fedipod 1.40.0 → 1.42.0

package/scripts/build-app.mjs

@@ -32,6 +32,10 @@ const aliasPlugin = {
     build.onResolve({ filter: /^node:fs$/ }, () => ({ path: shim('node-fs.mjs') }));
     build.onResolve({ filter: /^web-push$/ }, () => ({ path: shim('web-push.mjs') }));
     build.onResolve({ filter: /\/safefetch\.mjs$/ }, () => ({ path: shim('safefetch.mjs') }));
+    // The packed sanitize-html is for Node (scripts/vendor-sanitize.mjs); the
+    // browser takes the package itself, whose browser build leaves out what a
+    // page has no use for.
+    build.onResolve({ filter: /vendor\/sanitize-html\.cjs$/ }, (args) => build.resolve('sanitize-html', { kind: args.kind, resolveDir: args.resolveDir }));
     // The shapes are one .ttl file for both agents; Node reads it, the browser
     // gets it through the text loader below.
     build.onResolve({ filter: /shapes-text\.mjs$/ }, () => ({ path: shim('shapes-text.mjs') }));

package/scripts/check-netlify-bundles.mjs

@@ -0,0 +1,84 @@
+// check-netlify-bundles.mjs — before a deploy: the Netlify functions as Netlify
+// ships them. Builds them with Netlify's own bundler (netlify functions:build),
+// checks the account routes are the account function's and not the front's,
+// and loads every function from its own unpacked bundle, outside this
+// repository, where no node_modules beside the source can hide a missing
+// module or file, under the rule Netlify's Node keeps: no require() of an
+// ES-module-only package. The 1.40.0 and 1.40.2 failures (2026-09-26) are
+// what this catches.
+//
+//   node scripts/check-netlify-bundles.mjs   (the deploy command runs it first)
+import fs from 'node:fs'; import os from 'node:os'; import path from 'node:path';
+import { execFileSync, execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import { fileURLToPath } from 'node:url';
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'fn-bundles-'));
+let fails = 0;
+const check = (ok, msg) => { console.log(`${ok ? 'PASS' : 'FAIL'}  ${msg}`); if (!ok) fails++; };
+try {
+  execFileSync('netlify', ['functions:build', '--src', path.join(root, 'netlify/functions'), '--functions', path.join(tmp, 'zips')],
+    { cwd: root, stdio: 'ignore' });
+  const manifest = JSON.parse(fs.readFileSync(path.join(tmp, 'zips/manifest.json'), 'utf8'));
+  const fn = Object.fromEntries(manifest.functions.map((f) => [f.name, f]));
+  const routes = (f) => (f?.routes || []).map((r) => r.pattern).sort();
+  const excluded = (f) => (f?.excludedRoutes || []).map((r) => r.pattern || r).sort();
+  check(routes(fn.account).length > 0 && JSON.stringify(routes(fn.account)) === JSON.stringify(excluded(fn.front)),
+    `the account function answers exactly the paths the front leaves out (${routes(fn.account).join(' ')})`);
+  check(fn['flush-mail']?.schedule === '*/15 * * * *', 'the round is scheduled every fifteen minutes');
+  // Netlify's storage, stood in for by the library's own local server, so a
+  // request can run through each function and load what it loads on first use.
+  const { BlobsServer } = await import(path.join(root, 'node_modules/@netlify/blobs/dist/server.js'));
+  const blobs = new BlobsServer({ directory: path.join(tmp, 'blobs'), token: 'check', logger: () => {} });
+  const { port } = await blobs.start();
+  const env = {
+    ...process.env,
+    NETLIFY_BLOBS_CONTEXT: Buffer.from(JSON.stringify({ edgeURL: `http://127.0.0.1:${port}`, uncachedEdgeURL: `http://127.0.0.1:${port}`,
+      siteID: 'check', token: 'check' })).toString('base64'),
+    FEDIPOD_FRONT_HOST: 'fedipod.example', FEDIPOD_FRONT_ORIGIN: 'https://fedipod.example',
+    FEDIPOD_KEEPER_WEBID: 'https://keeper.example/profile/card#me', FEDIPOD_KEEPER_CLIENT_SECRET: 'check-secret',
+  };
+  // What each function is asked, and the answers that mean it ran its code.
+  const asks = {
+    front: [['GET', '/', [200]], ['GET', '/.well-known/webfinger?resource=acct:nobody@fedipod.example', [404]],
+      ['POST', '/u/nobody/ap/inbox/', [404, 410]]],
+    account: [['GET', '/api/v2/instance', [200]], ['POST', '/api/v1/apps', [200], 'client_name=check&redirect_uris=urn%3Aietf%3Awg%3Aoauth%3A2.0%3Aoob'],
+      ['GET', '/api/authorize?address=nobody', [404]], ['GET', '/api/v1/timelines/home', [401]], ['POST', '/api/state/open', [401]]],
+    'keeper-background': [['POST', '/', [403], '{}']],
+    'push-background': [['POST', '/', [403], '{}']],
+    'flush-mail': [['POST', '/', [204]]],
+  };
+  for (const f of manifest.functions) {
+    const dir = path.join(tmp, 'run', f.name);
+    fs.mkdirSync(dir, { recursive: true });
+    execFileSync('unzip', ['-q', path.join(tmp, 'zips', `${f.name}.zip`), '-d', dir]);
+    const entry = path.join(dir, 'netlify/functions', `${f.name}.mjs`);
+    // Netlify's Node will not require() a package that ships only as an ES
+    // module; this machine's will. The flag makes this one refuse it too, which
+    // is how 1.40.0 (jose) and 1.40.2 (htmlparser2 under sanitize-html) got
+    // past a check that loaded fine here. Each run exits when it has answered
+    // (a function may leave a timer behind), and not with execFileSync: the
+    // storage stand-in runs in this process, and a blocked event loop would
+    // never answer the function asking it.
+    const run = (script) => promisify(execFile)(process.execPath, ['--no-experimental-require-module', '-e', script],
+      { cwd: dir, env, encoding: 'utf8', timeout: 60_000 })
+      .then((r) => r.stdout.trim().split('\n').pop())
+      .catch((e) => `THREW ${String(e.stderr || e.message).trim().split('\n').pop()}`);
+    const out = await run(`import(${JSON.stringify(entry)}).then((m) => console.log(typeof m.default))`
+      + `.catch((e) => console.log('FAILS ' + e.message.split('\\n')[0])).finally(() => process.exit(0))`);
+    check(out === 'function', `${f.name} loads from its own bundle${out === 'function' ? '' : ` (${out})`}`);
+    for (const [method, p, ok, body] of asks[f.name] || []) {
+      const got = await run(`import(${JSON.stringify(entry)}).then(async (m) => {
+        const r = await m.default(new Request('https://fedipod.example' + ${JSON.stringify(p)}, { method: ${JSON.stringify(method)},
+          ${body ? `body: ${JSON.stringify(body)}, headers: { 'content-type': ${JSON.stringify(body.startsWith('{') ? 'application/json' : 'application/x-www-form-urlencoded')} },` : ''} }), { waitUntil() {} });
+        console.log(r.status);
+      }).catch((e) => console.log('THREW ' + e.message.split('\\n')[0])).finally(() => process.exit(0))`);
+      check(ok.includes(Number(got)), `${f.name} answers ${method} ${p} (${got})`);
+    }
+  }
+  await blobs.stop();
+} catch (e) { console.log('ERROR', e.message); fails++; }
+fs.rmSync(tmp, { recursive: true, force: true });
+console.log(fails ? `\n${fails} FAILED` : '\nall green');
+process.exit(fails ? 1 : 0);

package/scripts/check-pod-calls.mjs

@@ -291,5 +291,47 @@ if (!failures) pass('every in-scope caller reaches the pod through a named opera
   if (!bad) pass('lib/session/ imports nothing above itself, names no application, tells a Mastodon address from a pod one and acts through each, and the app binds its own database name');
 }
 
+// ---- 9. core is a library: nothing in it reaches the DeviceAgent, and every entry loads alone ----
+{
+  // The folders a consumer of the `fedipod` package may import from. None of
+  // them may import the DeviceAgent's files (lib/device/, run-agent.mjs):
+  // the Server and the forum import core and nothing else.
+  const CORE = ['lib/core', 'lib/pod', 'lib/client', 'lib/connections', 'lib/gateway', 'lib/shared', 'lib/surface', 'lib/server'];
+  const walk = (dir) => fs.readdirSync(dir, { withFileTypes: true }).flatMap((e) => {
+    const p = path.join(dir, e.name);
+    return e.isDirectory() ? walk(p) : (e.name.endsWith('.mjs') ? [p] : []);
+  });
+  let bad = 0;
+  for (const folder of CORE) {
+    for (const file of walk(path.join(root, folder))) {
+      const src = code(read(file));
+      const specs = [...src.matchAll(/from\s+['"]([^'"]+)['"]/g), ...src.matchAll(/import\(\s*['"]([^'"]+)['"]/g)].map((m) => m[1]);
+      for (const spec of specs) {
+        if (/(^|\/)device\//.test(spec) || /run-agent\.mjs$/.test(spec)) {
+          fail(`${path.relative(root, file)} imports ${spec} — core may not reach the DeviceAgent`); bad++;
+        }
+      }
+    }
+  }
+  // The named entries of the exports map, imported by package name from
+  // inside the package (Node resolves a package's own name through its map),
+  // so a consumer's `import 'fedipod/embed'` is what is proved here.
+  const entries = { embed: 'startEmbeddedAgent', front: 'routeFront', 'front-pages': 'frontPages', surface: 'buildAdminSurface', agent: 'Agent', remote: 'RemotePod', place: 'chosenRoot' };
+  for (const [entry, name] of Object.entries(entries)) {
+    try {
+      const m = await import(`fedipod/${entry}`);
+      if (typeof m[name] !== 'function') { fail(`fedipod/${entry} exports no ${name}`); bad++; }
+    } catch (e) { fail(`fedipod/${entry} does not load by name: ${e.message}`); bad++; }
+  }
+  try {
+    const { frontPages } = await import('fedipod/front-pages');
+    const pages = frontPages();
+    const missing = ['signupPage', 'runPage', 'adminPage', 'noticesPage', 'authBundle', 'installScript'].filter((k) => !pages[k])
+      .concat(Object.entries(pages.pageScripts).filter(([, v]) => !v).map(([k]) => k));
+    if (missing.length) { fail(`frontPages() is missing ${missing.join(', ')}`); bad++; }
+  } catch (e) { fail(`frontPages(): ${e.message}`); bad++; }
+  if (!bad) pass('core imports nothing from the DeviceAgent, every named entry of the fedipod package loads by name, and the front pages are all there');
+}
+
 console.log(failures ? `\n${failures} failure(s)` : '\npod layer intact');
 process.exit(failures ? 1 : 0);

package/scripts/vendor-sanitize.mjs

@@ -0,0 +1,27 @@
+// vendor-sanitize.mjs — sanitize-html and the HTML parser it uses, packed into
+// one CommonJS file, vendor/sanitize-html.cjs, which lib/core/wire.mjs imports.
+//
+// sanitize-html is CommonJS and require()s htmlparser2, which since 12 ships
+// only as an ES module. Node 24 lets require() load one; the Node that runs
+// the Netlify functions does not, so every function that cleans HTML failed to
+// load there (2026-09-26). Packed, the parser is part of this one file and
+// nothing is require()d that cannot be. Run again after sanitize-html changes:
+//
+//   node scripts/vendor-sanitize.mjs
+import fs from 'node:fs';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+import { build } from 'esbuild';
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const require = createRequire(path.join(root, 'package.json'));
+const entry = require.resolve('sanitize-html');
+const version = JSON.parse(fs.readFileSync(path.join(path.dirname(entry), 'package.json'), 'utf8')).version;
+const out = path.join(root, 'vendor/sanitize-html.cjs');
+await build({
+  entryPoints: [entry], bundle: true, platform: 'node', format: 'cjs', target: 'node18',
+  outfile: out, legalComments: 'inline', logLevel: 'warning',
+  banner: { js: `// sanitize-html ${version} with its dependencies, packed by scripts/vendor-sanitize.mjs. Do not edit.` },
+});
+console.log(`packed sanitize-html ${version} → vendor/sanitize-html.cjs (${Math.round(fs.statSync(out).size / 1024)} KB)`);

package/vendor/idp-grant.cjs

@@ -22,7 +22,12 @@
 
 const crypto = require('node:crypto');
 const fs = require('node:fs');
-const { generateKeyPair, exportJWK, SignJWT } = require('jose');
+// jose ships only as an ES module, so it is loaded with import(), which every
+// Node version takes and a bundler follows. A require() of it was left out of
+// the Netlify function bundle and took the whole gateway down on load
+// (2026-09-26): nothing here may require it.
+let joseLoaded = null;
+const jose = () => (joseLoaded ||= import('jose'));
 const { jfetch } = require('./jfetch.cjs');
 
 // The HTTP URI for a DPoP proof's `htu` is the request URL without query/fragment.
@@ -31,6 +36,7 @@ function htuOf(url) { const u = new URL(url); return u.origin + u.pathname; }
 // Build a DPoP proof JWT bound to (htm, htu), optionally carrying a server nonce
 // and the access-token hash (`ath`, required on resource requests).
 async function dpopProof({ keyPair, htm, htu, nonce, accessToken }) {
+  const { exportJWK, SignJWT } = await jose();
   const jwk = await exportJWK(keyPair.publicKey);
   const payload = { htu, htm, jti: crypto.randomUUID() };
   if (nonce) payload.nonce = nonce;
@@ -178,7 +184,7 @@ function readSavedToken(file) {
 }
 
 async function importSavedKey(saved) {
-  const { importJWK } = require('jose');
+  const { importJWK } = await jose();
   const privateKey = await importJWK(saved.privateJwk, 'ES256');
   const publicKey = await importJWK(saved.publicJwk, 'ES256');
   return { privateKey, publicKey };
@@ -187,7 +193,7 @@ async function importSavedKey(saved) {
 async function saveToken(file, keyPair, accessToken, expiresAt) {
   if (!file) return;
   try {
-    const { exportJWK } = require('jose');
+    const { exportJWK } = await jose();
     fs.writeFileSync(file, JSON.stringify({
       accessToken, expiresAt,
       privateJwk: await exportJWK(keyPair.privateKey),
@@ -223,8 +229,8 @@ function createGrantSession(rec, { gateToken, gatedOrigin, backoffFile = null, t
     // restart resumes the same session instead of minting a fresh grant. jose 6
     // makes generated keys non-extractable by default, which turns both of
     // those into "non-extractable CryptoKey cannot be exported as a JWK".
-    ? importSavedKey(saved).catch(() => generateKeyPair('ES256', { extractable: true }))
-    : generateKeyPair('ES256', { extractable: true });
+    ? importSavedKey(saved).catch(() => jose().then((j) => j.generateKeyPair('ES256', { extractable: true })))
+    : jose().then((j) => j.generateKeyPair('ES256', { extractable: true }));
   let accessToken = saved?.accessToken || null;
   let expiresAt = saved?.expiresAt || 0;
   let rsNonce = null;