fedipod 1.45.0 → 1.48.0

package/lib/session/fedi-login.mjs

@@ -1,123 +0,0 @@
-// fedi-login.mjs — sign a person in at their own Solid pod from their
-// Fediverse address, and bring them back to where they were.
-//
-//   import { fediLogin } from './fedi-login.mjs';
-//   const login = fediLogin({ dbName: 'my-app-oidc', clientName: 'My app' });
-//
-//   await login.login('@mei@fedipod.net');   // leaves for the pod's login page
-//   await login.resume();                     // on every page load: finishes a
-//                                             // login in progress and returns them
-//   const s = await login.getSession();       // null, or { webId, issuer, fetch, signOut }
-//
-// How an address becomes a login page. WebFinger at the address's host names
-// the actor and its aliases. An origin among those that answers
-// /.well-known/openid-configuration is the login provider, or says which is
-// (a pod host redirects there). Failing that, the WebID — the URL typed, or
-// the ones the actor names as its own — is read as JSON-LD and its
-// solid:oidcIssuer is the provider. A Mastodon address has neither, and the
-// person is told so in words.
-//
-// No imports but the session engine beside it, no Node built-ins, nothing
-// named after the application that uses it.
-import { solidOidcSession } from './oidc-session.mjs';
-
-const OIDC_ISSUER = 'http://www.w3.org/ns/solid/terms#oidcIssuer';
-
-/** `@mei@host`, `mei@host`, or a WebID or actor URL. Null when it is neither. */
-export function parseAddress(input) {
-  const t = String(input || '').trim();
-  if (/^https?:\/\//u.test(t)) { try { return { url: new URL(t).href, host: new URL(t).host }; } catch { return null; } }
-  const m = /^@?([^@\s/]+)@([^@\s/]+)$/u.exec(t);
-  if (!m) return null;
-  const name = m[1]; const host = m[2].toLowerCase();
-  return { name, host, at: `@${name}@${host}` };
-}
-
-export function fediLogin({ dbName, clientName, redirectUri = null, fetch: f = globalThis.fetch?.bind(globalThis) } = {}) {
-  const oidc = solidOidcSession({ dbName, clientName });
-  const get = (url, accept) => f(url, { headers: { accept }, redirect: 'follow' });
-  const json = (url, accept) => get(url, accept).then((r) => (r.ok ? r.json() : null)).catch(() => null);
-  const here = () => (globalThis.location ? location.origin + location.pathname : null);
-
-  const discovery = (base) => json(`${String(base).replace(/\/+$/, '')}/.well-known/openid-configuration`, 'application/json');
-  const isProvider = (cfg) => !!(cfg?.issuer && cfg.authorization_endpoint);
-  const origin = (u) => { try { return new URL(u).origin; } catch { return null; } };
-
-  // The issuer a WebID document names, read as the expanded JSON-LD a pod answers.
-  const issuerOfWebId = async (webId) => {
-    const doc = await json(webId, 'application/ld+json');
-    const nodes = Array.isArray(doc) ? doc : (doc?.['@graph'] || (doc ? [doc] : []));
-    const me = nodes.find((n) => n?.['@id'] === webId && n[OIDC_ISSUER]) || nodes.find((n) => n?.[OIDC_ISSUER]);
-    const v = [].concat(me?.[OIDC_ISSUER] || [])[0];
-    return typeof v === 'string' ? v : (v?.['@id'] || null);
-  };
-
-  /** Where an address signs in: { address, actor, origin, issuer, webId? }.
-   *  Throws, in plain words, when the host does not know the address or
-   *  nothing about it names a login provider. */
-  async function resolve(address) {
-    const a = parseAddress(address);
-    if (!a) throw new Error('an address looks like @you@your.server');
-    let actor = null;
-    const urls = [];
-    if (a.url) urls.push(a.url);
-    else {
-      const r = await get(`https://${a.host}/.well-known/webfinger?resource=${encodeURIComponent(`acct:${a.name}@${a.host}`)}`,
-        'application/jrd+json, application/json').catch(() => null);
-      if (!r?.ok) throw new Error(`${a.host} does not know ${a.at}`);
-      const jrd = await r.json().catch(() => null);
-      const self = (jrd?.links || []).find((l) => l.rel === 'self' && /activity\+json|ld\+json/u.test(l.type || ''));
-      actor = self?.href || null;
-      // The aliases first: at a Gateway they name the actor on the pod itself,
-      // and the pod is where the login is.
-      for (const u of [...(jrd?.aliases || []), ...(actor ? [actor] : [])]) if (typeof u === 'string') urls.push(u);
-      if (!urls.length) throw new Error(`${a.host} did not say where ${a.at} lives`);
-    }
-    const found = (extra) => ({ address: a.at || a.url, actor, ...extra });
-
-    // 1. An origin that is the login provider, or says which is.
-    for (const o of [...new Set(urls.map(origin).filter(Boolean))]) {
-      const cfg = await discovery(o);
-      if (isProvider(cfg)) return found({ origin: o, issuer: cfg.issuer });
-    }
-    // 2. The WebID: the URL typed, or the ones the actor names as its own.
-    const webIds = a.url ? [a.url] : [];
-    if (actor) {
-      const doc = await json(actor, 'application/activity+json');
-      for (const u of [].concat(doc?.alsoKnownAs || [])) if (typeof u === 'string') webIds.push(u);
-    }
-    for (const webId of webIds) {
-      const issuer = await issuerOfWebId(webId);
-      if (issuer && isProvider(await discovery(issuer))) return found({ origin: origin(webId), issuer, webId });
-    }
-    throw new Error(`${a.host} is not a Solid pod, so there is no pod login to send you to`);
-  }
-
-  /** Everything `login` does short of leaving the page: returns the found pod
-   *  and the `authorizationUrl` to send the person to. */
-  async function startLogin(address, { returnTo = globalThis.location?.href || null, redirectUri: ru = redirectUri || here() } = {}) {
-    const found = await resolve(address);
-    const { authorizationUrl } = await oidc.beginLogin({ issuer: found.issuer, redirectUri: ru, returnTo });
-    return { ...found, authorizationUrl, returnTo };
-  }
-
-  /** Send the person to their pod's login page. They come back to `redirectUri`
-   *  (this page, unless set) and `resume` there returns them to `returnTo`
-   *  (where they were, unless set). */
-  async function login(address, opts) {
-    const s = await startLogin(address, opts);
-    location.href = s.authorizationUrl;
-    return s;
-  }
-
-  /** Call on every page load. Finishes a login the person is coming back from
-   *  and returns them to where they were; null when no login is in progress. */
-  async function resume({ currentUrl = globalThis.location?.href, go = (u) => location.replace(u) } = {}) {
-    const session = await oidc.completeLogin({ currentUrl });
-    if (!session) return null;
-    if (session.returnTo && session.returnTo !== currentUrl) go(session.returnTo);
-    return session;
-  }
-
-  return { resolve, startLogin, login, resume, getSession: oidc.getSession, signOut: oidc.signOut };
-}

package/lib/session/oidc-session.mjs

@@ -1,233 +0,0 @@
-// oidc-session.mjs — Solid-OIDC login for a browser page, with a secure,
-// durable, worker-visible session.
-//
-// The redirect handshake (authorization-code + PKCE) runs in the page. The
-// session it yields — a DPoP keypair whose private half is NON-EXTRACTABLE, plus
-// the refresh token, the token endpoint and the WebID — is kept in IndexedDB.
-// IndexedDB survives a browser restart and is readable by a service worker,
-// and a non-extractable key can sign but never be read out, even by injected
-// script.
-//
-//   import { solidOidcSession } from 'solid-oidc-session/oidc-session.mjs';
-//   const oidc = solidOidcSession({ dbName: 'my-app-oidc', clientName: 'My app' });
-//
-// Page:   const { authorizationUrl } = await oidc.beginLogin({ issuer, redirectUri });
-//         location.href = authorizationUrl;                      // ... redirect ...
-//         await oidc.completeLogin({ currentUrl: location.href });  // on return
-// Anywhere (page or worker, SAME dbName):
-//         const session = await oidc.getSession();  // { webId, issuer, fetch, refresh, signOut } | null
-//
-// No imports, no Node built-ins, nothing named after the application that
-// uses it: IndexedDB, WebCrypto and fetch are all it needs.
-
-const STORE = 'session';
-const b64u = (buf) => btoa(String.fromCharCode(...new Uint8Array(buf))).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
-const enc = (o) => b64u(new TextEncoder().encode(JSON.stringify(o)));
-const sha256 = (s) => crypto.subtle.digest('SHA-256', new TextEncoder().encode(s));
-const rand = (n = 32) => b64u(crypto.getRandomValues(new Uint8Array(n)));
-
-async function dpopKey() { return crypto.subtle.generateKey({ name: 'ECDSA', namedCurve: 'P-256' }, false, ['sign']); }
-async function publicJwk(pair) { const j = await crypto.subtle.exportKey('jwk', pair.publicKey); return { kty: j.kty, crv: j.crv, x: j.x, y: j.y }; }
-async function dpopProof(pair, jwk, htm, htu, ath) {
-  const header = { typ: 'dpop+jwt', alg: 'ES256', jwk };
-  const payload = { htm, htu: htu.split('#')[0], jti: crypto.randomUUID(), iat: Math.floor(Date.now() / 1000), ...(ath ? { ath } : {}) };
-  const data = `${enc(header)}.${enc(payload)}`;
-  const sig = await crypto.subtle.sign({ name: 'ECDSA', hash: 'SHA-256' }, pair.privateKey, new TextEncoder().encode(data));
-  return `${data}.${b64u(sig)}`;
-}
-const jwtPayload = (jwt) => { try { return JSON.parse(new TextDecoder().decode(Uint8Array.from(atob(jwt.split('.')[1].replace(/-/g, '+').replace(/_/g, '/')), (c) => c.charCodeAt(0)))); } catch { return {}; } };
-
-async function discover(issuer) {
-  const res = await fetch(`${issuer.replace(/\/+$/, '')}/.well-known/openid-configuration`, { headers: { accept: 'application/json' } });
-  if (!res.ok) throw new Error(`OIDC discovery failed at ${issuer} (HTTP ${res.status})`);
-  return res.json();
-}
-async function registerClient(cfg, redirectUri, clientName) {
-  const res = await fetch(cfg.registration_endpoint, {
-    method: 'POST', headers: { 'content-type': 'application/json' },
-    body: JSON.stringify({ client_name: clientName, redirect_uris: [redirectUri], token_endpoint_auth_method: 'none',
-      grant_types: ['authorization_code', 'refresh_token'], response_types: ['code'], application_type: 'web', scope: 'openid webid offline_access' }),
-  });
-  if (!res.ok) throw new Error(`client registration failed (HTTP ${res.status})`);
-  return (await res.json()).client_id;
-}
-
-/**
- * One session store. `dbName` is the IndexedDB database the session lives in:
- * a page and its service worker must pass the same name to see the same
- * sign-in, and two apps on one origin pass different names to keep theirs
- * apart. `clientName` is what the pod's login screen shows the person.
- */
-export function solidOidcSession({ dbName = 'solid-oidc-session', clientName = 'Solid app' } = {}) {
-  function idb() {
-    return new Promise((res, rej) => {
-      const r = indexedDB.open(dbName, 1);
-      r.onupgradeneeded = () => r.result.createObjectStore(STORE);
-      r.onsuccess = () => res(r.result);
-      r.onerror = () => rej(r.error);
-    });
-  }
-  async function idbGet(key) {
-    const db = await idb();
-    return new Promise((res, rej) => { const t = db.transaction(STORE).objectStore(STORE).get(key); t.onsuccess = () => res(t.result); t.onerror = () => rej(t.error); });
-  }
-  async function idbPut(key, val) {
-    const db = await idb();
-    return new Promise((res, rej) => { const t = db.transaction(STORE, 'readwrite').objectStore(STORE).put(val, key); t.onsuccess = () => res(); t.onerror = () => rej(t.error); });
-  }
-  async function idbDel(key) {
-    const db = await idb();
-    return new Promise((res, rej) => { const t = db.transaction(STORE, 'readwrite').objectStore(STORE).delete(key); t.onsuccess = () => res(); t.onerror = () => rej(t.error); });
-  }
-
-  /** Begin login: prepare PKCE + a non-extractable DPoP key, stash the pending
-   *  state, and return the authorization URL for the caller to navigate to. */
-  async function beginLogin({ issuer, redirectUri, clientName: name = clientName, returnTo = null }) {
-    const cfg = await discover(issuer);
-    const client_id = await registerClient(cfg, redirectUri, name);
-    const pair = await dpopKey();
-    const verifier = rand(48);
-    const challenge = b64u(await sha256(verifier));
-    const state = rand(16);
-    await idbPut('pending', { issuer, client_id, redirectUri, verifier, state, pair, returnTo,
-      tokenEndpoint: cfg.token_endpoint, authorizationEndpoint: cfg.authorization_endpoint,
-      revocationEndpoint: cfg.revocation_endpoint || null });
-    const url = new URL(cfg.authorization_endpoint);
-    for (const [k, v] of Object.entries({ client_id, redirect_uri: redirectUri, response_type: 'code',
-      scope: 'openid webid offline_access', code_challenge: challenge, code_challenge_method: 'S256', state, prompt: 'consent' })) url.searchParams.set(k, v);
-    return { authorizationUrl: url.href };
-  }
-
-  /** Complete login from the redirect back. Exchanges the code (DPoP + PKCE),
-   *  stores the durable session, and returns it. Returns null if there is no code. */
-  async function completeLogin({ currentUrl }) {
-    const u = new URL(currentUrl);
-    const code = u.searchParams.get('code');
-    const state = u.searchParams.get('state');
-    if (!code) return null;
-    const p = await idbGet('pending');
-    if (!p || p.state !== state) throw new Error('login state mismatch');
-    const jwk = await publicJwk(p.pair);
-    const res = await fetch(p.tokenEndpoint, {
-      method: 'POST',
-      headers: { 'content-type': 'application/x-www-form-urlencoded', dpop: await dpopProof(p.pair, jwk, 'POST', p.tokenEndpoint) },
-      body: new URLSearchParams({ grant_type: 'authorization_code', code, redirect_uri: p.redirectUri, client_id: p.client_id, code_verifier: p.verifier }),
-    });
-    const tok = await res.json().catch(() => ({}));
-    if (!res.ok || !tok.access_token) throw new Error(`token exchange failed (HTTP ${res.status}): ${tok.error || ''}`);
-    const webId = jwtPayload(tok.access_token).webid || jwtPayload(tok.id_token || '').webid || null;
-    const session = { issuer: p.issuer, client_id: p.client_id, tokenEndpoint: p.tokenEndpoint, pair: p.pair,
-      // Where to hand the refresh token back at sign-out. Kept on the session
-      // because discovery is a network round trip and sign-out should not need
-      // one — see signOut().
-      revocationEndpoint: p.revocationEndpoint || null,
-      refreshToken: tok.refresh_token || null, accessToken: tok.access_token,
-      expiresAt: Date.now() + Math.max(30, (tok.expires_in || 300)) * 1000, webId };
-    await idbPut('session', session);
-    await idbDel('pending');
-    // `returnTo` rides only on the handle this call returns: where the person
-    // was when they left for the login page, for the caller to send them back.
-    return Object.assign(sessionHandle(session), p.returnTo ? { returnTo: p.returnTo } : {});
-  }
-
-  /** Restore the session from IndexedDB — works in the page and the worker. */
-  async function getSession() {
-    const s = await idbGet('session');
-    return s ? sessionHandle(s) : null;
-  }
-
-  /**
-   * Sign out, and tell the issuer.
-   *
-   * Dropping the row locally leaves the REFRESH TOKEN alive at the pod for its
-   * full life — signing out of a shared or borrowed browser would clear the
-   * screen and nothing else, and anyone who had copied the token could go on
-   * minting access tokens with it. RFC 7009: hand it back.
-   *
-   * Best effort, and the local teardown happens either way: an issuer that is
-   * unreachable, or that publishes no revocation endpoint, must not be able to
-   * keep somebody signed in.
-   */
-  async function signOut() {
-    const s = await idbGet('session').catch(() => null);
-    if (s?.revocationEndpoint && s.refreshToken) {
-      try {
-        await fetch(s.revocationEndpoint, {
-          method: 'POST',
-          headers: { 'content-type': 'application/x-www-form-urlencoded' },
-          body: new URLSearchParams({
-            token: s.refreshToken, token_type_hint: 'refresh_token', client_id: s.client_id,
-          }),
-        });
-      } catch { /* told if we could; leaving is not conditional on being heard */ }
-    }
-    await idbDel('session');
-    await idbDel('pending');
-  }
-
-  function sessionHandle(s) {
-    let { accessToken, expiresAt, refreshToken } = s;
-    const jwkP = publicJwk(s.pair);
-    const refresh = async () => {
-      if (!refreshToken) throw new Error('session expired and there is no refresh token — sign in again');
-      const jwk = await jwkP;
-      let res;
-      try {
-        res = await fetch(s.tokenEndpoint, {
-          method: 'POST', headers: { 'content-type': 'application/x-www-form-urlencoded', dpop: await dpopProof(s.pair, jwk, 'POST', s.tokenEndpoint) },
-          body: new URLSearchParams({ grant_type: 'refresh_token', refresh_token: refreshToken, client_id: s.client_id, scope: 'openid webid offline_access' }),
-        });
-      } catch (e) {
-        // A renewal that never reached the server is not a refused one: the
-        // session is still good, and saying "your pod refused the write" about
-        // it sends whoever reads it looking in the wrong place. Under load a
-        // server refuses the token endpoint first, and a refusal with no CORS
-        // headers arrives here as the browser's bare "Failed to fetch".
-        throw new Error(`${e.message} — renewing your sign-in at ${new URL(s.tokenEndpoint).host}`);
-      }
-      const tok = await res.json().catch(() => ({}));
-      if (res.status === 429) {
-        throw new Error(`${new URL(s.tokenEndpoint).host} is asking us to slow down — your sign-in could not be renewed just now`);
-      }
-      if (!res.ok || !tok.access_token) { await idbDel('session'); throw new Error('refresh failed — sign in again'); }
-      accessToken = tok.access_token;
-      expiresAt = Date.now() + Math.max(30, (tok.expires_in || 300)) * 1000;
-      if (tok.refresh_token) refreshToken = tok.refresh_token;
-      // Re-read before writing back. There is ONE 'session' row, and this handle
-      // closed over the session it was made from — so a refresh that was already
-      // in flight when the user signed in as somebody else would put the OLD
-      // identity back, silently, over the new one. Only write if the row is still
-      // the session this handle belongs to.
-      const now = await idbGet('session');
-      if (now && now.webId !== s.webId) {
-        throw new Error('signed in as somebody else while this session was refreshing');
-      }
-      await idbPut('session', { ...s, accessToken, expiresAt, refreshToken });
-    };
-    const send = async (url, init) => {
-      const jwk = await jwkP;
-      const ath = b64u(await sha256(accessToken));
-      const headers = { ...(init.headers || {}), authorization: `DPoP ${accessToken}`, dpop: await dpopProof(s.pair, jwk, (init.method || 'GET'), url, ath) };
-      return fetch(url, { ...init, headers });
-    };
-    const authFetch = async (url, init = {}) => {
-      if (Date.now() > expiresAt - 30_000) await refresh();
-      const res = await send(url, init);
-      // A token the pod REFUSES is not only ever an expired one: a pod that
-      // restarted, a clock that drifted, a token the server stopped recognising
-      // all answer 401 while the clock here still says the token is good — so the
-      // renewal above never fires and every call fails from then on. Renew once
-      // and ask again.
-      if (res.status === 401 && refreshToken) {
-        try { await refresh(); } catch { return res; }
-        return send(url, init);
-      }
-      return res;
-    };
-    // `issuer` so a page that cannot renew can send the person back to the right
-    // login without asking them for their address again.
-    return { webId: s.webId, issuer: s.issuer, fetch: authFetch, refresh, signOut };
-  }
-
-  return { beginLogin, completeLogin, getSession, signOut };
-}

package/lib/session/package.json

@@ -1,49 +0,0 @@
-{
-  "name": "fediverse-session",
-  "version": "0.2.1",
-  "description": "Type a Fediverse handle or a WebID and get back an account you can act with: post, read its timeline, follow, reply, favourite, boost. Works out whether the account lives on a Mastodon-family server or on a Solid pod through FediPod, sends the person to sign in there, brings them back to where they were, and speaks to whichever it is.",
-  "type": "module",
-  "license": "MIT",
-  "author": "Jeff Zucker",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/jeff-zucker/FediPod.git",
-    "directory": "lib/session"
-  },
-  "homepage": "https://github.com/jeff-zucker/FediPod/tree/main/lib/session#readme",
-  "keywords": [
-    "fediverse",
-    "activitypub",
-    "mastodon",
-    "solid",
-    "solid-oidc",
-    "webid",
-    "login",
-    "oauth",
-    "fedipod"
-  ],
-  "files": [
-    "fedi-account.mjs",
-    "fedi-login.mjs",
-    "oidc-session.mjs",
-    "README.md"
-  ],
-  "exports": {
-    ".": "./fedi-account.mjs",
-    "./fedi-account.mjs": "./fedi-account.mjs",
-    "./fedi-login.mjs": "./fedi-login.mjs",
-    "./oidc-session.mjs": "./oidc-session.mjs"
-  },
-  "scripts": {
-    "prepublishOnly": "node ../../scripts/check-pod-calls.mjs"
-  },
-  "dependencies": {},
-  "peerDependencies": {
-    "jsonld": "^9.0.0"
-  },
-  "peerDependenciesMeta": {
-    "jsonld": {
-      "optional": true
-    }
-  }
-}