fedipod 1.48.1 → 1.49.0

package/lib/client/masto/accounts.mjs

@@ -8,6 +8,16 @@ import * as podMedia from '../../pod/media.mjs';
 import * as social from '../../core/social.mjs';
 import { readBody, readMultipart } from './body.mjs';
 
+// What a profile picture or header may be: an image of a kind every client
+// shows, stored as that type and named by it, never by the client's filename.
+// Anything else, a web page above all, would be served from the pod's own
+// address and run there when opened.
+const PROFILE_IMAGE_EXT = { 'image/png': 'png', 'image/jpeg': 'jpg', 'image/gif': 'gif', 'image/webp': 'webp', 'image/avif': 'avif' };
+const profileImageType = (f) => {
+  const t = String(f?.contentType || '').split(';')[0].trim().toLowerCase();
+  return PROFILE_IMAGE_EXT[t] ? t : null;
+};
+
 export async function handle(api, ctx) {
   const { req, res, pathname, url, send } = ctx;   // eslint-disable-line no-unused-vars
 
@@ -38,13 +48,17 @@ export async function handle(api, ctx) {
     else form = await readBody(req);
 
     const cfg = { ...api.store.getConfig() };
+    for (const f of [ files.avatar, files.header ]) {
+      if (f?.data?.length && !profileImageType(f)) {
+        return send(422, { error: 'a profile picture or header must be a PNG, JPEG, GIF, WebP or AVIF image' });
+      }
+    }
     const putImage = async (f) => {
-      const ext = (f.filename || '').includes('.')
-        ? f.filename.split('.').pop().replace(/[^\w]/g, '') : 'bin';
-      const slug = new Date().toISOString().slice(0, 10) + '-' + crypto.randomBytes(4).toString('hex') + '.' + ext;
+      const type = profileImageType(f);
+      const slug = new Date().toISOString().slice(0, 10) + '-' + crypto.randomBytes(4).toString('hex') + '.' + PROFILE_IMAGE_EXT[type];
       const url = api.urls.media + slug;
       await api.agent.publisher.ensureMediaContainer();
-      await podMedia.write(api.agent.remote, url, f.data, f.contentType);
+      await podMedia.write(api.agent.remote, url, f.data, type);
       return url;
     };
 

package/lib/client/masto/index.mjs

@@ -84,6 +84,7 @@ export class MastoApi {
       store: this.store,
       subject: () => this.urls?.actor || 'https://localhost/',
       log: this.log,
+      liveKeys: () => new Set(this.tokens().map((t) => this._push.keyOf(t))),
     });
     return this._push;
   }

package/lib/client/masto/oauth.mjs

@@ -12,6 +12,10 @@ const AUTHZ_WINDOW_MS = 60_000;
 const AUTHZ_MAX_ATTEMPTS = 5;
 const CODE_TTL_MS = 5 * 60_000;                  // an authorization code is short-lived
 const MAX_APPS = 200;                            // registered third-party clients, capped
+const MAX_REDIRECTS = 10;                        // return addresses one client may register
+const MAX_REDIRECT_CHARS = 2048;
+const REGISTRATION_WINDOW_MS = 60_000;
+const MAX_REGISTRATIONS = 10;                    // registrations per window, from anyone
 const CLIENT_DOC_TTL_MS = 10 * 60_000;           // how long a fetched client document is trusted
 const CLIENT_DOC_MAX_CACHED = 200;               // ids remembered at once; oldest out
 const CLIENT_DOC_WINDOW_MS = 60_000;
@@ -48,12 +52,14 @@ const parseRedirects = (v) => (Array.isArray(v) ? v : String(v || '').split(/\s+
 // fediverse-session library, and proves that sign-in back to /oauth/authorize.
 function sendPodSigninPage(res, client, webId, mount = '') {
   let asking = '';
+  let allow = 'Allow';
   if (client && (client.name || client.redirect)) {
     let where = '';
     try { where = client.redirect ? new URL(client.redirect).host : ''; } catch { /* oob or blank */ }
     const who = client.name ? escapeHtml(client.name) : (where ? escapeHtml(where) : 'A client');
     asking = `<p><strong>${who}</strong> is asking to use your account`
       + `${where ? `, and you will be sent back to <code>${escapeHtml(where)}</code>` : ''}.</p>`;
+    allow = `Allow ${who}`;
   }
   res.writeHead(200, { 'content-type': 'text/html; charset=utf-8', 'cache-control': 'no-cache' });
   res.end(`<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">
@@ -64,13 +70,14 @@ h1{color:var(--heading);font-size:1.5rem}
 code{word-break:break-all;background:rgba(120,120,120,.12);padding:.05em .35em;border-radius:4px}
 button{font:inherit;padding:.6rem 1.1rem;background:var(--btn);color:#fff;border:none;border-radius:9px;cursor:pointer}
 button[hidden]{display:none}
+#cancel{background:transparent;color:inherit;border:2px solid currentColor;margin-left:.6rem}
 #signin-status{min-height:1.5em;padding:.6rem .8rem;border:1px solid var(--line);border-radius:8px;margin-top:1rem}
-@media (prefers-color-scheme:dark){:root{--heading:#7fb3e8;--btn:#5a8a4f}}</style></head><body>
+@media (prefers-color-scheme:dark){:root{--heading:#7fb3e8;--btn:#4a7a40}}</style></head><body>
 <main>
 <h1>Sign in with your pod</h1>
 ${asking}
 <p>This account belongs to <a id="webid" href="${escapeHtml(webId)}">${escapeHtml(webId)}</a>. Sign in at that pod to allow it.</p>
-<p><button type="button" id="signin" hidden>Sign in with your pod</button></p>
+<p><button type="button" id="signin" hidden>${allow}</button><button type="button" id="cancel" hidden>Cancel</button></p>
 <p id="signin-status" role="status" aria-live="polite"></p>
 </main>
 <script type="module" src="${escapeHtml(mount)}/oauth/session/signin.mjs"></script>
@@ -324,12 +331,53 @@ export function registerApp(api, { name, website, redirectUris, scopes }) {
     clientSecret: crypto.randomBytes(32).toString('base64url'),
     name: String(name || 'client').slice(0, 200),
     website: String(website || '').slice(0, 500),
-    redirectUris, scopes: String(scopes || 'read'), createdAt: Date.now(),
+    redirectUris, scopes: String(scopes || 'read').slice(0, 500), createdAt: Date.now(),
+    // Set when the owner first lets it sign in (touchApp): a client nobody
+    // has used is the first to go when the list is full.
+    usedAt: null,
   };
-  api.store.write('oauth-apps.json', [...api.apps(), app].slice(-MAX_APPS));
+  const kept = api.apps();
+  while (kept.length >= MAX_APPS) kept.splice(kept.indexOf(leastUsed(kept)), 1);
+  api.store.write('oauth-apps.json', [...kept, app]);
   return app;
 }
 
+// The client to push out of a full list: one nobody has signed in with,
+// oldest first; failing that, the one used longest ago. A client registered
+// before `usedAt` existed counts as used when it was made, so a flood of new
+// registrations cannot push out the apps the owner already has.
+function leastUsed(list) {
+  const never = list.filter((a) => a.usedAt === null);
+  const when = (a) => a.usedAt ?? a.createdAt ?? 0;
+  return (never.length ? never : list).reduce((a, b) => (when(b) < when(a) ? b : a));
+}
+
+export function touchApp(api, clientId) {
+  const all = api.apps();
+  const app = all.find((a) => a.clientId === clientId);
+  if (!app) return;
+  app.usedAt = Date.now();
+  api.store.write('oauth-apps.json', all);
+}
+
+// Why a registration's return addresses cannot be kept, or null. Registering
+// needs no sign-in, so its size is the part a stranger controls.
+export function redirectsProblem(raw) {
+  if (Array.isArray(raw) && raw.some((v) => typeof v !== 'string')) return 'redirect_uris must be text';
+  const list = parseRedirects(raw);
+  if (list.length > MAX_REDIRECTS) return `at most ${MAX_REDIRECTS} redirect_uris`;
+  if (list.some((u) => u.length > MAX_REDIRECT_CHARS)) return `a redirect_uri is at most ${MAX_REDIRECT_CHARS} characters`;
+  return null;
+}
+
+export function registrationLimited(api) {
+  const now = Date.now();
+  api.appRegistrations = (api.appRegistrations || []).filter((t) => now - t < REGISTRATION_WINDOW_MS);
+  if (api.appRegistrations.length >= MAX_REGISTRATIONS) return true;
+  api.appRegistrations.push(now);
+  return false;
+}
+
 // A short-lived, single-use authorization code for a registered client, kept
 // apart from masto-tokens.json so the code is NOT a bearer until it is
 // exchanged with the client secret.
@@ -398,6 +446,13 @@ export async function handle(api, ctx) {
   // authorize step becomes a real login form.
   if (pathname === '/api/v1/apps' && req.method === 'POST') {
     const body = await readBody(req);
+    const problem = redirectsProblem(body.redirect_uris);
+    if (problem) return send(422, { error: problem });
+    if (registrationLimited(api)) {
+      api.log('app registration refused: too many this minute');
+      return send(429, { error: 'too many apps registered just now — try again in a minute' },
+        { 'retry-after': String(REGISTRATION_WINDOW_MS / 1000) });
+    }
     const redirectUris = parseRedirects(body.redirect_uris);
     const app = api.registerApp({ name: body.client_name, website: body.website,
       redirectUris, scopes: body.scopes });
@@ -543,6 +598,7 @@ export async function handle(api, ctx) {
         challenge: params.get('code_challenge') || null,
         challengeMethod: params.get('code_challenge_method') || null })
       : api.mintToken(client.scope);
+    if (app) touchApp(api, app.clientId);
     if (!redirect || redirect === 'urn:ietf:wg:oauth:2.0:oob') return send(200, { code });
     const target = new URL(redirect);
     target.searchParams.set('code', code);
@@ -647,6 +703,8 @@ export async function handle(api, ctx) {
     if (gone) {
       const kept = api.tokenRecords().filter(r => r.token !== gone);
       api.store.write('masto-tokens.json', kept);
+      // Its notifications stop with it.
+      if (api.push.get(gone)) api.push.drop(gone);
       api.log('client token revoked');
     }
     return send(200, {});

package/lib/client/oidc-auth.mjs

@@ -8,6 +8,9 @@
 // The verifier is injected so offline tests stub it, and wrapped so the
 // library (CJS, older jose) can be replaced without touching any caller.
 
+import { scopeAllows } from './masto/oauth.mjs';
+import { claimedWebId } from '../gateway/token-claims.mjs';
+
 export function makeC2sAuth({ agent, masto = null, verifier = null, log = () => {}, scheme = null, mount = '' }) {
   let verify = verifier;
   const loadVerifier = async () => {
@@ -19,7 +22,14 @@ export function makeC2sAuth({ agent, masto = null, verifier = null, log = () =>
   };
 
   return async function authenticate(req, pathname) {
-    if (masto?.authed(req)) {
+    const bearer = masto?.tokenOf(req);
+    if (bearer) {
+      // The same permission the Mastodon routes ask of this token: a client
+      // allowed only to read does not post here either.
+      const need = req.method === 'GET' || req.method === 'HEAD' ? 'read' : 'write';
+      if (!scopeAllows(bearer.scope, need)) {
+        return { ok: false, status: 403, error: `this app was not allowed to ${need === 'read' ? 'read' : 'post'} for the account` };
+      }
       return { ok: true, webid: agent.remote?.webId || null, via: 'bearer' };
     }
     if (!req.headers.authorization) {
@@ -32,6 +42,12 @@ export function makeC2sAuth({ agent, masto = null, verifier = null, log = () =>
       return { ok: false, status: 401, error: 'a Solid-OIDC token must come with its DPoP proof',
         headers: { 'www-authenticate': 'DPoP' } };
     }
+    // A token naming anyone but the owner is refused before it is checked:
+    // checking fetches the documents it names, and a stranger names them.
+    const claimed = claimedWebId({ headers: { get: (n) => req.headers[n] ?? null } });
+    if (claimed && claimed !== agent.remote?.webId) {
+      return { ok: false, status: 403, error: 'this account belongs to its owner alone' };
+    }
     let webid;
     try {
       const v = await loadVerifier();
@@ -48,8 +64,10 @@ export function makeC2sAuth({ agent, masto = null, verifier = null, log = () =>
         { header: req.headers.dpop, method: req.method, url: htu },
       ));
     } catch (e) {
+      // The reason stays here: it can carry what was read from an address
+      // the token named.
       log(`c2s auth: token rejected — ${e.message}`);
-      return { ok: false, status: 401, error: `token rejected: ${e.message}` };
+      return { ok: false, status: 401, error: 'token rejected' };
     }
     const owner = agent.remote?.webId;
     if (!owner || webid !== owner) {

package/lib/client/webpush.mjs

@@ -7,10 +7,13 @@ import crypto from 'node:crypto';
 import webpush from 'web-push';
 
 export class Push {
-  constructor({ store, subject, log = () => {} }) {
+  constructor({ store, subject, log = () => {}, liveKeys = null }) {
     this.store = store;
     this.subject = subject;             // () => the actor URL, VAPID's contact
     this.log = log;
+    // () => the keys of the sign-ins still in force, where they are kept beside
+    // the subscriptions; without it no subscription is forgotten for its sign-in.
+    this.liveKeys = liveKeys;
   }
 
   state() { return this.store.read('webpush.json', { subs: {} }); }
@@ -68,14 +71,21 @@ export class Push {
 
   // Push one notification to every subscription whose alerts allow the type.
   // A push service answering 404/410 means the browser dropped the
-  // subscription — it is removed rather than retried forever.
+  // subscription — it is removed rather than retried forever. With
+  // `liveKeys`, every subscription whose sign-in is no longer in force is
+  // forgotten first: an app signed out, expired or pushed off the list hears
+  // nothing more.
   async notify(n, payload) {
     const st = this.state();
+    let dropped = false;
+    const live = this.liveKeys?.() || null;
+    if (live) {
+      for (const key of Object.keys(st.subs)) if (!live.has(key)) { delete st.subs[key]; dropped = true; }
+    }
     const entries = Object.entries(st.subs);
-    if (!entries.length) return;
+    if (!entries.length) { if (dropped) this.save(st); return; }
     const { publicKey, privateKey } = this.vapid();
     const details = { subject: this.subject(), publicKey, privateKey };
-    let dropped = false;
     for (const [key, sub] of entries) {
       if (sub.alerts && sub.alerts[n.type] === false) continue;
       try {

package/lib/gateway/front-core.mjs

@@ -18,7 +18,7 @@
 import crypto from 'node:crypto';
 import { handleDelivery } from './gateway-core.mjs';
 import { ownerPostAtDoor } from './outbox-door.mjs';
-import { readCapped, safeFetch, isLoopbackHost } from '../shared/safefetch.mjs';
+import { readCapped, safeFetch, isLoopbackHost, namesPrivateAddress } from '../shared/safefetch.mjs';
 import * as podRoot from '../pod/root.mjs';
 import * as podPolicy from '../pod/policy.mjs';
 import { podBaseOfWebId } from '../pod/urls.mjs';
@@ -26,8 +26,9 @@ import { routeQuietApi, noteOpened, noteReceived, closedState, accountState, clo
 import { holdsMail, mayBeAway, isPresent, holdingPut, afterHeld, routeHereApi, routeKeeperApi, routePushApi } from './held-mail.mjs';
 import { routeNoticesApi } from './notices.mjs';
 import { withSecurityHeaders } from './headers.mjs';
-import { podTokenVerifier } from './caches.mjs';
-import { claimedWebId } from './token-claims.mjs';
+import { claimedWebId, verifyPodToken } from './token-claims.mjs';
+
+export { verifyPodToken };
 import { answerPrivateRead } from './private-read.mjs';
 import { announced, overLimit, relayOne } from './relay-extras.mjs';
 
@@ -56,29 +57,6 @@ const profilePageOf = (rec) => (rec?.podHome ? rec.podHome + 'ap/profile.html' :
 
 const AP_CT = 'application/activity+json';
 
-// Verify a Solid-OIDC token (DPoP-bound) and return its WebID, or null. The
-// verifier is injected so tests stub it; in production it is the same library
-// the agent's own C2S auth uses.
-export async function verifyPodToken(request, pathname, verifier) {
-  const authz = request.headers.get('authorization');
-  if (!authz) return null;
-  try {
-    const dpop = request.headers.get('dpop');
-    // Solid-OIDC binds the token to a key the client proves on every request;
-    // a token shown without the proof is one anyone who saw it could show.
-    if (!dpop) { console.log(`front: pod token without a DPoP proof refused on ${pathname}`); return null; }
-    const v = verifier || await podTokenVerifier();
-    const url = request.url;
-    const { webid } = await v(authz, { header: dpop, method: request.method, url });
-    return webid || null;
-  } catch (e) {
-    // Said aloud: a token the front will not take is otherwise a bare 401 to
-    // the caller and nothing at all here.
-    console.log(`front: pod token refused on ${pathname}: ${e?.message || e}`);
-    return null;
-  }
-}
-
 // Is this WebID served by the claimed pod? A pod owner's WebID lives on the pod
 // origin — that is the whole proof: a token for a WebID under podHome could
 // only be minted by someone who controls that pod's identity provider.
@@ -104,6 +82,13 @@ function webidUnderPod(webid, podHome) {
   } catch { return false; }
 }
 
+// Whether a WebID is this row's owner: the one recorded, or for a row from
+// before WebIDs were recorded, one living on the row's pod.
+const ownsRow = (rec) => (webid) => (rec.webId ? webid === rec.webId : webidUnderPod(webid, rec.podHome));
+
+// A front on this machine: a test run, whose pods and identity providers are here too.
+const frontOnThisMachine = (ctx) => { try { return isLoopbackHost(new URL(ctx.frontOrigin).hostname); } catch { return false; } };
+
 /**
  * Whether this WebID may speak for this pod.
  *
@@ -361,7 +346,7 @@ async function route(request, ctx) {
   // Solid-OIDC token — and must be the WebID the deploy names as admin.
   if (pathname === '/api/roster') {
     if (!ctx.listDirectory || !ctx.adminWebId) return j(501, { error: 'this front has no roster to offer' });
-    const webid = await verifyPodToken(request, pathname, ctx.verifier);
+    const webid = await verifyPodToken(request, pathname, ctx.verifier, { only: (w) => w === ctx.adminWebId });
     if (!webid) return j(401, { error: 'a Solid-OIDC token is required' });
     if (webid !== ctx.adminWebId) return j(403, { error: 'that WebID is not the admin of this front' });
     const rows = await ctx.listDirectory();
@@ -381,7 +366,7 @@ async function route(request, ctx) {
   // for good; a row seeded in the deploy's environment can only be removed there.
   if (pathname === '/api/revoke' && request.method === 'POST') {
     if (!ctx.removeDirectory || !ctx.adminWebId) return j(501, { error: 'this front cannot revoke accounts' });
-    const webid = await verifyPodToken(request, pathname, ctx.verifier);
+    const webid = await verifyPodToken(request, pathname, ctx.verifier, { only: (w) => w === ctx.adminWebId });
     if (!webid) return j(401, { error: 'a Solid-OIDC token is required' });
     if (webid !== ctx.adminWebId) return j(403, { error: 'that WebID is not the admin of this front' });
     let body;
@@ -470,7 +455,12 @@ async function route(request, ctx) {
     }
     const badPod = podHomeProblem(podHome, ctx.frontOrigin);
     if (badPod) return j(400, { error: badPod });
-    const webid = await verifyPodToken(request, pathname, ctx.verifier);
+    // Anyone may sign up, so the pod and the token's addresses are a
+    // stranger's to name, and checking them fetches them. A front on the
+    // internet fetches only public ones; one on this machine, for testing, its own.
+    const publicOnly = !frontOnThisMachine(ctx);
+    if (publicOnly && await namesPrivateAddress(podHome)) return j(400, { error: 'that pod address is not on the public internet' });
+    const webid = await verifyPodToken(request, pathname, ctx.verifier, { publicOnly });
     if (!webid) return j(401, { error: 'a Solid-OIDC token proving the pod is required' });
     if (!await provesPod(webid, podHome, ctx.fetchImpl)) {
       return j(403, { error: 'the token proves a different pod than the one you listed' });
@@ -571,10 +561,9 @@ async function route(request, ctx) {
       return withApiCors(j(400, { error: 'movedTo must be an https …/ap/actor URL' }));
     }
     if (ctx.frontOrigin && mu.origin === new URL(ctx.frontOrigin).origin) return withApiCors(j(400, { error: 'that address is at this gateway' }));
-    const webid = await verifyPodToken(request, pathname, ctx.verifier);
+    const webid = await verifyPodToken(request, pathname, ctx.verifier, { only: ownsRow(rec) });
     if (!webid) return withApiCors(j(401, { error: 'a Solid-OIDC token proving the pod is required' }));
-    const owner = rec.webId ? webid === rec.webId : webidUnderPod(webid, rec.podHome);
-    if (!owner) return withApiCors(j(403, { error: "the token proves a different pod than this account's" }));
+    if (!ownsRow(rec)(webid)) return withApiCors(j(403, { error: "the token proves a different pod than this account's" }));
     const movedAt = rec.movedTo === movedTo && rec.movedAt ? rec.movedAt : new Date().toISOString();
     await ctx.putDirectory(handle, { ...rec, movedTo, movedAt });
     console.log(`front @${handle}: moved to ${movedTo}`);
@@ -603,10 +592,9 @@ async function route(request, ctx) {
     const handle = String(body.handle || '').toLowerCase();
     const rec = await ctx.lookup(handle);
     if (!rec) { console.log(`relay: no account named ${handle}`); return withApiCors(j(404, { error: 'no such account' })); }
-    const webid = await verifyPodToken(request, pathname, ctx.verifier);
+    const webid = await verifyPodToken(request, pathname, ctx.verifier, { only: ownsRow(rec) });
     if (!webid) { console.log(`relay @${handle}: no usable pod token`); return withApiCors(j(401, { error: 'a Solid-OIDC token proving the pod is required' })); }
-    const owner = rec.webId ? webid === rec.webId : webidUnderPod(webid, rec.podHome);
-    if (!owner) { console.log(`relay @${handle}: token is for ${webid}, not this account's pod`); return withApiCors(j(403, { error: "the token proves a different pod than this account's" })); }
+    if (!ownsRow(rec)(webid)) { console.log(`relay @${handle}: token is for ${webid}, not this account's pod`); return withApiCors(j(403, { error: "the token proves a different pod than this account's" })); }
     const items = Array.isArray(body.requests) ? body.requests : [];
     if (!items.length) return withApiCors(j(400, { error: 'requests must be a non-empty list' }));
     // Acting through the relay is being here. Hourly at most; see noteOpened.
@@ -677,6 +665,16 @@ async function route(request, ctx) {
     if (/(^|\/)\.internal(\/|$)/u.test(podUrl.pathname) || /(^|\/)\.\.(\/|$)/u.test(podUrl.pathname)) {
       return j(403, { error: 'that is not a pod address' });
     }
+    // A server that runs identities runs them for its own pods only, and says
+    // which those are. Asked before anything is fetched: the checks below read
+    // the addresses the request names, and a stranger names them.
+    if (ctx.agentControl.serves) {
+      if (!await ctx.agentControl.serves(podBase)) return j(403, { error: 'that pod is not on this server' });
+      const claimed = claimedWebId(request);
+      if (claimed && !await ctx.agentControl.serves(claimed)) {
+        return j(403, { error: 'the token is for a WebID on another server' });
+      }
+    }
     // The pod's own server names its owner when it can, and where it does that
     // is the proof. Where it does not, the WebID must live in EXACTLY this pod
     // — its own pod base equal to podBase, not merely starting with it, which on

package/lib/gateway/gateway-core.mjs

@@ -112,7 +112,10 @@ export function asSigned(request, bytes, origin) {
 }
 
 // `origin` is the door's own, the one senders address (see asSigned).
-export async function handleDelivery(request, ident, { podPut, fetchImpl = fetch, maxBytes = DEFAULT_MAX_BYTES, paused = false, origin = null } = {}) {
+// `admit(verified)`, when given, says whether the inbox has room for this
+// delivery now; one without room is answered 503 and written nowhere, so its
+// sender tries again later. Without it every delivery that passes is written.
+export async function handleDelivery(request, ident, { podPut, fetchImpl = fetch, maxBytes = DEFAULT_MAX_BYTES, paused = false, origin = null, admit = null } = {}) {
   // The body, once, as the bytes the sender digested; the text of it is what
   // is filed and hashed, as before.
   let bytes, raw;
@@ -157,6 +160,8 @@ export async function handleDelivery(request, ident, { podPut, fetchImpl = fetch
     failed = `signature ${v.why} (${v.method}); host ${request.headers.get('host') || 'none'}${fwd ? ` forwarded-for ${fwd}` : ''}, date ${has('date')}, digest ${has('digest') === 'yes' || has('content-digest') === 'yes' ? 'yes' : 'no'}; ${params.slice(0, 300)}`;
   }
 
+  if (admit && !admit(v.verified === true)) return { status: 503, reason: 'inbox full — try later' };
+
   // No per-user secret on record = no receipt: the delivery still filters and
   // forwards, it just reads as unverified at the drain — never a failure.
   const receipt = ident.hmacSecret

package/lib/gateway/masto-gateway.mjs

@@ -605,12 +605,14 @@ async function route(request, pathname, ctx, deps, log) {
 
   // The pod sign-in, proved: a code for the app.
   if (pathname === '/api/authorize' && request.method === 'POST') {
-    const webid = await deps.verifyPodToken(request, pathname, ctx.verifier);
-    if (!webid) return json(401, { error: 'sign in at your pod first' });
     const body = await request.clone().json().catch(() => ({}));
     const found = await accountFor(ctx, body.address, host);
     if (found.error) return json(found.error[0], { error: found.error[1] });
     const { handle, rec } = found;
+    // A token for anyone but this account's owner is refused before it is
+    // checked: checking fetches the addresses it names.
+    const webid = await deps.verifyPodToken(request, pathname, ctx.verifier, { only: (w) => w === rec.webId });
+    if (!webid) return json(401, { error: 'sign in at your pod first' });
     if (keptBefore(ctx, rec)) return json(503, { error: MOVING });
     if (!usable(ctx, rec)) return json(409, { error: notReady(rec) });
     if (rec.webId !== webid) return json(403, { error: `you signed in as ${webid}, and this account belongs to ${rec.webId}` });

package/lib/gateway/notices.mjs

@@ -49,7 +49,7 @@ export async function routeNoticesApi(request, pathname, ctx, { j, verifyPodToke
   }
   if (request.method !== 'POST') return { status: 405, headers: {}, body: '' };
   if (!ctx.putNotice || !ctx.deleteNotice || !ctx.adminWebId) return j(501, { error: 'this front keeps no notices' });
-  const webid = await verifyPodToken(request, pathname, ctx.verifier);
+  const webid = await verifyPodToken(request, pathname, ctx.verifier, { only: (w) => w === ctx.adminWebId });
   if (!webid) return j(401, { error: 'a Solid-OIDC token is required' });
   if (webid !== ctx.adminWebId) return j(403, { error: 'that WebID is not the admin of this front' });
   let body;

package/lib/gateway/outbox-door.mjs

@@ -11,10 +11,10 @@ export async function ownerPostAtDoor(request, pathname, ctx, rec, handle, { cor
   const json = (status, obj, extra = {}) => ({ status,
     headers: { ...cors, 'content-type': 'application/json', 'cache-control': 'no-store', ...extra },
     body: JSON.stringify(obj) });
-  const webid = await verifyPodToken(request, pathname, ctx.verifier);
+  const isOwner = (w) => (rec.webId ? w === rec.webId : webidUnderPod(w, rec.podHome));
+  const webid = await verifyPodToken(request, pathname, ctx.verifier, { only: isOwner });
   if (!webid) return json(401, { error: 'a Solid-OIDC token proving this account\'s owner is required' });
-  const owner = rec.webId ? webid === rec.webId : webidUnderPod(webid, rec.podHome);
-  if (!owner) return json(403, { error: 'this outbox belongs to its owner alone' });
+  if (!isOwner(webid)) return json(403, { error: 'this outbox belongs to its owner alone' });
   const onPod = (u) => u.replace(rec.actorUrl.replace(/ap\/actor$/u, ''), rec.podHome);
   const { status, reason, location, object } = await handleOwnerPost(request, identFor(rec),
     { podPut: (u, b, ct) => ctx.podPut(handle, u, b, ct), ownerWebId: webid,

package/lib/gateway/private-read.mjs

@@ -17,6 +17,7 @@ import { verifyHttpSignature, makeSafeLoader } from './httpsig.mjs';
 import { asSigned } from './gateway-core.mjs';
 import { senderKeys } from './caches.mjs';
 import { keptNow } from './copy.mjs';
+import { sameOrigin } from '../core/intake/activity.mjs';
 
 const AP_CT = 'application/activity+json';
 const PUBLIC_NAMES = new Set(['https://www.w3.org/ns/activitystreams#Public', 'as:Public', 'Public']);
@@ -51,7 +52,12 @@ export async function signedReader(request, { fetchImpl = fetch, origin = null }
   const v = await verifyHttpSignature(asSigned(request, new Uint8Array(0), origin), {
     documentLoader: makeSafeLoader({ fetchImpl }), keyCache: senderKeys,
   });
-  return v.verified && typeof v.actor === 'string' ? { actor: v.actor, reason: null } : { actor: null, reason: v.reason };
+  if (!v.verified || typeof v.actor !== 'string') return { actor: null, reason: v.reason };
+  // A key document names its owner, and anyone can publish one naming anyone.
+  // Only a key on the owner's own server speaks for them — the drain's rule too
+  // (receiptVouchesFor in lib/core/intake/verify.mjs).
+  if (!sameOrigin(v.keyId, v.actor)) return { actor: null, reason: 'key-not-on-signer-origin' };
+  return { actor: v.actor, reason: null };
 }
 
 // Refused reads are told nothing, and never held at the edge.

package/lib/gateway/quiet.mjs

@@ -114,10 +114,10 @@ export const closedAnswer = (headers = {}, why = 'this address is closed') => ({
 // WebID is the row's, or lives on the row's pod for a row from before WebIDs
 // were recorded.
 export async function provedOwner(request, pathname, ctx, rec, { j, verifyPodToken, webidUnderPod }) {
-  const webid = await verifyPodToken(request, pathname, ctx.verifier);
+  const isOwner = (w) => (rec.webId ? w === rec.webId : webidUnderPod(w, rec.podHome));
+  const webid = await verifyPodToken(request, pathname, ctx.verifier, { only: isOwner });
   if (!webid) return { error: j(401, { error: 'a Solid-OIDC token proving the pod is required' }) };
-  const owner = rec.webId ? webid === rec.webId : webidUnderPod(webid, rec.podHome);
-  if (!owner) return { error: j(403, { error: "the token proves a different pod than this account's" }) };
+  if (!isOwner(webid)) return { error: j(403, { error: "the token proves a different pod than this account's" }) };
   return { webid };
 }
 

package/lib/gateway/state-api.mjs

@@ -162,8 +162,6 @@ export async function routeStateApi(request, pathname, ctx, deps) {
 
   if (pathname === '/api/state/open') {
     if (request.method !== 'POST') return j(405, { error: 'POST' });
-    const webid = await deps.verifyPodToken(request, pathname, ctx.verifier);
-    if (!webid) return j(401, { error: 'a Solid-OIDC token proving the pod is required' });
     let body = {};
     try { body = JSON.parse((await request.clone().text()) || '{}'); } catch { return j(400, { error: 'bad JSON' }); }
     // The account: named, or the one browser account kept here for this WebID.
@@ -171,8 +169,14 @@ export async function routeStateApi(request, pathname, ctx, deps) {
     // Read fresh: FediPod asks this the moment it has turned keeping on, and a
     // row read a minute earlier would still say the account is not kept.
     let rec = handle ? await (ctx.lookupFresh || ctx.lookup)(handle) : null;
+    // A token for somebody with no account here is refused before it is
+    // checked: checking fetches the addresses it names.
+    const dir = handle ? {} : (await ctx.listDirectory?.() || {});
+    const only = handle ? (w) => !!rec && w === rec.webId : (w) => Object.values(dir).some((r) => r?.webId === w);
+    const webid = await deps.verifyPodToken(request, pathname, ctx.verifier, { only });
+    if (!webid) return j(401, { error: 'a Solid-OIDC token proving the pod is required' });
     if (!handle) {
-      const rows = Object.entries(await ctx.listDirectory?.() || {})
+      const rows = Object.entries(dir)
         .filter(([, r]) => r?.webId === webid && r.openedAt && r.keeper && !r.movedTo && !r.closedAt);
       if (rows.length > 1) return j(409, { error: 'more than one account here for this sign-in; name one', handles: rows.map(([h]) => h) });
       if (rows.length === 1) [[handle, rec]] = rows;

package/lib/gateway/token-claims.mjs

@@ -5,12 +5,74 @@
 // the claim decides nothing but the address. Verifying it here would let
 // anyone make the front fetch signing keys from a server they name, on every
 // read.
+//
+// And checking one: verifyPodToken, which the front's routes share.
 
-export function claimedWebId(request) {
+import { podTokenVerifier } from './caches.mjs';
+import { namesPrivateAddress, safeFetch, readCapped } from '../shared/safefetch.mjs';
+
+function claimsOf(request) {
   const token = /^(?:DPoP|Bearer)\s+([\w-]+)\.([\w-]+)\./u.exec(request.headers.get('authorization') || '');
   if (!token) return null;
+  try { return JSON.parse(Buffer.from(token[2], 'base64url').toString('utf8')); } catch { return null; }
+}
+
+export function claimedWebId(request) {
+  const webid = claimsOf(request)?.webid;
+  return typeof webid === 'string' ? webid : null;
+}
+
+// Whether checking this token would stay off private addresses: the WebID it
+// names, its identity provider, and the key set that provider names. A token
+// the check cannot read fetches nothing. A provider whose settings cannot be
+// read here, by a fetch that refuses private addresses at every redirect, is
+// refused: the check's own fetch follows redirects anywhere.
+async function fetchesArePublic(request) {
+  const c = claimsOf(request);
+  if (!c) return true;
+  if (typeof c.webid === 'string' && await namesPrivateAddress(c.webid)) return false;
+  if (typeof c.iss !== 'string') return true;
+  if (await namesPrivateAddress(c.iss)) return false;
+  let jwks = null;
+  try {
+    const res = await safeFetch(`${c.iss.replace(/\/$/u, '')}/.well-known/openid-configuration`, { headers: { accept: 'application/json' } });
+    jwks = JSON.parse(await readCapped(res, 64 * 1024))?.jwks_uri;
+  } catch { return false; }
+  return !(typeof jwks === 'string' && await namesPrivateAddress(jwks));
+}
+
+// Verify a Solid-OIDC token (DPoP-bound) and return its WebID, or null. The
+// verifier is injected so tests stub it; in production it is the same library
+// the agent's own C2S auth uses.
+// Checking fetches the WebID and the identity provider the token names, and a
+// stranger names them. `only`, when the caller knows whose token it wants,
+// refuses a token naming anyone else before that; `publicOnly`, where any
+// token may arrive, refuses one whose check would reach a private address.
+export async function verifyPodToken(request, pathname, verifier, { only = null, publicOnly = false } = {}) {
+  const authz = request.headers.get('authorization');
+  if (!authz) return null;
+  const claimed = claimedWebId(request);
+  if (only && claimed && !only(claimed)) {
+    console.log(`front: pod token for somebody else refused unchecked on ${pathname}`);
+    return null;
+  }
+  if (publicOnly && !await fetchesArePublic(request)) {
+    console.log(`front: pod token naming a private address refused unchecked on ${pathname}`);
+    return null;
+  }
   try {
-    const claims = JSON.parse(Buffer.from(token[2], 'base64url').toString('utf8'));
-    return typeof claims?.webid === 'string' ? claims.webid : null;
-  } catch { return null; }
+    const dpop = request.headers.get('dpop');
+    // Solid-OIDC binds the token to a key the client proves on every request;
+    // a token shown without the proof is one anyone who saw it could show.
+    if (!dpop) { console.log(`front: pod token without a DPoP proof refused on ${pathname}`); return null; }
+    const v = verifier || await podTokenVerifier();
+    const url = request.url;
+    const { webid } = await v(authz, { header: dpop, method: request.method, url });
+    return webid || null;
+  } catch (e) {
+    // Said aloud: a token the front will not take is otherwise a bare 401 to
+    // the caller and nothing at all here.
+    console.log(`front: pod token refused on ${pathname}: ${e?.message || e}`);
+    return null;
+  }
 }

package/lib/server/embed.mjs

@@ -241,7 +241,7 @@ export async function ensureInboxDoor(agent, urls, log = () => {}) {
  * The policy is read from the identity's live state rather than its
  * published policy document, because both are in this process.
  */
-export async function deliverToInbox(agent, request, { podPut, gatewayWebId = null, fetchImpl = fetch } = {}) {
+export async function deliverToInbox(agent, request, { podPut, gatewayWebId = null, fetchImpl = fetch, admit = null } = {}) {
   const cfg = agent.store.getConfig() || {};
   const contacts = agent.store.getContacts();
   const bl = agent.store.getBlocklist();
@@ -258,7 +258,7 @@ export async function deliverToInbox(agent, request, { podPut, gatewayWebId = nu
     gatewayWebId,
     hmacSecret: cfg.gateway?.hmacSecret || null,
   };
-  return handleDelivery(request, ident, { podPut, fetchImpl });
+  return handleDelivery(request, ident, { podPut, fetchImpl, admit });
 }
 
 /**

package/lib/shared/safefetch.mjs

@@ -122,6 +122,17 @@ export function insecureUrlReason(url, what = 'address') {
     + 'Use https:// — or a loopback address if the pod is on this machine.';
 }
 
+// Whether a URL's host is, or resolves to, a private address. A host that does
+// not resolve names no address at all, and a request to it fails on its own.
+export async function namesPrivateAddress(url) {
+  if (process.env.AP_ALLOW_PRIVATE_TARGETS === '1') return false;
+  let u;
+  try { u = new URL(url); } catch { return false; }
+  const host = u.hostname.replace(/^\[|\]$/g, '');
+  if (net.isIP(host)) return isPrivateAddress(host);
+  try { return (await dns.lookup(host, { all: true })).some((a) => isPrivateAddress(a.address)); } catch { return false; }
+}
+
 // Throws when the URL must not be requested; otherwise returns the
 // validated address to pin the connection to ({address, family}), or null
 // when the URL already names a literal IP.

package/lib/surface/surface.mjs

@@ -163,7 +163,8 @@ export function buildAdminSurface({ agent, gate, allowed, log = console.log,
     // answer a foreign Origin, per above.
     const bad = checkRequest(req, allowed, { ignoreOrigin: apiPath });
     if (bad) {
-      log(`refused: ${bad} (${req.method} ${req.url})`);
+      // The path only: an address can carry a key, and a log is kept.
+      log(`refused: ${bad} (${req.method} ${url.pathname})`);
       res.writeHead(403, { 'content-type': 'text/plain', ...securityHeaders(allowed, false) });
       res.end('forbidden\n');
       return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fedipod",
-  "version": "1.48.1",
+  "version": "1.49.0",
   "description": "Standalone single-actor ActivityPub agent whose wire face, RDF truth and state all live on a Solid pod (CSS). Bundles a Phanpy UI and a Mastodon client-API facade.",
   "type": "module",
   "license": "MIT",
@@ -55,7 +55,7 @@
     "install-service": "node bin/fedipod.mjs install-service",
     "uninstall-service": "node bin/fedipod.mjs uninstall-service",
     "prepublishOnly": "npm test",
-    "test": "node claude/smoke-tests/agent-smoke.mjs && node claude/smoke-tests/front-hard-test.mjs && node claude/smoke-tests/copy-test.mjs && node claude/smoke-tests/copy-mode-test.mjs && node claude/smoke-tests/hold-test.mjs && node claude/smoke-tests/masto-gateway-test.mjs && node scripts/check-pod-calls.mjs && node scripts/verify-ui.mjs && node --test claude/smoke-tests/forum-signup-form.test.mjs claude/smoke-tests/door-verify.test.mjs && node scripts/check-sizes.mjs && node scripts/test-dependents.mjs && node claude/validation/browser-agent/all.mjs",
+    "test": "node claude/smoke-tests/agent-smoke.mjs && node claude/smoke-tests/front-hard-test.mjs && node claude/smoke-tests/copy-test.mjs && node claude/smoke-tests/copy-mode-test.mjs && node claude/smoke-tests/hold-test.mjs && node claude/smoke-tests/masto-gateway-test.mjs && node scripts/check-pod-calls.mjs && node scripts/verify-ui.mjs && node --test claude/smoke-tests/forum-signup-form.test.mjs claude/smoke-tests/door-verify.test.mjs claude/smoke-tests/oauth-signin.test.mjs claude/smoke-tests/app-registration.test.mjs claude/smoke-tests/push-signout.test.mjs claude/smoke-tests/token-fetches.test.mjs && node scripts/check-sizes.mjs && node scripts/test-dependents.mjs && node claude/validation/browser-agent/all.mjs",
     "verify-ui": "node scripts/verify-ui.mjs",
     "build:sw": "node scripts/build-app.mjs --entry web/app/sw-src.mjs --out web/app/dist/sw.js",
     "build:boot": "node scripts/build-app.mjs --entry web/app/boot.mjs --out web/app/dist/boot.js",

package/web/admin/oauth-signin.mjs

@@ -8,15 +8,26 @@ const $ = (id) => document.getElementById(id);
 const say = (text, error = false) => { const s = $('signin-status'); s.textContent = text; s.setAttribute('role', error ? 'alert' : 'status'); };
 const webId = $('webid').href;
 const here = location.origin + location.pathname;
+const params = new URLSearchParams(location.search);
 const login = fediLogin({ dbName: 'fedipod-signin', clientName: 'FediPod sign-in', redirectUri: here });
+// The owner's own yes to this client, given by pressing Allow in this tab. It
+// rides the trip to the pod and back, and nothing else stands for it: a link
+// that lands here with a pod sign-in already stored gets nothing without it.
+// The same rule as the Gateway's app sign-in (web/app-signin/app-signin.mjs).
+const CONSENT = 'fedipod-signin-consent';
+const request = `${params.get('client_id')}\n${params.get('redirect_uri') || ''}`;
+const consented = () => { try { return sessionStorage.getItem(CONSENT) === request; } catch { return false; } };
+const consent = (on) => { try { if (on) sessionStorage.setItem(CONSENT, request); else sessionStorage.removeItem(CONSENT); } catch { /* keeps no site data */ } };
 
 // Back from the pod: this finishes the sign-in and returns to the client's
 // request, which carries the client's own parameters.
 try { await login.resume(); } catch (e) { say(e.message, true); }
 
+// Proves the pod sign-in to the account. True when nothing more is asked here.
 async function prove() {
   const s = await login.getSession();
-  if (!s) return false;
+  if (!s || !consented()) return false;
+  consent(false);
   if (s.webId !== webId) { say(`You signed in as ${s.webId}, but this account belongs to ${webId}. Sign out there and sign in as the owner.`, true); return true; }
   say('Signing you in…');
   const res = await s.fetch(here, {
@@ -30,8 +41,20 @@ async function prove() {
   return true;
 }
 
-if (location.search.includes('client_id=') && !(await prove())) $('signin').hidden = false;
+const choices = (shown) => { $('signin').hidden = !shown; $('cancel').hidden = !shown; };
+
 $('signin').addEventListener('click', async () => {
+  consent(true);
+  choices(false);
+  if (await prove()) return;
   say('Taking you to your pod…');
-  try { await login.login(webId, { returnTo: location.href, redirectUri: here }); } catch (e) { say(e.message, true); }
+  try { await login.login(webId, { returnTo: location.href, redirectUri: here }); } catch (e) { say(e.message, true); choices(true); }
+});
+$('cancel').addEventListener('click', () => {
+  consent(false);
+  choices(false);
+  say('Nothing was allowed. You can close this page.');
 });
+
+// Back from the pod after pressing Allow: finish. Otherwise ask.
+if (params.get('client_id') && !(consented() && await prove())) choices(true);

package/web/front/run.js

@@ -186,7 +186,7 @@ async function showReply(res, p) {
     // back from the server and one comes from sessionStorage, and pasting any
     // of them into innerHTML means whatever markup they contain is rendered.
     // Only the fixed wording is markup here; everything variable is text.
-    const manage = `${p.podBase.replace(/\/$/, '')}${d.doorPath}?dk-token=${encodeURIComponent(d.doorSecret)}`;
+    const manage = d.manage || `${p.podBase.replace(/\/$/, '')}${d.doorPath}?dk-token=${encodeURIComponent(d.doorSecret)}`;
     n.textContent = 'Your Fediverse account is ready. Manage it at ';
     const a = say('a', p.podBase.replace(/\/$/, '') + d.doorPath); a.href = manage;
     n.append(a, '.');