: podFetch, log: agent.log, id: agent.holderId });
+  if (!await podLease.takeover()) return { ok: false, why: 'the pod\'s lease could not be taken' };
+  const res = await tokenFetch(agent)(`${agent.copy.base}forget`, { method: 'POST', headers: { 'x-fedipod-holder': agent.holderId } })
+    .catch((e) => ({ status: 0, e }));
+  if (res.status !== 200) return { ok: false, why: `the gateway would not let the copy go (${res.status || res.e?.message})` };
+  agent.copy = null;
+  agent.store.attach(pod);
+  await agent.store.load({ force: true });
+  useLease(agent, podLease);
+  podLease.startRenewal();
+  agent.log(`handed the account's copy over: ${docs.length} documents written to the pod`);
+  return { ok: true };
+}
+
+/** A token near its end, renewed; the hourly check-in asks. */
+export async function renewCopyToken(agent, frontOrigin) {
+  if (!agent.copy || agent.copy.expiresAt - Date.now() > RENEW_BEFORE_MS) return;
+  const fresh = await openCopy(agent, frontOrigin, { handle: agent.copy.handle });
+  if (fresh) agent.copy = fresh;
+}