fedipod 1.36.6 → 1.40.0

package/web/app/index.html

@@ -191,6 +191,13 @@ a { color: var(--accent); }
         <span id="signed-pod-label" class="grouplabel">Your pod</span>
         <p id="signed-pod" role="status" aria-labelledby="signed-pod-label"></p>
 
+        <div id="container-field">
+          <label for="container">Store your data in a container named fedipod, inside this container</label>
+          <input type="text" id="container" name="container" autocomplete="off" spellcheck="false"
+            aria-describedby="container-hint">
+          <p class="hint" id="container-hint">Your data will be at <span id="place">…</span>. This is permanent.</p>
+        </div>
+
         <!-- Shown when the pod's account lives at another gateway: this is a
              move, not a new account. -->
         <p id="movein-note" hidden>Moving <strong id="movein-from"></strong> to this site.
@@ -217,6 +224,15 @@ a { color: var(--accent); }
       <p class="hint">The handle and the pod cannot be changed afterwards. Everything else — display
         name, bio, pictures — you set later in the client.</p>
       <p class="err" id="form-error" role="alert"></p>
+      <div id="index-ask" role="alertdialog" aria-labelledby="index-ask-text" hidden>
+        <p id="index-ask-text">Your pod has no public type index, the list Solid apps use to find your
+          things. FediPod needs one to record where your account lives. Create it? It will be readable
+          by anyone, like your profile.</p>
+        <p>
+          <button type="button" id="index-no">No, stop</button>
+          <button type="button" class="primary" id="index-yes">Create it and continue</button>
+        </p>
+      </div>
       <p>
         <button type="button" id="back-1">Back</button>
         <button type="submit" class="primary" id="submit">Create your Fediverse account</button>

package/web/app/signup.mjs

@@ -16,14 +16,18 @@ import * as podState from '../../lib/pod/state.mjs';
 import { resourceExists } from '../../lib/pod/root.mjs';
 import { podBaseOfWebId } from '../../lib/pod/urls.mjs';
 import { cacheOpenedKeys } from './keys-browser.mjs';
+import { chosenRoot, findAccount, recordPlace, hasPublicIndex } from '../../lib/core/place.mjs';
 
-// The container everything the agent publishes hangs under. New pods made here
-// use `fedipod/`; new installs default to `fedipod/` too, and older ones keep
-// that predate this, so those pods are untouched. The name is stored on the
-// config, so the agent reads it rather than guessing.
-export const AP_ROOT = 'fedipod/';
-const actorUrlFor = (pod) => `${pod}${AP_ROOT}ap/actor`;
-const keysDocFor = (pod) => `${pod}${AP_ROOT}ap-state/keys.json`;
+// Everything the agent publishes hangs under a container named `fedipod`, in
+// the container its owner chose (lib/core/place.mjs). The root is stored on the
+// config, so the agent reads it rather than guessing, and the place is recorded
+// in the owner's public type index, which is how the account is found again.
+const actorUrlFor = (pod, root) => `${pod}${root}ap/actor`;
+const keysDocFor = (pod, root) => `${pod}${root}ap-state/keys.json`;
+const stateOf = (pod, root) => `${pod}${root}ap-state/`;
+
+/** The account's config as it sits under `root`, read as its owner. */
+const readConfigAt = (remote, pod) => (root) => podState.readConfig(remote, { state: stateOf(pod, root) });
 
 const HANDLE_RE = /^[a-z0-9-]{2,30}$/;
 
@@ -42,7 +46,7 @@ export function handleProblem(handle) {
 // identity being built, so changing the handle on the form starts a clean
 // attempt.
 const PROGRESS = new Map();
-const progressKey = (webId, a) => [webId, a.handle, a.shape || 'pod'].join('|');
+const progressKey = (webId, a) => [webId, a.handle, a.shape || 'pod', a.container || ''].join('|');
 
 /** A fronted name is one per gateway; a taken one is refused before anything is made. */
 async function assertFrontNameFree(frontOrigin, handle) {
@@ -58,7 +62,12 @@ async function assertFrontNameFree(frontOrigin, handle) {
  * note) so a page can draw the same tick list the CLI setup shows. Resumable:
  * see PROGRESS above.
  *
- * answers: { handle, shape?: 'pod'|'front', gateway? }
+ * answers: { handle, shape?: 'pod'|'front', gateway?, container?, createIndex? }
+ *   container    the path of the container that holds `fedipod/` (the pod root
+ *                when empty)
+ *   createIndex  the person's yes to making a public type index when their
+ *                profile names none; without it, sign-up stops before writing
+ *                anything and says so (error code 'needs-index')
  * session: { webId, issuer, fetch } — the Solid-OIDC session from the pod's
  *          own login (oidc-session.mjs). The pod is where the WebID lives.
  *
@@ -91,11 +100,27 @@ export async function signUp(answers, { session, onStep = () => {}, frontOrigin
     skip: (note) => onStep(key, 'skipped', note),
   });
 
+  const place = chosenRoot(pod, answers.container);
+  if (place.problem) throw new Error(`Where to store it: ${place.problem}.`);
+  const root = place.root;
+  const remote = new BrowserRemotePod(session, { webId, role: 'signup', log: () => {} });
+
   // --- the pod --- (the session came from it; what is checked is that it has no account yet)
   const podStep = step('pod');
   if (!prog.pod) {
     podStep.running('checking your pod');
-    if (await resourceExists(session.fetch, actorUrlFor(pod))) throw new Error('The pod already hosts a FediPod account. If you want a second account, put it on a different pod.');
+    if (await findAccount(remote, pod, readConfigAt(remote, pod))
+      || await resourceExists(session.fetch, actorUrlFor(pod, root))) {
+      throw new Error('The pod already hosts a FediPod account. If you want a second account, put it on a different pod.');
+    }
+    if (await resourceExists(session.fetch, `${pod}${root}`)) {
+      throw new Error(`${new URL(pod + root).pathname} is already there and is not a FediPod account — choose another container.`);
+    }
+    // Where the account lives is recorded in the public type index. With none,
+    // the person is asked first; nothing is written before they have said yes.
+    if (!answers.createIndex && !await hasPublicIndex(remote, pod)) {
+      throw Object.assign(new Error('Your profile names no public type index.'), { code: 'needs-index' });
+    }
     prog.pod = pod;
     podStep.ok(pod);
   } else {
@@ -108,11 +133,11 @@ export async function signUp(answers, { session, onStep = () => {}, frontOrigin
   const pathPod = new URL(pod).pathname !== '/';
   const fronted = pathPod || wantsFront;
   if (fronted && !frontOrigin) {
-    throw new Error(`${pod} is a suffix-based host, so its address must live at a gateway, and this page has none.`);
+    throw new Error(`${pod} is a suffixed pod, so its address must live at a gateway, and this page has none.`);
   }
   if (pathPod && !wantsFront) await assertFrontNameFree(frontOrigin, handle);
 
-  const actorUrl = actorUrlFor(pod);                              // where the documents live, always
+  const actorUrl = actorUrlFor(pod, root);                        // where the documents live, always
   const frontActor = fronted ? `${frontOrigin.replace(/\/$/, '')}/u/${handle}/ap/actor` : null;
 
   // Connect the gateway (fedipod.net) before the key is made, because a
@@ -133,7 +158,7 @@ export async function signUp(answers, { session, onStep = () => {}, frontOrigin
       // bare pod root sends this identity's mail to <pod>/ap/inbox/ — outside
       // the container the agent drains, where nothing would ever read it. The
       // manage surface has always sent `urls.home`; this is the same value.
-      body: JSON.stringify({ handle, podHome: `${pod}${AP_ROOT}`, actorUrl, kind: 'person', fronted }),
+      body: JSON.stringify({ handle, podHome: `${pod}${root}`, actorUrl, kind: 'person', fronted }),
     });
     const d = await res.json().catch(() => ({}));
     if (res.status !== 201 || !d.hmacSecret) {
@@ -163,7 +188,6 @@ export async function signUp(answers, { session, onStep = () => {}, frontOrigin
   // The opened copy is kept in this browser (IndexedDB) so the worker can boot
   // itself after an idle kill with no read. A browser that has no copy reads
   // the pod's with its session — see keys-browser.mjs.
-  const remote = new BrowserRemotePod(session, { webId, role: 'signup', log: () => {} });
   const keysStep = step('keys');
   let keys;
   if (!prog.keysStored) {
@@ -177,13 +201,13 @@ export async function signUp(answers, { session, onStep = () => {}, frontOrigin
     // pod this key may sit on.
     try {
       await podState.provisionKey(remote, {
-        stateUrl: `${pod}${AP_ROOT}ap-state/`,
-        keysUrl: keysDocFor(pod),
+        stateUrl: stateOf(pod, root),
+        keysUrl: keysDocFor(pod, root),
         keys,
       });
     } catch (e) {
       throw new Error(`could not store the signing key on the pod (${e.message}). `
-        + `You are signed in as ${webId} — that WebID must own ${pod} and its ${AP_ROOT} must be writable by it.`);
+        + `You are signed in as ${webId} — that WebID must own ${pod} and ${root} in it must be writable by it.`);
     }
     // This browser's own opened copy, so the boot that follows needs no read.
     // Best effort: a browser that refuses IndexedDB (private mode) reads the
@@ -197,7 +221,7 @@ export async function signUp(answers, { session, onStep = () => {}, frontOrigin
   }
 
   const config = {
-    remotePod: pod, root: AP_ROOT, handle, name: handle, issuer: String(session.issuer || '').replace(/\/+$/, ''),
+    remotePod: pod, root, handle, name: handle, issuer: String(session.issuer || '').replace(/\/+$/, ''),
     createdAt: new Date().toISOString(),
     ...(gateway ? { gateway } : {}),
   };
@@ -205,11 +229,24 @@ export async function signUp(answers, { session, onStep = () => {}, frontOrigin
   // sign-in — which arrives with only an OIDC session — can read the account's
   // config and key from the pod and boot.
   try {
-    await podState.writeConfig(remote, { state: `${pod}${AP_ROOT}ap-state/` }, config);
+    await podState.writeConfig(remote, { state: stateOf(pod, root) }, config);
   } catch (e) {
     throw new Error(`could not store the config on the pod (${e.message})`);
   }
 
+  // --- where it lives, in the public type index ---
+  if (!prog.placed) {
+    const placeStep = step('place');
+    placeStep.running('recording where your account lives');
+    try {
+      await recordPlace(remote, pod, actorUrl, { create: !!answers.createIndex });
+    } catch (e) {
+      throw new Error(`could not record where your account lives in your type index (${e.message})`);
+    }
+    prog.placed = true;
+    placeStep.ok();
+  }
+
   PROGRESS.delete(key);                                          // finished — nothing left to resume
 
   const host = gateway?.frontActor ? new URL(gateway.frontActor).host : new URL(pod).host;
@@ -232,14 +269,16 @@ export async function signUp(answers, { session, onStep = () => {}, frontOrigin
 export async function readAccount(session) {
   const pod = podBaseOfWebId(session.webId);
   const remote = new BrowserRemotePod(session, { webId: session.webId, role: 'signup', log: () => {} });
-  const config = await podState.readConfig(remote, { state: `${pod}${AP_ROOT}ap-state/` }).catch(() => null);
-  if (!config) return null;
+  // A person account: the browser build is persons only.
+  const found = await findAccount(remote, pod, readConfigAt(remote, pod), (c) => (c.kind || 'person') === 'person');
+  if (!found) return null;
+  const { root, config } = found;
   const frontActor = config.gateway?.frontActor || null;
   let frontHost = null;
   try { frontHost = frontActor ? new URL(frontActor).host : null; } catch { frontHost = null; }
   let podHost = '';
   try { podHost = new URL(config.remotePod || pod).host; } catch { podHost = ''; }
-  return { pod, config, frontActor, frontHost, address: `@${config.handle}@${frontHost || podHost}` };
+  return { pod, root, config, frontActor, frontHost, address: `@${config.handle}@${frontHost || podHost}` };
 }
 
 /**
@@ -268,9 +307,9 @@ export async function moveIn(answers, { session, onStep = () => {}, frontOrigin
   const here = await readAccount(session);
   if (!here?.frontActor) throw new Error('this pod holds no account at another gateway to move here');
   if (here.frontHost === new URL(origin).host) throw new Error('this account already lives at this gateway');
-  const { pod, config: old } = here;
+  const { pod, root, config: old } = here;
   const remote = new BrowserRemotePod(session, { webId: session.webId, role: 'signup', log: () => {} });
-  const urls = { state: `${pod}${AP_ROOT}ap-state/` };
+  const urls = { state: stateOf(pod, root) };
   const keys = await podState.readKeys(remote, urls);
   if (!keys?.rsa) throw new Error('could not read this account\'s signing key on the pod');
   if (isKeyEnvelope(keys)) throw new Error(`this account's key is still under a password from an earlier version — sign in once at ${here.frontHost} first, then come back`);
@@ -282,7 +321,7 @@ export async function moveIn(answers, { session, onStep = () => {}, frontOrigin
   await assertFrontNameFree(origin, handle);
   const res = await session.fetch(`${origin}/api/attach`, {
     method: 'POST', headers: { 'content-type': 'application/json' },
-    body: JSON.stringify({ handle, podHome: `${pod}${AP_ROOT}`, actorUrl: actorUrlFor(pod), kind: old.kind || 'person', fronted: true }),
+    body: JSON.stringify({ handle, podHome: `${pod}${root}`, actorUrl: actorUrlFor(pod, root), kind: old.kind || 'person', fronted: true }),
   });
   const d = await res.json().catch(() => ({}));
   if (res.status !== 201 || !d.hmacSecret) throw new Error(`could not attach to this gateway (HTTP ${res.status}): ${d.error || ''}`);
@@ -311,7 +350,7 @@ export async function moveIn(answers, { session, onStep = () => {}, frontOrigin
   } catch (e) {
     throw new Error(`could not update your account on the pod (${e.message})`);
   }
-  await cacheOpenedKeys(actorUrlFor(pod), keys);
+  await cacheOpenedKeys(actorUrlFor(pod, root), keys);
   keysStep.ok();
 
   return { config, address: `@${handle}@${new URL(origin).host}`, movedFrom: config.movedFrom };

package/web/app/sw-src.mjs

@@ -9,6 +9,7 @@
 import { BrowserAgent } from './agent.mjs';
 import { getSession } from './oidc-session.mjs';
 import { ADMIN_PATHS } from './admin-facade.mjs';
+import { bridge } from '../../lib/client/masto/bridge.mjs';
 
 let agent = null;
 let booting = null;
@@ -105,17 +106,19 @@ self.addEventListener('activate', (e) => e.waitUntil(self.clients.claim()));
 // browsers kill an idle service worker and restart it fresh, and the client at
 // /app/ never posts 'boot' — so without on-demand boot every request after a
 // restart 503s. On a boot failure `booting` is cleared so the next request retries.
-async function bootFromSession(frontOrigin) {
+async function bootFromSession(frontOrigin, restart) {
   const oidc = await getSession();
   if (!oidc) throw new Error('no session — sign in first');
   const a = new BrowserAgent({ log: (m) => console.log('[sw-agent]', m) });
-  await a.boot({ oidc, frontOrigin: frontOrigin || self.location.origin });
+  await a.boot({ oidc, frontOrigin: frontOrigin || self.location.origin, restart });
   agent = a;
   return a;
 }
-function ensureBooting(frontOrigin) {
+// `restart`: booting on demand after the browser killed the worker, not
+// because the owner just signed in.
+function ensureBooting(frontOrigin, { restart = false } = {}) {
   if (agent) return Promise.resolve(agent);
-  if (!booting) booting = bootFromSession(frontOrigin).catch((err) => { booting = null; throw err; });
+  if (!booting) booting = bootFromSession(frontOrigin, restart).catch((err) => { booting = null; throw err; });
   return booting;
 }
 
@@ -144,6 +147,10 @@ self.addEventListener('message', (e) => {
 self.addEventListener('fetch', (e) => {
   const url = new URL(e.request.url);
   if (url.origin !== self.location.origin || !(isFacade(url.pathname) || isAdmin(url.pathname))) return;   // static → network
+  // A Mastodon app somewhere else signing in at this address, or the pod
+  // sending its owner back to that sign-in: the gateway's, not this browser's
+  // agent, whose own client signs in from a page on this origin.
+  if (url.pathname.startsWith('/oauth/') && !sameOriginReferrer(e.request)) return;
   e.respondWith(serve(e.request, url));
 });
 
@@ -156,63 +163,18 @@ async function serve(request, url) {
   }
   // Boot on demand from the stored session, so the client works even when the
   // worker was restarted (idle-killed) and nobody posted 'boot' this time.
-  if (!agent) { try { await ensureBooting(); } catch { /* no session → 503 below */ } }
+  if (!agent) { try { await ensureBooting(undefined, { restart: true }); } catch { /* no session → 503 below */ } }
   if (!agent) return json(503, { error: 'not signed in on this browser — sign in at the front page' });
-  // Bytes, not text. A multipart upload is binary — read as text it comes back
-  // through a UTF-8 round trip that replaces every byte that is not valid UTF-8,
-  // which is most of a JPEG, so the boundary search found nothing and every
-  // media and avatar upload answered "422 file required". readBody() does
-  // `data += chunk`, which decodes a Buffer the same way it always did, so the
-  // JSON and form paths are unchanged.
-  const bodyBytes = (request.method === 'GET' || request.method === 'HEAD')
-    ? null : Buffer.from(new Uint8Array(await request.arrayBuffer()));
-  // The admin facade is JSON-only (the gate above enforces the content type),
-  // and takes its body already decoded.
-  const bodyText = bodyBytes ? new TextDecoder().decode(bodyBytes) : '';
-  const reqHeaders = {}; for (const [k, v] of request.headers) reqHeaders[k.toLowerCase()] = v;
-  // `host` is a forbidden header name, so a fetch Request never carries one and
-  // the loop above cannot produce it — but it is a header every real request
-  // arrives with, and the agent reads it to say where it lives. Without it the
-  // notifications `Link` header named `https://undefined/`, so a client that
-  // paged by following it (which is how a client is meant to page) walked off
-  // the origin and saw nothing past the first screen.
-  reqHeaders.host = url.host;
-  const listeners = {};
-  // The body's events fire on the next microtask. A route that reads the body
-  // may only register for them after an await or two — the facade dispatches
-  // through its area modules first — so a listener that arrives after the
-  // events have fired is given them at once, in the order it asks.
-  let fired = false;
-  const req = { method: request.method, url: url.pathname + url.search, headers: reqHeaders,
-    // notAllowed() above let this through, so it came from this origin. Said
-    // out loud rather than left implicit: MastoApi asks (through the
-    // authorities object in agent.mjs) whether a request is the owner's own,
-    // and in a browser that question means exactly this.
+  const { req, res, bodyText, response } = await bridge(request, url, {
+    // notAllowed() above let this through, so it came from this origin.
     sameOrigin: true,
-    socket: { encrypted: url.protocol === 'https:' },
-    on(ev, cb) {
-      (listeners[ev] ||= []).push(cb);
-      if (fired) { if (ev === 'data' && bodyBytes?.length) cb(bodyBytes); else if (ev === 'end') cb(); }
-      return req;
-    },
-    destroy() {} };
-  queueMicrotask(() => {
-    fired = true;
-    if (bodyBytes?.length) (listeners.data || []).forEach((cb) => cb(bodyBytes));
-    (listeners.end || []).forEach((cb) => cb());
   });
-  let status = 200; const outHeaders = {}; const chunks = [];
-  const res = {
-    writeHead(s, h) { status = s; if (h) Object.assign(outHeaders, h); return res; },
-    setHeader(k, v) { outHeaders[k] = v; }, getHeader(k) { return outHeaders[k]; },
-    write(c) { chunks.push(c); }, end(c) { if (c) chunks.push(c); },
-  };
   try {
     const handled = isAdmin(url.pathname)
       ? await agent.admin.handle(req, res, url.pathname, url, bodyText)
       : await agent.masto.handle(req, res, url.pathname, url);
     if (!handled) return fetch(request);
-    return new Response(chunks.join(''), { status, headers: { 'content-type': 'application/json', ...outHeaders } });
+    return response();
   } catch (err) {
     return json(500, { error: err.message });
   }

package/web/app/update.js

@@ -64,7 +64,8 @@
       setTimeout(go, 4000);   // a pages-only change: no new worker will take over
     } catch { /* offline, or the site did not answer: try again later */ }
   };
-  // Often enough that a reader watching a page being worked on sees it.
+  // Every ten minutes: a deploy reaches an open page soon enough, and each
+  // open tab asks the site 144 times a day rather than 1,440.
   setTimeout(check, 5000);
-  setInterval(check, 60 * 1000);
+  setInterval(check, 10 * 60 * 1000);
 })();

package/web/app/warm-start.mjs

@@ -0,0 +1,115 @@
+// warm-start.mjs — what a browser worker's last start read, kept in this
+// browser so that a restart moments later need not read the pod again.
+//
+// A browser stops an idle service worker after about thirty seconds, and a
+// client in a background tab wakes it about once a minute. Each wake was a
+// whole sign-in against the pod. Kept here: where the account lives, its state
+// documents as the pod holds them (bytes and ETags), and when the last full
+// start and the last inbox drain were. A document is marked pending before it
+// is written to the pod and confirmed after, so a worker stopped in between
+// re-reads that one document rather than trusting a copy the pod has moved
+// past. Signing out deletes the database.
+const DB = 'fedipod-warm';
+
+export const WARM_GAP_MS = 5 * 60_000;       // a restart this soon after the last is the same visit
+export const FULL_EVERY_MS = 60 * 60_000;    // a full start still happens at least hourly
+export const DRAIN_EVERY_MS = 2 * 60_000;    // the inbox drain's own fallback cadence
+
+export const isWarm = (meta, now = Date.now()) =>
+  !!meta && now - meta.wakeAt < WARM_GAP_MS && now - meta.fullAt < FULL_EVERY_MS;
+
+function open() {
+  return new Promise((res, rej) => {
+    const r = indexedDB.open(DB, 1);
+    r.onupgradeneeded = () => { r.result.createObjectStore('meta'); r.result.createObjectStore('docs'); };
+    r.onsuccess = () => res(r.result);
+    r.onerror = () => rej(r.error);
+  });
+}
+
+// One transaction, then the connection is closed, so a sign-out can delete
+// the database without waiting on a worker that still holds it open.
+async function tx(stores, mode, work) {
+  const db = await open();
+  try {
+    return await new Promise((res, rej) => {
+      const t = db.transaction(stores, mode);
+      let out;
+      Promise.resolve(work(t)).then((v) => { out = v; });
+      t.oncomplete = () => res(out);
+      t.onerror = () => rej(t.error);
+      t.onabort = () => rej(t.error);
+    });
+  } finally { db.close(); }
+}
+
+const docKey = (webId, name) => `${webId}\n${name}`;
+const range = (webId) => IDBKeyRange.bound(`${webId}\n`, `${webId}\n￿`);
+const ask = (rq) => new Promise((res, rej) => { rq.onsuccess = () => res(rq.result); rq.onerror = () => rej(rq.error); });
+
+export const warmMeta = (webId) => tx('meta', 'readonly', (t) => ask(t.objectStore('meta').get(webId)).then((m) => m || null));
+
+export const saveMeta = (webId, patch) => tx('meta', 'readwrite', async (t) => {
+  const s = t.objectStore('meta');
+  const had = (await ask(s.get(webId))) || {};
+  s.put({ ...had, ...patch }, webId);
+});
+
+export const saveDoc = (webId, name, doc) => tx('docs', 'readwrite', (t) => {
+  t.objectStore('docs').put({ name, ...doc }, docKey(webId, name));
+});
+
+export const dropDoc = (webId, name) => tx('docs', 'readwrite', (t) => {
+  t.objectStore('docs').delete(docKey(webId, name));
+});
+
+export const loadDocs = (webId) => tx('docs', 'readonly', (t) => ask(t.objectStore('docs').getAll(range(webId))));
+
+// Everything the pod held at a load, in place of whatever was kept before.
+export const replaceDocs = (webId, docs, listingEtag) => tx(['docs', 'meta'], 'readwrite', async (t) => {
+  const d = t.objectStore('docs');
+  d.delete(range(webId));
+  for (const doc of docs) d.put({ ...doc, pending: false }, docKey(webId, doc.name));
+  const m = t.objectStore('meta');
+  const had = (await ask(m.get(webId))) || {};
+  m.put({ ...had, listingEtag: listingEtag || null }, webId);
+});
+
+export function deleteWarm() {
+  return new Promise((res) => {
+    let rq; try { rq = indexedDB.deleteDatabase(DB); } catch { res(); return; }
+    rq.onsuccess = rq.onerror = rq.onblocked = () => res();
+  });
+}
+
+/**
+ * Keep `store`'s documents in step with the pod, for `webId`. Before a write
+ * or removal the document is marked pending; after it lands, the bytes the
+ * pod now holds are kept. A load replaces the whole copy.
+ */
+export function keepInStep(store, webId, log = () => {}) {
+  const fail = (e) => log(`warm copy: ${e?.message || e}`);
+  store.onWriting = (name) => saveDoc(webId, name, { text: null, etag: null, pending: true }).catch(fail);
+  store.onSettled = (name) => {
+    const text = store.lastText.get(name);
+    (text == null ? dropDoc(webId, name) : saveDoc(webId, name, { text, etag: store.etags.get(name) || null, pending: false }))
+      .catch(fail);
+  };
+  store.onLoaded = () => {
+    const docs = [...store.lastText].map(([name, text]) => ({ name, text, etag: store.etags.get(name) || null }));
+    replaceDocs(webId, docs, store.etags.get('')).catch(fail);
+  };
+}
+
+/**
+ * Put a kept copy into `store`, and answer the names of documents it caught
+ * mid-write: those, and only those, need reading from the pod again. While the
+ * lease stayed with this browser nothing else wrote the state, so the rest is
+ * what the pod holds. With any pending, the container's ETag is left out too,
+ * so a later full load lists it afresh.
+ */
+export function takeUp(store, docs, listingEtag) {
+  const pending = docs.filter((d) => d.pending).map((d) => d.name);
+  store.restore({ docs: docs.filter((d) => !d.pending && d.text != null), listingEtag: pending.length ? null : listingEtag });
+  return pending;
+}

package/web/app-signin/app-signin.mjs

@@ -0,0 +1,78 @@
+// app-signin.mjs — a Mastodon app asked to use an account at this gateway
+// (lib/gateway/masto-gateway.mjs). The person gives their address here, signs
+// in at their own pod with the fediverse-session library, and the page proves
+// that sign-in to the gateway with one signed request; the gateway hands the
+// app its code. No password of ours anywhere.
+import { fediLogin } from './fedi-login.mjs';
+
+const $ = (id) => document.getElementById(id);
+const say = (text, error = false) => { const s = $('signin-status'); s.textContent = text; s.setAttribute('role', error ? 'alert' : 'status'); };
+const here = location.origin + location.pathname;
+const params = new URLSearchParams(location.search);
+// The address last used here, so the trip to the pod and back does not ask again.
+const KEY = 'fedipod-app-address';
+const remembered = () => { try { return sessionStorage.getItem(KEY) || localStorage.getItem(KEY) || ''; } catch { return ''; } };
+const remember = (a) => { try { sessionStorage.setItem(KEY, a); localStorage.setItem(KEY, a); } catch { /* keeps no site data */ } };
+const login = fediLogin({ dbName: 'fedipod-app-signin', clientName: 'Sign in to an app', redirectUri: here });
+// The person's own yes to this app, given by pressing the button in this tab.
+// It rides the trip to the pod and back, and nothing else stands for it: a
+// page that sends someone here, signed in before, gets nothing without it.
+const CONSENT = 'fedipod-app-consent';
+const request = `${params.get('client_id')}\n${params.get('redirect_uri') || ''}`;
+const consented = () => { try { return sessionStorage.getItem(CONSENT) === request; } catch { return false; } };
+const consent = (on) => { try { if (on) sessionStorage.setItem(CONSENT, request); else sessionStorage.removeItem(CONSENT); } catch { /* keeps no site data */ } };
+
+// Back from the pod: this finishes the sign-in and returns to the app's request.
+try { await login.resume(); } catch (e) { say(e.message, true); }
+
+// Proves the pod sign-in to the gateway. True when the app has its code.
+async function prove(address) {
+  const s = await login.getSession();
+  if (!s || !consented()) return false;
+  consent(false);
+  say('Signing you in…');
+  const res = await s.fetch(`${location.origin}/api/authorize`, {
+    method: 'POST', headers: { 'content-type': 'application/json' },
+    body: JSON.stringify({ ...Object.fromEntries(params), address }),
+  });
+  const d = await res.json().catch(() => ({}));
+  if (res.ok && d.redirect) { say('Signed in. Going back to the app…'); location.href = d.redirect; return true; }
+  if (res.ok && d.code) { say(`Signed in. The app asks you to paste this code into it: ${d.code}`); return true; }
+  say(d.error || `The sign-in was refused (HTTP ${res.status}).`, true);
+  return false;
+}
+
+async function start() {
+  if (!params.get('client_id')) { say('This page is for an app that asked to use your account. Start from the app.', true); return; }
+  const r = await fetch(`/api/authorize?${new URLSearchParams({ client_id: params.get('client_id'), redirect_uri: params.get('redirect_uri') || '' })}`);
+  const app = await r.json().catch(() => ({}));
+  if (!r.ok) { say(app.error || `This app cannot sign in here (HTTP ${r.status}).`, true); return; }
+  const asking = $('asking');
+  const name = document.createElement('strong');
+  name.textContent = app.name;
+  asking.append(name, ' is asking to use your account');
+  if (app.sendsTo) { const where = document.createElement('code'); where.textContent = app.sendsTo; asking.append(', and will be sent back to ', where); }
+  asking.append('.');
+  asking.hidden = false;
+  const address = remembered();
+  $('address').value = address;
+  // Back from the pod after pressing the button: finish. Otherwise ask.
+  if (!(address && consented() && await prove(address))) $('signin-form').hidden = false;
+}
+
+$('signin-form').addEventListener('submit', async (ev) => {
+  ev.preventDefault();
+  const address = $('address').value.trim();
+  if (!address) { say('Write your address here first.', true); return; }
+  const r = await fetch(`/api/authorize?address=${encodeURIComponent(address)}`);
+  const who = await r.json().catch(() => ({}));
+  if (!r.ok) { say(who.error || `That address was not found (HTTP ${r.status}).`, true); return; }
+  remember(address);
+  consent(true);
+  const s = await login.getSession();
+  if (s && s.webId === who.webId) { await prove(address); return; }
+  say('Taking you to your pod…');
+  try { await login.login(who.webId, { returnTo: location.href, redirectUri: here }); } catch (e) { say(e.message, true); }
+});
+
+await start();

package/web/app-signin/index.html

@@ -0,0 +1,41 @@
+<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>Let an app use your account</title>
+<link rel="stylesheet" href="/app-signin/tokens.css">
+<style>
+  body { font-family: var(--font); background: var(--surface); color: var(--fg); margin: 0; line-height: 1.5; }
+  main { max-width: 30rem; margin: 8vh auto; padding: 1.5rem 1.75rem; background: var(--raised);
+    border: 1px solid var(--line); border-radius: 10px; }
+  h1 { color: var(--heading); font-size: 1.5rem; margin: 0 0 1rem; }
+  a { color: var(--link); text-decoration: underline; }
+  code { word-break: break-all; background: var(--field-bg); padding: .05em .35em; border-radius: 4px; }
+  label { display: block; margin: 1rem 0 .4rem; font-weight: bold; }
+  input { font: inherit; width: 100%; box-sizing: border-box; padding: .5rem .7rem; background: var(--field-bg);
+    color: var(--field-text); border: 1px solid var(--field-edge); border-radius: 6px; }
+  .hint { color: var(--sub); }
+  button { font: inherit; padding: .6rem 1.1rem; background: var(--btn); color: var(--btn-text); border: none;
+    border-radius: 9px; cursor: pointer; }
+  button:hover { background: var(--btn-hover); }
+  :focus-visible { outline: 3px solid var(--ring); outline-offset: 2px; }
+  #signin-status { margin-top: 1rem; padding: .6rem .8rem; border: 1px solid var(--line); border-radius: 8px; }
+  #signin-status:empty { display: none; }
+</style>
+</head>
+<body>
+<main>
+<h1>Let an app use your account</h1>
+<p id="asking" hidden></p>
+<form id="signin-form" hidden>
+  <label for="address">Your address here</label>
+  <input type="text" id="address" name="address" autocomplete="username">
+  <p class="hint">You sign in at your own pod. No password is typed on this page.</p>
+  <p><button type="submit" id="signin">Sign in with your pod</button></p>
+</form>
+<p id="signin-status" role="status" aria-live="polite"></p>
+</main>
+<script type="module" src="/app-signin/app-signin.mjs"></script>
+</body>
+</html>

package/web/front/run.html

@@ -46,12 +46,18 @@ Fediverse services straight from your pod.</p>
   <label for="run-issuer">Your identity provider</label>
   <input type="url" id="run-issuer" autocomplete="off" placeholder="https://this.server">
   </p>
+  <p class="field">
+  <label for="run-container">Store your data in a container named fedipod, inside this container</label>
+  <input type="text" id="run-container" autocomplete="off" spellcheck="false" placeholder="/"
+    aria-describedby="run-container-hint">
+  </p>
+  <p class="hint" id="run-container-hint">Leave it empty for your pod's root. This is permanent.</p>
   <p class="actions">
     <button type="button" id="run-continue" class="primary" disabled>Sign in with your pod &amp; opt in</button>
     <button type="button" id="run-leave">Stop running it here</button>
   </p>
 </form>
-<p class="hint" id="run-note" hidden></p>
+<div class="hint" id="run-note" hidden></div>
 
 <script type="module" src="/run.js"></script>
 </body>