fedipod 1.48.0 → 1.49.0

package/README.md

@@ -2,63 +2,36 @@
 
 - access the Fediverse from a Solid pod
 
-FediPod gives you a Fediverse account whose data lives on a Solid pod. You
-follow people on Mastodon, Bluesky, and other Fediverse or ATProto servers in
-one timeline. Your posts, followers and settings are kept on your pod. While fedipod.net
-keeps your account running, it works from a copy of them, and every fifteen
-minutes it writes that copy to your pod and deletes it; your signing key never
-leaves your pod.
+FediPod gives you a Fediverse account whose data lives on a Solid pod, and you
+use it with any Fediverse client. You can follow people on Mastodon, Bluesky, and other Fediverse or ATProto servers in one timeline. 
 
 The easiest way to run FediPod is to use it in any browser at https://fedipod.net. Nothing to install. Sign-up points you to a pod provider if you need a pod, then attaches a Fediverse identity to the pod you sign in with.
 
-
-This README is about the `FediPod BrowserAgent`. There are also a number of [other ways to run FediPod](#other-ways-to-run-fedipod) which offer a variety of scenarios.  If interested in the code, see also : [architecture overview](architecture.md) and [files overview](files-overview.md). Which specs FediPod follows, and where it stops short: [specs-in-use.md](specs-in-use.md).
+This README is about the `FediPod` as used with a Gateway. There are also a number of [other ways to run FediPod](#other-ways-to-run-fedipod) which offer a variety of scenarios.  If interested in the code, see also : [architecture overview](architecture.md) and [files overview](files-overview.md). Which specs FediPod follows, and where it stops short: [specs-in-use.md](specs-in-use.md).
 
 ## Requirements
 
 - A current browser
 - A free account on a gateway such as https://fedipod.net
-- A Solid pod that supports WAC (you can get one if you don't have one as part of account setup)
+- A Solid pod (you can get one if you don't have one as part of account setup)
 
 ## Getting an account
 
 1. Open https://fedipod.net and choose **create an account**.
 2. Choose your pod provider. You'll be redirected to your provider to login if you have a pod or sign up if you need to create one.
 3. Back on fedipod.net, choose your handle and where your address lives:
-   on your pod, `@handle@yourpod`, or at this site, `@handle@fedipod.net`.
+   on your pod, `@handle@yourpod`, or at the gateway, `@handle@fedipod.net`.
    Choose where on your pod your data goes: a container named `fedipod`,
    inside whichever container you name (your pod's root if you leave it
-   empty). If your pod has no public type index yet, you're asked whether
-   to create one; FediPod records there where your account lives, and
-   nothing is set up without it.
+   empty).
 4. You see your Fediverse timeline.
 
-From now on, anyone can open your profile at `https://fedipod.net/@handle@provider`, signed in or not.
-
-## Getting a forum
-
-The same page makes a forum. Choose **A forum** as the first thing on it. A
-forum has a pod of its own, so make a new pod for it at your provider (or
-sign in with one that holds nothing else), then give the forum a handle, a
-name and its categories, and the address at fedipod.net you will moderate it
-as. fedipod.net runs the forum from then on; nothing runs on your machine.
-Its page is at `https://bb.fedipod.net/<handle>/` and its address is
-`@handle@fedipod.net`, with one address per category.
-
 ## What you can do
 
-There are two clients, both served by fedipod.net:
-[Sengi](https://github.com/NicolasConstant/sengi) (MIT, by Nicolas Constant),
-which you get by default, and [Phanpy](https://github.com/cheeaun/phanpy)
-(MIT, by Chee Aun). The links at the top right of every page switch between
+You can access your account by pointing any Mastodon API or C2S client at fedipod.net and signing in.  There are also two built-inclients, both served by fedipod.net: [Sengi](https://github.com/NicolasConstant/sengi) (MIT, by Nicolas Constant), which you get by default, and [Phanpy](https://github.com/cheeaun/phanpy)(MIT, by Chee Aun). The links at the top right of every page switch between
 them, at any time; whichever you opened last is the one that opens next time.
 
-You follow and unfollow, post, reply,
-favourite, boost, attach media, edit and delete. Content warnings, polls with
-up to four options and one or several answers, all four visibility levels, a
-conversations view for direct messages, bookmarks, lists, keyword filters,
-pinned posts that other servers can see, blocking and muting, and the custom
-emojis other servers send.
+You can follow and unfollow, post, reply, favourite, boost, attach media, edit and delete. Content warnings, polls with up to four options and one or several answers, all four visibility levels, a conversations view for direct messages, bookmarks, lists, keyword filters, pinned posts that other servers can see, blocking and muting, and the custom emojis other servers send.
 
 A post can quote another post. Quote is offered on posts whose author allows
 it; the quoted author's server is asked, and the quote shows as pending until
@@ -108,50 +81,18 @@ the DeviceAgent has, described in [the admin interface](gui.md).
 it in a second browser shows your timeline read-only, and the moment you act
 there it takes over; the first drops back to reading.
 
-## What the browser version does not do
-
-- **Live updates.** The client refreshes by polling.
-- **Hosting a group.** Joining one works.
-
-For these, see [Other ways to run FediPod](#other-ways-to-run-fedipod).
-
-## Your data and your keys
-
-Everything you publish and everything you read is stored on your pod. Your
-signing key is stored there too, in a container only you can read through
-your pod's login.
-While fedipod.net keeps your account running, its own pod identity can read
-that container too, so it can act for you while FediPod is closed. It works
-from a copy of your account's data, and every fifteen minutes it writes that
-copy to your pod and deletes it, so none of your data stays at fedipod.net
-longer than that. The next time anything needs your account, the copy is made
-again from your pod. Your key stays on your pod only.
-It all lives in the `fedipod` container you chose at sign-up. Your pod's
-public type index records it, as an ActivityStreams actor, which is how
-FediPod and other Solid apps find your account again.
- fedipod.net holds no key: it verifies incoming mail, drops
-the junk, forwards the rest to your pod, and hands your browser the app.
-With an address on your pod, `@handle@yourpod`, you can detach from it at
-any time and attach to a gateway of your own; your address and your data do
-not change.
-
 ## Other ways to use FediPod
 
 - [fediverse-session](https://github.com/jeff-zucker/fediverse-session) - an ESM library that supports both Solid-based and regular Fediverse accounts with methods to login, reply, boost, etc.
 - [FediPod Server](https://github.com/jeff-zucker/fedipod-server): a full ActivityPub
   server as a Community Solid Server component, giving every pod on the server
-  the option of a Fediverse account.
+  the option of a Fediverse account.  See this link for how to host your own Solid-ActivityPub server.
 - [FediPod BB](https://github.com/jeff-zucker/fedipod-bb) - A Lemmy-like  bulletin board forum with the structure stored on a group pod and users' data stored on their own pod or on their Fediverse server if they don't have a pod.
+<!--
 - [FediPod DeviceAgent](device-agent.md) a single-user AP server that lives partly in a gateway, partly on a local device, with all data stored on your pod.
+-->
 - [FediPod Groups](groups.md): hosting a discussion group of Fediverse and Bluesky users from a pod.
-- [FediPod Gateway](gateway.md): A thin, always-on door running on Netlify or any small host that provides a middleman between a pod and the single-user agents. (only needed with `BrowserAgent` and `DeviceAgent`)
-
-There are two ways to run FediPod: in a browser at a Gateway such as
-fedipod.net, with nothing installed, or as a Gateway of your own, deployed
-from this repository ([netlify/README.md](netlify/README.md)). Cloning the
-repository and running it is not one of them: `npm start` only says so. The
-DeviceAgent is deprecated; nothing new is built for it.
-
+- [FediPod Gateway](gateway.md): A thin, always-on door running on Netlify or any small host that provides a middleman between a pod and the single-user agents. See this link for how to host your own gateway.
 
 ## Acknowledgements
 

package/gateway.md

@@ -242,9 +242,9 @@ from an app.
 
 **Notifications on your phone.** An app that offers notifications can sign up
 for them here. A mention, a reply, a direct message, a follow, or a like, boost
-or reaction to your own post then reaches your phone as it arrives, while
-FediPod and the app are closed. While FediPod is open in a browser, it reads
-your mail itself, and those arrivals are not pushed.
+or reaction to your own post then reaches your phone as it arrives, whether
+FediPod is open in a browser or closed. Notifications from a connected Bluesky
+or Mastodon account are not pushed.
 
 ## Accounts that go quiet
 

package/gui.md

@@ -19,7 +19,8 @@ The software row names the version the agent is running. When the copy on the ma
   old handle keeps working as a redirect, and the identity is parked
   afterwards.
 * **Retire identity** is permanent — every follower's server is told to drop
-  the account, and the identity does not come back.
+  the account, your WebID profile and public type index stop naming it, and
+  the identity does not come back.
 * In the **Upkeep** group: **Drain the inbox** fetches and handles everything
   waiting now, and **Show dead letters** lists deliveries that failed for
   good and will not be retried.

package/lib/client/masto/accounts.mjs

@@ -8,6 +8,16 @@ import * as podMedia from '../../pod/media.mjs';
 import * as social from '../../core/social.mjs';
 import { readBody, readMultipart } from './body.mjs';
 
+// What a profile picture or header may be: an image of a kind every client
+// shows, stored as that type and named by it, never by the client's filename.
+// Anything else, a web page above all, would be served from the pod's own
+// address and run there when opened.
+const PROFILE_IMAGE_EXT = { 'image/png': 'png', 'image/jpeg': 'jpg', 'image/gif': 'gif', 'image/webp': 'webp', 'image/avif': 'avif' };
+const profileImageType = (f) => {
+  const t = String(f?.contentType || '').split(';')[0].trim().toLowerCase();
+  return PROFILE_IMAGE_EXT[t] ? t : null;
+};
+
 export async function handle(api, ctx) {
   const { req, res, pathname, url, send } = ctx;   // eslint-disable-line no-unused-vars
 
@@ -38,13 +48,17 @@ export async function handle(api, ctx) {
     else form = await readBody(req);
 
     const cfg = { ...api.store.getConfig() };
+    for (const f of [ files.avatar, files.header ]) {
+      if (f?.data?.length && !profileImageType(f)) {
+        return send(422, { error: 'a profile picture or header must be a PNG, JPEG, GIF, WebP or AVIF image' });
+      }
+    }
     const putImage = async (f) => {
-      const ext = (f.filename || '').includes('.')
-        ? f.filename.split('.').pop().replace(/[^\w]/g, '') : 'bin';
-      const slug = new Date().toISOString().slice(0, 10) + '-' + crypto.randomBytes(4).toString('hex') + '.' + ext;
+      const type = profileImageType(f);
+      const slug = new Date().toISOString().slice(0, 10) + '-' + crypto.randomBytes(4).toString('hex') + '.' + PROFILE_IMAGE_EXT[type];
       const url = api.urls.media + slug;
       await api.agent.publisher.ensureMediaContainer();
-      await podMedia.write(api.agent.remote, url, f.data, f.contentType);
+      await podMedia.write(api.agent.remote, url, f.data, type);
       return url;
     };
 

package/lib/client/masto/index.mjs

@@ -84,6 +84,7 @@ export class MastoApi {
       store: this.store,
       subject: () => this.urls?.actor || 'https://localhost/',
       log: this.log,
+      liveKeys: () => new Set(this.tokens().map((t) => this._push.keyOf(t))),
     });
     return this._push;
   }

package/lib/client/masto/oauth.mjs

@@ -12,6 +12,10 @@ const AUTHZ_WINDOW_MS = 60_000;
 const AUTHZ_MAX_ATTEMPTS = 5;
 const CODE_TTL_MS = 5 * 60_000;                  // an authorization code is short-lived
 const MAX_APPS = 200;                            // registered third-party clients, capped
+const MAX_REDIRECTS = 10;                        // return addresses one client may register
+const MAX_REDIRECT_CHARS = 2048;
+const REGISTRATION_WINDOW_MS = 60_000;
+const MAX_REGISTRATIONS = 10;                    // registrations per window, from anyone
 const CLIENT_DOC_TTL_MS = 10 * 60_000;           // how long a fetched client document is trusted
 const CLIENT_DOC_MAX_CACHED = 200;               // ids remembered at once; oldest out
 const CLIENT_DOC_WINDOW_MS = 60_000;
@@ -48,12 +52,14 @@ const parseRedirects = (v) => (Array.isArray(v) ? v : String(v || '').split(/\s+
 // fediverse-session library, and proves that sign-in back to /oauth/authorize.
 function sendPodSigninPage(res, client, webId, mount = '') {
   let asking = '';
+  let allow = 'Allow';
   if (client && (client.name || client.redirect)) {
     let where = '';
     try { where = client.redirect ? new URL(client.redirect).host : ''; } catch { /* oob or blank */ }
     const who = client.name ? escapeHtml(client.name) : (where ? escapeHtml(where) : 'A client');
     asking = `<p><strong>${who}</strong> is asking to use your account`
       + `${where ? `, and you will be sent back to <code>${escapeHtml(where)}</code>` : ''}.</p>`;
+    allow = `Allow ${who}`;
   }
   res.writeHead(200, { 'content-type': 'text/html; charset=utf-8', 'cache-control': 'no-cache' });
   res.end(`<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">
@@ -64,13 +70,14 @@ h1{color:var(--heading);font-size:1.5rem}
 code{word-break:break-all;background:rgba(120,120,120,.12);padding:.05em .35em;border-radius:4px}
 button{font:inherit;padding:.6rem 1.1rem;background:var(--btn);color:#fff;border:none;border-radius:9px;cursor:pointer}
 button[hidden]{display:none}
+#cancel{background:transparent;color:inherit;border:2px solid currentColor;margin-left:.6rem}
 #signin-status{min-height:1.5em;padding:.6rem .8rem;border:1px solid var(--line);border-radius:8px;margin-top:1rem}
-@media (prefers-color-scheme:dark){:root{--heading:#7fb3e8;--btn:#5a8a4f}}</style></head><body>
+@media (prefers-color-scheme:dark){:root{--heading:#7fb3e8;--btn:#4a7a40}}</style></head><body>
 <main>
 <h1>Sign in with your pod</h1>
 ${asking}
 <p>This account belongs to <a id="webid" href="${escapeHtml(webId)}">${escapeHtml(webId)}</a>. Sign in at that pod to allow it.</p>
-<p><button type="button" id="signin" hidden>Sign in with your pod</button></p>
+<p><button type="button" id="signin" hidden>${allow}</button><button type="button" id="cancel" hidden>Cancel</button></p>
 <p id="signin-status" role="status" aria-live="polite"></p>
 </main>
 <script type="module" src="${escapeHtml(mount)}/oauth/session/signin.mjs"></script>
@@ -324,12 +331,53 @@ export function registerApp(api, { name, website, redirectUris, scopes }) {
     clientSecret: crypto.randomBytes(32).toString('base64url'),
     name: String(name || 'client').slice(0, 200),
     website: String(website || '').slice(0, 500),
-    redirectUris, scopes: String(scopes || 'read'), createdAt: Date.now(),
+    redirectUris, scopes: String(scopes || 'read').slice(0, 500), createdAt: Date.now(),
+    // Set when the owner first lets it sign in (touchApp): a client nobody
+    // has used is the first to go when the list is full.
+    usedAt: null,
   };
-  api.store.write('oauth-apps.json', [...api.apps(), app].slice(-MAX_APPS));
+  const kept = api.apps();
+  while (kept.length >= MAX_APPS) kept.splice(kept.indexOf(leastUsed(kept)), 1);
+  api.store.write('oauth-apps.json', [...kept, app]);
   return app;
 }
 
+// The client to push out of a full list: one nobody has signed in with,
+// oldest first; failing that, the one used longest ago. A client registered
+// before `usedAt` existed counts as used when it was made, so a flood of new
+// registrations cannot push out the apps the owner already has.
+function leastUsed(list) {
+  const never = list.filter((a) => a.usedAt === null);
+  const when = (a) => a.usedAt ?? a.createdAt ?? 0;
+  return (never.length ? never : list).reduce((a, b) => (when(b) < when(a) ? b : a));
+}
+
+export function touchApp(api, clientId) {
+  const all = api.apps();
+  const app = all.find((a) => a.clientId === clientId);
+  if (!app) return;
+  app.usedAt = Date.now();
+  api.store.write('oauth-apps.json', all);
+}
+
+// Why a registration's return addresses cannot be kept, or null. Registering
+// needs no sign-in, so its size is the part a stranger controls.
+export function redirectsProblem(raw) {
+  if (Array.isArray(raw) && raw.some((v) => typeof v !== 'string')) return 'redirect_uris must be text';
+  const list = parseRedirects(raw);
+  if (list.length > MAX_REDIRECTS) return `at most ${MAX_REDIRECTS} redirect_uris`;
+  if (list.some((u) => u.length > MAX_REDIRECT_CHARS)) return `a redirect_uri is at most ${MAX_REDIRECT_CHARS} characters`;
+  return null;
+}
+
+export function registrationLimited(api) {
+  const now = Date.now();
+  api.appRegistrations = (api.appRegistrations || []).filter((t) => now - t < REGISTRATION_WINDOW_MS);
+  if (api.appRegistrations.length >= MAX_REGISTRATIONS) return true;
+  api.appRegistrations.push(now);
+  return false;
+}
+
 // A short-lived, single-use authorization code for a registered client, kept
 // apart from masto-tokens.json so the code is NOT a bearer until it is
 // exchanged with the client secret.
@@ -398,6 +446,13 @@ export async function handle(api, ctx) {
   // authorize step becomes a real login form.
   if (pathname === '/api/v1/apps' && req.method === 'POST') {
     const body = await readBody(req);
+    const problem = redirectsProblem(body.redirect_uris);
+    if (problem) return send(422, { error: problem });
+    if (registrationLimited(api)) {
+      api.log('app registration refused: too many this minute');
+      return send(429, { error: 'too many apps registered just now — try again in a minute' },
+        { 'retry-after': String(REGISTRATION_WINDOW_MS / 1000) });
+    }
     const redirectUris = parseRedirects(body.redirect_uris);
     const app = api.registerApp({ name: body.client_name, website: body.website,
       redirectUris, scopes: body.scopes });
@@ -543,6 +598,7 @@ export async function handle(api, ctx) {
         challenge: params.get('code_challenge') || null,
         challengeMethod: params.get('code_challenge_method') || null })
       : api.mintToken(client.scope);
+    if (app) touchApp(api, app.clientId);
     if (!redirect || redirect === 'urn:ietf:wg:oauth:2.0:oob') return send(200, { code });
     const target = new URL(redirect);
     target.searchParams.set('code', code);
@@ -647,6 +703,8 @@ export async function handle(api, ctx) {
     if (gone) {
       const kept = api.tokenRecords().filter(r => r.token !== gone);
       api.store.write('masto-tokens.json', kept);
+      // Its notifications stop with it.
+      if (api.push.get(gone)) api.push.drop(gone);
       api.log('client token revoked');
     }
     return send(200, {});

package/lib/client/oidc-auth.mjs

@@ -8,6 +8,9 @@
 // The verifier is injected so offline tests stub it, and wrapped so the
 // library (CJS, older jose) can be replaced without touching any caller.
 
+import { scopeAllows } from './masto/oauth.mjs';
+import { claimedWebId } from '../gateway/token-claims.mjs';
+
 export function makeC2sAuth({ agent, masto = null, verifier = null, log = () => {}, scheme = null, mount = '' }) {
   let verify = verifier;
   const loadVerifier = async () => {
@@ -19,7 +22,14 @@ export function makeC2sAuth({ agent, masto = null, verifier = null, log = () =>
   };
 
   return async function authenticate(req, pathname) {
-    if (masto?.authed(req)) {
+    const bearer = masto?.tokenOf(req);
+    if (bearer) {
+      // The same permission the Mastodon routes ask of this token: a client
+      // allowed only to read does not post here either.
+      const need = req.method === 'GET' || req.method === 'HEAD' ? 'read' : 'write';
+      if (!scopeAllows(bearer.scope, need)) {
+        return { ok: false, status: 403, error: `this app was not allowed to ${need === 'read' ? 'read' : 'post'} for the account` };
+      }
       return { ok: true, webid: agent.remote?.webId || null, via: 'bearer' };
     }
     if (!req.headers.authorization) {
@@ -32,6 +42,12 @@ export function makeC2sAuth({ agent, masto = null, verifier = null, log = () =>
       return { ok: false, status: 401, error: 'a Solid-OIDC token must come with its DPoP proof',
         headers: { 'www-authenticate': 'DPoP' } };
     }
+    // A token naming anyone but the owner is refused before it is checked:
+    // checking fetches the documents it names, and a stranger names them.
+    const claimed = claimedWebId({ headers: { get: (n) => req.headers[n] ?? null } });
+    if (claimed && claimed !== agent.remote?.webId) {
+      return { ok: false, status: 403, error: 'this account belongs to its owner alone' };
+    }
     let webid;
     try {
       const v = await loadVerifier();
@@ -48,8 +64,10 @@ export function makeC2sAuth({ agent, masto = null, verifier = null, log = () =>
         { header: req.headers.dpop, method: req.method, url: htu },
       ));
     } catch (e) {
+      // The reason stays here: it can carry what was read from an address
+      // the token named.
       log(`c2s auth: token rejected — ${e.message}`);
-      return { ok: false, status: 401, error: `token rejected: ${e.message}` };
+      return { ok: false, status: 401, error: 'token rejected' };
     }
     const owner = agent.remote?.webId;
     if (!owner || webid !== owner) {

package/lib/client/webpush.mjs

@@ -7,10 +7,13 @@ import crypto from 'node:crypto';
 import webpush from 'web-push';
 
 export class Push {
-  constructor({ store, subject, log = () => {} }) {
+  constructor({ store, subject, log = () => {}, liveKeys = null }) {
     this.store = store;
     this.subject = subject;             // () => the actor URL, VAPID's contact
     this.log = log;
+    // () => the keys of the sign-ins still in force, where they are kept beside
+    // the subscriptions; without it no subscription is forgotten for its sign-in.
+    this.liveKeys = liveKeys;
   }
 
   state() { return this.store.read('webpush.json', { subs: {} }); }
@@ -68,14 +71,21 @@ export class Push {
 
   // Push one notification to every subscription whose alerts allow the type.
   // A push service answering 404/410 means the browser dropped the
-  // subscription — it is removed rather than retried forever.
+  // subscription — it is removed rather than retried forever. With
+  // `liveKeys`, every subscription whose sign-in is no longer in force is
+  // forgotten first: an app signed out, expired or pushed off the list hears
+  // nothing more.
   async notify(n, payload) {
     const st = this.state();
+    let dropped = false;
+    const live = this.liveKeys?.() || null;
+    if (live) {
+      for (const key of Object.keys(st.subs)) if (!live.has(key)) { delete st.subs[key]; dropped = true; }
+    }
     const entries = Object.entries(st.subs);
-    if (!entries.length) return;
+    if (!entries.length) { if (dropped) this.save(st); return; }
     const { publicKey, privateKey } = this.vapid();
     const details = { subject: this.subject(), publicKey, privateKey };
-    let dropped = false;
     for (const [key, sub] of entries) {
       if (sub.alerts && sub.alerts[n.type] === false) continue;
       try {

package/lib/core/place.mjs

@@ -52,6 +52,16 @@ export async function recordPlace(pod, podBase, actorAtPod, { create = false } =
   return (await typeIndex.register(pod, index, actorAtPod)) ? 'registered' : 'already';
 }
 
+/**
+ * Take the account's place out of the owner's public type index, for an
+ * account retired for good. Returns 'removed', 'absent' or 'no-index'.
+ */
+export async function forgetPlace(pod, podBase, actorAtPod) {
+  const index = await typeIndex.findPublicIndex(pod, podBase);
+  if (!index) return 'no-index';
+  return (await typeIndex.unregister(pod, index, actorAtPod)) ? 'removed' : 'absent';
+}
+
 /** Whether this person's profile names a public type index. */
 export async function hasPublicIndex(pod, podBase) {
   return !!(await typeIndex.findPublicIndex(pod, podBase).catch(() => null));

package/lib/core/publisher/index.mjs

@@ -26,7 +26,7 @@ import * as restore from './restore.mjs';
 import * as notes from './notes.mjs';
 import * as questions from './questions.mjs';
 import * as own from './own.mjs';
-import { recordPlace } from '../place.mjs';
+import { recordPlace, forgetPlace } from '../place.mjs';
 
 // The version is read where a bundled deploy (the Netlify functions) cannot
 // break it: a package.json that is not beside the bundle is not a reason for
@@ -212,7 +212,7 @@ export class Publisher {
     // writes none — the forum's own actor, or a Gateway, answers for it.
     if (!this.config.forum) {
       await discovery.writeWebfinger(this.remote, urls,
-        wire.jrd({ handle: this.config.handle, host, actor: urls.actor, page: urls.profileHtml }));
+        wire.jrd({ handle: this.config.handle, host, actor: urls.actor, page: urls.profileHtml, avatar: this.config.icon || null }));
       await discovery.writeHostMeta(this.remote, urls, wire.hostMeta(urls.base));
 
       const nodeinfoDocUrl = urls.home + 'ap/nodeinfo-2.0';
@@ -393,6 +393,18 @@ export class Publisher {
     await podActor.writeTombstone(this.remote, urls, wire.tombstoneDoc(urls, deletedAt, this.config.kind));
     this.store.setConfig({ ...this.store.getConfig(), retiredAt: deletedAt });
     await this.store.flush();
+    // The owner's own documents stop pointing at it: the WebID profile's
+    // account and outbox links, and its place in the public type index.
+    // Best-effort, as writing them was.
+    if (!this.config.forum) {
+      await podActor.unlinkInWebIdProfile(this.remote, {
+        actorUrl: urls.actor, outbox: this.clientOrigin ? `${this.clientOrigin}ap/outbox` : this.gatewayOutbox(),
+      }).then((n) => { if (n) this.log('the WebID profile no longer lists the actor'); })
+        .catch((e) => this.log(`the WebID profile still lists the actor: ${e.message}`));
+      await forgetPlace(this.remote, urls.base, urls.home + 'ap/actor')
+        .then((r) => { if (r === 'removed') this.log('the public type index no longer records the account'); })
+        .catch((e) => this.log(`the type index still records the account: ${e.message}`));
+    }
     this.log(`retired: Delete sent to ${inboxes.length} inbox(es), actor replaced with a Tombstone`);
     return { inboxes: inboxes.length, deletedAt };
   }

package/lib/core/store.mjs

@@ -185,9 +185,13 @@ export class PodStore {
   // Read these documents again, whatever is held: a kept copy caught them
   // mid-write, so the pod's copy is the one to hold. Throws when one cannot be
   // read, so the caller can fall back to a full load rather than act without it.
-  async refresh(names) {
+  // `ifChanged`: a document held here is asked for only if it changed since — a
+  // pod's listing does not change when a document in it is rewritten.
+  async refresh(names, { ifChanged = false } = {}) {
     for (const name of names) {
-      const r = await this.storage.read(name);
+      const etag = ifChanged && this.cache.has(name) ? this.etags.get(name) : null;
+      const r = await this.storage.read(name, etag ? { etag } : undefined);
+      if (r.notModified) continue;
       if (r.status === 404) {
         this.cache.delete(name); this.lastText.delete(name); this.etags.delete(name);
       } else if (!r.ok) {

package/lib/core/wire.mjs

@@ -56,13 +56,15 @@ export function hostMeta(base) {
   return `<?xml version="1.0" encoding="UTF-8"?>\n<XRD xmlns="http://docs.oasis-open.org/ns/xri/xrd-1.0">\n  <Link rel="lrdd" template="${base}.well-known/webfinger?resource={uri}"/>\n</XRD>\n`;
 }
 
-export function jrd({ handle, host, actor, aliases = [], page = null }) {
+export function jrd({ handle, host, actor, aliases = [], page = null, avatar = null }) {
   return {
     subject: `acct:${handle}@${host}`,
     ...(aliases.length ? { aliases } : {}),
     links: [
       { rel: 'self', type: 'application/activity+json', href: actor },
       ...(page ? [{ rel: 'http://webfinger.net/rel/profile-page', type: 'text/html', href: page }] : []),
+      // The account's picture, as Mastodon's answer names it.
+      ...(avatar ? [{ rel: 'http://webfinger.net/rel/avatar', href: avatar }] : []),
     ],
   };
 }