fedipod 1.48.0 → 1.49.0

package/lib/server/embed.mjs

@@ -241,7 +241,7 @@ export async function ensureInboxDoor(agent, urls, log = () => {}) {
  * The policy is read from the identity's live state rather than its
  * published policy document, because both are in this process.
  */
-export async function deliverToInbox(agent, request, { podPut, gatewayWebId = null, fetchImpl = fetch } = {}) {
+export async function deliverToInbox(agent, request, { podPut, gatewayWebId = null, fetchImpl = fetch, admit = null } = {}) {
   const cfg = agent.store.getConfig() || {};
   const contacts = agent.store.getContacts();
   const bl = agent.store.getBlocklist();
@@ -258,7 +258,7 @@ export async function deliverToInbox(agent, request, { podPut, gatewayWebId = nu
     gatewayWebId,
     hmacSecret: cfg.gateway?.hmacSecret || null,
   };
-  return handleDelivery(request, ident, { podPut, fetchImpl });
+  return handleDelivery(request, ident, { podPut, fetchImpl, admit });
 }
 
 /**

package/lib/shared/safefetch.mjs

@@ -122,6 +122,17 @@ export function insecureUrlReason(url, what = 'address') {
     + 'Use https:// — or a loopback address if the pod is on this machine.';
 }
 
+// Whether a URL's host is, or resolves to, a private address. A host that does
+// not resolve names no address at all, and a request to it fails on its own.
+export async function namesPrivateAddress(url) {
+  if (process.env.AP_ALLOW_PRIVATE_TARGETS === '1') return false;
+  let u;
+  try { u = new URL(url); } catch { return false; }
+  const host = u.hostname.replace(/^\[|\]$/g, '');
+  if (net.isIP(host)) return isPrivateAddress(host);
+  try { return (await dns.lookup(host, { all: true })).some((a) => isPrivateAddress(a.address)); } catch { return false; }
+}
+
 // Throws when the URL must not be requested; otherwise returns the
 // validated address to pin the connection to ({address, family}), or null
 // when the URL already names a literal IP.

package/lib/surface/surface.mjs

@@ -163,7 +163,8 @@ export function buildAdminSurface({ agent, gate, allowed, log = console.log,
     // answer a foreign Origin, per above.
     const bad = checkRequest(req, allowed, { ignoreOrigin: apiPath });
     if (bad) {
-      log(`refused: ${bad} (${req.method} ${req.url})`);
+      // The path only: an address can carry a key, and a log is kept.
+      log(`refused: ${bad} (${req.method} ${url.pathname})`);
       res.writeHead(403, { 'content-type': 'text/plain', ...securityHeaders(allowed, false) });
       res.end('forbidden\n');
       return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fedipod",
-  "version": "1.48.0",
+  "version": "1.49.0",
   "description": "Standalone single-actor ActivityPub agent whose wire face, RDF truth and state all live on a Solid pod (CSS). Bundles a Phanpy UI and a Mastodon client-API facade.",
   "type": "module",
   "license": "MIT",
@@ -55,7 +55,7 @@
     "install-service": "node bin/fedipod.mjs install-service",
     "uninstall-service": "node bin/fedipod.mjs uninstall-service",
     "prepublishOnly": "npm test",
-    "test": "node claude/smoke-tests/agent-smoke.mjs && node claude/smoke-tests/front-hard-test.mjs && node claude/smoke-tests/copy-test.mjs && node claude/smoke-tests/copy-mode-test.mjs && node claude/smoke-tests/hold-test.mjs && node claude/smoke-tests/masto-gateway-test.mjs && node scripts/check-pod-calls.mjs && node scripts/verify-ui.mjs && node --test claude/smoke-tests/forum-signup-form.test.mjs claude/smoke-tests/door-verify.test.mjs && node scripts/check-sizes.mjs && node scripts/test-dependents.mjs && node claude/validation/browser-agent/all.mjs",
+    "test": "node claude/smoke-tests/agent-smoke.mjs && node claude/smoke-tests/front-hard-test.mjs && node claude/smoke-tests/copy-test.mjs && node claude/smoke-tests/copy-mode-test.mjs && node claude/smoke-tests/hold-test.mjs && node claude/smoke-tests/masto-gateway-test.mjs && node scripts/check-pod-calls.mjs && node scripts/verify-ui.mjs && node --test claude/smoke-tests/forum-signup-form.test.mjs claude/smoke-tests/door-verify.test.mjs claude/smoke-tests/oauth-signin.test.mjs claude/smoke-tests/app-registration.test.mjs claude/smoke-tests/push-signout.test.mjs claude/smoke-tests/token-fetches.test.mjs && node scripts/check-sizes.mjs && node scripts/test-dependents.mjs && node claude/validation/browser-agent/all.mjs",
     "verify-ui": "node scripts/verify-ui.mjs",
     "build:sw": "node scripts/build-app.mjs --entry web/app/sw-src.mjs --out web/app/dist/sw.js",
     "build:boot": "node scripts/build-app.mjs --entry web/app/boot.mjs --out web/app/dist/boot.js",

package/web/admin/index.html

@@ -527,7 +527,8 @@ pre { overflow-x: auto; background: #0001; padding: .6rem; border-radius: .3rem;
     <p><strong>This cannot be undone.</strong> A Delete goes to every follower's inbox telling
       those servers to drop the account and the posts they cached, the actor document is
       replaced with a Tombstone, and this agent will refuse to start again for this pod. Your
-      posts and RDF stay on the pod; the identity does not come back.</p>
+      WebID profile and public type index stop naming the account. Your posts and RDF stay on
+      the pod; the identity does not come back.</p>
     <p>Two things that are not this, and can be done from here:
       <button type="button" id="go-park" title="   Park instead: keeps the handle, just stops the mail" class="inline">Park it instead</button>
       keeps the handle resolving and just stops the mail — setting status back to

package/web/admin/oauth-signin.mjs

@@ -8,15 +8,26 @@ const $ = (id) => document.getElementById(id);
 const say = (text, error = false) => { const s = $('signin-status'); s.textContent = text; s.setAttribute('role', error ? 'alert' : 'status'); };
 const webId = $('webid').href;
 const here = location.origin + location.pathname;
+const params = new URLSearchParams(location.search);
 const login = fediLogin({ dbName: 'fedipod-signin', clientName: 'FediPod sign-in', redirectUri: here });
+// The owner's own yes to this client, given by pressing Allow in this tab. It
+// rides the trip to the pod and back, and nothing else stands for it: a link
+// that lands here with a pod sign-in already stored gets nothing without it.
+// The same rule as the Gateway's app sign-in (web/app-signin/app-signin.mjs).
+const CONSENT = 'fedipod-signin-consent';
+const request = `${params.get('client_id')}\n${params.get('redirect_uri') || ''}`;
+const consented = () => { try { return sessionStorage.getItem(CONSENT) === request; } catch { return false; } };
+const consent = (on) => { try { if (on) sessionStorage.setItem(CONSENT, request); else sessionStorage.removeItem(CONSENT); } catch { /* keeps no site data */ } };
 
 // Back from the pod: this finishes the sign-in and returns to the client's
 // request, which carries the client's own parameters.
 try { await login.resume(); } catch (e) { say(e.message, true); }
 
+// Proves the pod sign-in to the account. True when nothing more is asked here.
 async function prove() {
   const s = await login.getSession();
-  if (!s) return false;
+  if (!s || !consented()) return false;
+  consent(false);
   if (s.webId !== webId) { say(`You signed in as ${s.webId}, but this account belongs to ${webId}. Sign out there and sign in as the owner.`, true); return true; }
   say('Signing you in…');
   const res = await s.fetch(here, {
@@ -30,8 +41,20 @@ async function prove() {
   return true;
 }
 
-if (location.search.includes('client_id=') && !(await prove())) $('signin').hidden = false;
+const choices = (shown) => { $('signin').hidden = !shown; $('cancel').hidden = !shown; };
+
 $('signin').addEventListener('click', async () => {
+  consent(true);
+  choices(false);
+  if (await prove()) return;
   say('Taking you to your pod…');
-  try { await login.login(webId, { returnTo: location.href, redirectUri: here }); } catch (e) { say(e.message, true); }
+  try { await login.login(webId, { returnTo: location.href, redirectUri: here }); } catch (e) { say(e.message, true); choices(true); }
+});
+$('cancel').addEventListener('click', () => {
+  consent(false);
+  choices(false);
+  say('Nothing was allowed. You can close this page.');
 });
+
+// Back from the pod after pressing Allow: finish. Otherwise ask.
+if (params.get('client_id') && !(consented() && await prove())) choices(true);

package/web/app/agent.mjs

@@ -152,8 +152,9 @@ export class BrowserAgent {
 
   // One call to the gateway's owner API, proved with the pod session. What
   // comes back on 200 or 410 is the account's standing there, kept for the
-  // manage page; anything else is logged and forgotten.
-  async tellGateway(what, body) {
+  // manage page; anything else is logged and forgotten. `standing: false` for
+  // a call whose answer says nothing about the account's standing.
+  async tellGateway(what, body, { standing = true } = {}) {
     if (!this.gatewayApi) return null;
     let res;
     try {
@@ -163,15 +164,38 @@ export class BrowserAgent {
     } catch (e) { this.log(`gateway ${what}: ${e.message}`); return null; }
     const json = await res.json().catch(() => ({}));
     const out = { status: res.status, ...json };
-    if (res.status === 200 || res.status === 410) this.gatewayStanding = out;
+    if (res.status === 200 || res.status === 410) { if (standing) this.gatewayStanding = out; }
     else this.log(`gateway ${what}: ${res.status} ${json.error || ''}`);
     return out;
   }
-  openAtGateway() { return this.tellGateway('open', { handle: this.doorKey }); }
+  // The account's picture goes with it, for the address's WebFinger answer;
+  // said only once the account has been read, so "none" is never a guess.
+  openAtGateway() {
+    const config = this.store?.getConfig?.();
+    return this.tellGateway('open', { handle: this.doorKey, ...(config ? { icon: config.icon || null } : {}) });
+  }
   pauseAtGateway(paused) { return this.tellGateway('pause', { handle: this.doorKey, paused: !!paused }); }
   closeAtGateway() { return this.tellGateway('close', { handle: this.doorKey, confirm: true }); }
   static OPEN_EVERY_MS = 60 * 60_000;
 
+  // A notification made here, from mail read while FediPod is open, goes to
+  // the phones the owner signed up, as one made while it is closed does
+  // (lib/gateway/held-mail.mjs: /api/push). Named a moment later, once written,
+  // so a burst is one call. One from another network is not pushed.
+  static PUSH_AFTER_MS = 2_000;
+  notePush(n) {
+    if (!this.gatewayApi || n?.bsky || n?.via) return;
+    if (!Object.keys(this.store.read('webpush.json', { subs: {} }).subs || {}).length) return;
+    (this._toPush ||= new Set()).add(n.id);
+    this._pushTimer ||= setTimeout(async () => {
+      const ids = [...this._toPush];
+      this._toPush.clear();
+      this._pushTimer = null;
+      await this.store.flush?.().catch(() => {});
+      await this.tellGateway('push', { handle: this.doorKey, ids }, { standing: false });
+    }, BrowserAgent.PUSH_AFTER_MS);
+  }
+
   // The gateway acting for this account while the app is closed, or not. On:
   // the rules on the account's folders name the gateway's pod identity, then
   // the gateway is told. Off: the gateway is told first, so it stops, then the
@@ -304,6 +328,7 @@ export class BrowserAgent {
           if (this.viewer) return;              // another agent holds the copy: reading only
         }
       }
+      this.store.onEvent = (type, n) => { if (type === 'notification') this.notePush(n); };
       const now = Date.now();
       // Said before the drain starts, so held mail is in the inbox to be read.
       const hereDue = !warm || now - (warm.hereAt || 0) >= BrowserAgent.HERE_EVERY_MS;

package/web/app/dist/boot.js

@@ -32999,6 +32999,33 @@ var PodTransport = class {
     await this.writeAboutWebId(podBase, { inserts: missing, deletes: stale });
     return true;
   }
+  /**
+   * The account taken out of the WebID profile again, as linkAccountInProfile
+   * wrote it: the foaf:account link, what the profile says of the actor, and
+   * `outbox` when it is the one named. From every document of the profile that
+   * holds any of it, each write checked. Returns how many documents changed.
+   */
+  async unlinkAccountInProfile({ actorUrl, outbox = null }) {
+    const me = namedNode2(this.webId);
+    const actor = namedNode2(actorUrl);
+    let changed = 0;
+    for (const d of await this.profileDocs(podBaseOfWebId(this.webId))) {
+      if (!d.g) continue;
+      const gone = [
+        ...d.g.statementsMatching(me, FOAF("account"), actor),
+        ...d.g.statementsMatching(actor, RDF3("type"), FOAF("OnlineAccount")),
+        ...d.g.statementsMatching(actor, RDF3("type"), AS("Person")),
+        ...d.g.statementsMatching(actor, RDF3("type"), AS("Group")),
+        ...d.g.statementsMatching(actor, FOAF("accountName"), null),
+        ...outbox ? d.g.statementsMatching(me, AS("outbox"), namedNode2(outbox)) : []
+      ].map((st2) => [st2.subject, st2.predicate, st2.object]);
+      if (!gone.length) continue;
+      const status = await this.writeRdfChecked(d.url, d.g, { deletes: gone, mustDescribe: d.profile ? this.webId : null });
+      if (status >= 300) throw new Error(`not written: ${d.url} \u2192 ${status}`);
+      changed++;
+    }
+    return changed;
+  }
   /**
    * An N3 Patch of exactly these statements, or false when the pod will not
    * take one and the caller should write the document instead.