fedipod 1.48.1 → 1.49.1

package/lib/core/store.mjs

@@ -435,6 +435,15 @@ export class PodStore {
   // arrival order — the Mastodon-API facade serves timelines from this.
   // [{ noteId, actor, content, published, inReplyTo, kind: 'timeline'|'post'|'tag' }]
   getStatuses() { return this.read('statuses.json', []); }
+  // When each open poll closes, read in place: asked every 30 seconds, where
+  // a copy of the whole timeline each time was the whole cost of asking.
+  openPollEnds() {
+    const out = [];
+    for (const s of this.cache.get('statuses.json') || []) {
+      if (s?.kind === 'post' && s.poll && !s.poll.closed && s.poll.expiresAt) out.push(Date.parse(s.poll.expiresAt));
+    }
+    return out;
+  }
   // A count must not pay for a clone: nodeinfo and the instance document are
   // public and answer strangers, so they read the cache directly.
   countStatuses(kind = null) {
@@ -482,6 +491,11 @@ export class PodStore {
     const all = this.getStatuses();
     const i = all.findIndex(x => x.noteId === noteId);
     if (i < 0) return null;
+    // An edit is held to the size a new post is: a remote Update could
+    // otherwise put a post of megabytes into the document rewritten on every change.
+    if (typeof patch?.content === 'string' && patch.content.length > MAX_CONTENT) {
+      patch = { ...patch, content: clamp(patch.content, MAX_CONTENT), truncated: true };
+    }
     all[i] = { ...all[i], ...patch };
     this.write('statuses.json', all);
     return all[i];

package/lib/gateway/front-core.mjs

@@ -18,7 +18,7 @@
 import crypto from 'node:crypto';
 import { handleDelivery } from './gateway-core.mjs';
 import { ownerPostAtDoor } from './outbox-door.mjs';
-import { readCapped, safeFetch, isLoopbackHost } from '../shared/safefetch.mjs';
+import { readCapped, safeFetch, isLoopbackHost, namesPrivateAddress } from '../shared/safefetch.mjs';
 import * as podRoot from '../pod/root.mjs';
 import * as podPolicy from '../pod/policy.mjs';
 import { podBaseOfWebId } from '../pod/urls.mjs';
@@ -26,8 +26,9 @@ import { routeQuietApi, noteOpened, noteReceived, closedState, accountState, clo
 import { holdsMail, mayBeAway, isPresent, holdingPut, afterHeld, routeHereApi, routeKeeperApi, routePushApi } from './held-mail.mjs';
 import { routeNoticesApi } from './notices.mjs';
 import { withSecurityHeaders } from './headers.mjs';
-import { podTokenVerifier } from './caches.mjs';
-import { claimedWebId } from './token-claims.mjs';
+import { claimedWebId, verifyPodToken } from './token-claims.mjs';
+
+export { verifyPodToken };
 import { answerPrivateRead } from './private-read.mjs';
 import { announced, overLimit, relayOne } from './relay-extras.mjs';
 
@@ -56,29 +57,6 @@ const profilePageOf = (rec) => (rec?.podHome ? rec.podHome + 'ap/profile.html' :
 
 const AP_CT = 'application/activity+json';
 
-// Verify a Solid-OIDC token (DPoP-bound) and return its WebID, or null. The
-// verifier is injected so tests stub it; in production it is the same library
-// the agent's own C2S auth uses.
-export async function verifyPodToken(request, pathname, verifier) {
-  const authz = request.headers.get('authorization');
-  if (!authz) return null;
-  try {
-    const dpop = request.headers.get('dpop');
-    // Solid-OIDC binds the token to a key the client proves on every request;
-    // a token shown without the proof is one anyone who saw it could show.
-    if (!dpop) { console.log(`front: pod token without a DPoP proof refused on ${pathname}`); return null; }
-    const v = verifier || await podTokenVerifier();
-    const url = request.url;
-    const { webid } = await v(authz, { header: dpop, method: request.method, url });
-    return webid || null;
-  } catch (e) {
-    // Said aloud: a token the front will not take is otherwise a bare 401 to
-    // the caller and nothing at all here.
-    console.log(`front: pod token refused on ${pathname}: ${e?.message || e}`);
-    return null;
-  }
-}
-
 // Is this WebID served by the claimed pod? A pod owner's WebID lives on the pod
 // origin — that is the whole proof: a token for a WebID under podHome could
 // only be minted by someone who controls that pod's identity provider.
@@ -104,6 +82,13 @@ function webidUnderPod(webid, podHome) {
   } catch { return false; }
 }
 
+// Whether a WebID is this row's owner: the one recorded, or for a row from
+// before WebIDs were recorded, one living on the row's pod.
+const ownsRow = (rec) => (webid) => (rec.webId ? webid === rec.webId : webidUnderPod(webid, rec.podHome));
+
+// A front on this machine: a test run, whose pods and identity providers are here too.
+const frontOnThisMachine = (ctx) => { try { return isLoopbackHost(new URL(ctx.frontOrigin).hostname); } catch { return false; } };
+
 /**
  * Whether this WebID may speak for this pod.
  *
@@ -361,7 +346,7 @@ async function route(request, ctx) {
   // Solid-OIDC token — and must be the WebID the deploy names as admin.
   if (pathname === '/api/roster') {
     if (!ctx.listDirectory || !ctx.adminWebId) return j(501, { error: 'this front has no roster to offer' });
-    const webid = await verifyPodToken(request, pathname, ctx.verifier);
+    const webid = await verifyPodToken(request, pathname, ctx.verifier, { only: (w) => w === ctx.adminWebId });
     if (!webid) return j(401, { error: 'a Solid-OIDC token is required' });
     if (webid !== ctx.adminWebId) return j(403, { error: 'that WebID is not the admin of this front' });
     const rows = await ctx.listDirectory();
@@ -381,7 +366,7 @@ async function route(request, ctx) {
   // for good; a row seeded in the deploy's environment can only be removed there.
   if (pathname === '/api/revoke' && request.method === 'POST') {
     if (!ctx.removeDirectory || !ctx.adminWebId) return j(501, { error: 'this front cannot revoke accounts' });
-    const webid = await verifyPodToken(request, pathname, ctx.verifier);
+    const webid = await verifyPodToken(request, pathname, ctx.verifier, { only: (w) => w === ctx.adminWebId });
     if (!webid) return j(401, { error: 'a Solid-OIDC token is required' });
     if (webid !== ctx.adminWebId) return j(403, { error: 'that WebID is not the admin of this front' });
     let body;
@@ -470,7 +455,12 @@ async function route(request, ctx) {
     }
     const badPod = podHomeProblem(podHome, ctx.frontOrigin);
     if (badPod) return j(400, { error: badPod });
-    const webid = await verifyPodToken(request, pathname, ctx.verifier);
+    // Anyone may sign up, so the pod and the token's addresses are a
+    // stranger's to name, and checking them fetches them. A front on the
+    // internet fetches only public ones; one on this machine, for testing, its own.
+    const publicOnly = !frontOnThisMachine(ctx);
+    if (publicOnly && await namesPrivateAddress(podHome)) return j(400, { error: 'that pod address is not on the public internet' });
+    const webid = await verifyPodToken(request, pathname, ctx.verifier, { publicOnly });
     if (!webid) return j(401, { error: 'a Solid-OIDC token proving the pod is required' });
     if (!await provesPod(webid, podHome, ctx.fetchImpl)) {
       return j(403, { error: 'the token proves a different pod than the one you listed' });
@@ -571,10 +561,9 @@ async function route(request, ctx) {
       return withApiCors(j(400, { error: 'movedTo must be an https …/ap/actor URL' }));
     }
     if (ctx.frontOrigin && mu.origin === new URL(ctx.frontOrigin).origin) return withApiCors(j(400, { error: 'that address is at this gateway' }));
-    const webid = await verifyPodToken(request, pathname, ctx.verifier);
+    const webid = await verifyPodToken(request, pathname, ctx.verifier, { only: ownsRow(rec) });
     if (!webid) return withApiCors(j(401, { error: 'a Solid-OIDC token proving the pod is required' }));
-    const owner = rec.webId ? webid === rec.webId : webidUnderPod(webid, rec.podHome);
-    if (!owner) return withApiCors(j(403, { error: "the token proves a different pod than this account's" }));
+    if (!ownsRow(rec)(webid)) return withApiCors(j(403, { error: "the token proves a different pod than this account's" }));
     const movedAt = rec.movedTo === movedTo && rec.movedAt ? rec.movedAt : new Date().toISOString();
     await ctx.putDirectory(handle, { ...rec, movedTo, movedAt });
     console.log(`front @${handle}: moved to ${movedTo}`);
@@ -603,10 +592,9 @@ async function route(request, ctx) {
     const handle = String(body.handle || '').toLowerCase();
     const rec = await ctx.lookup(handle);
     if (!rec) { console.log(`relay: no account named ${handle}`); return withApiCors(j(404, { error: 'no such account' })); }
-    const webid = await verifyPodToken(request, pathname, ctx.verifier);
+    const webid = await verifyPodToken(request, pathname, ctx.verifier, { only: ownsRow(rec) });
     if (!webid) { console.log(`relay @${handle}: no usable pod token`); return withApiCors(j(401, { error: 'a Solid-OIDC token proving the pod is required' })); }
-    const owner = rec.webId ? webid === rec.webId : webidUnderPod(webid, rec.podHome);
-    if (!owner) { console.log(`relay @${handle}: token is for ${webid}, not this account's pod`); return withApiCors(j(403, { error: "the token proves a different pod than this account's" })); }
+    if (!ownsRow(rec)(webid)) { console.log(`relay @${handle}: token is for ${webid}, not this account's pod`); return withApiCors(j(403, { error: "the token proves a different pod than this account's" })); }
     const items = Array.isArray(body.requests) ? body.requests : [];
     if (!items.length) return withApiCors(j(400, { error: 'requests must be a non-empty list' }));
     // Acting through the relay is being here. Hourly at most; see noteOpened.
@@ -677,6 +665,16 @@ async function route(request, ctx) {
     if (/(^|\/)\.internal(\/|$)/u.test(podUrl.pathname) || /(^|\/)\.\.(\/|$)/u.test(podUrl.pathname)) {
       return j(403, { error: 'that is not a pod address' });
     }
+    // A server that runs identities runs them for its own pods only, and says
+    // which those are. Asked before anything is fetched: the checks below read
+    // the addresses the request names, and a stranger names them.
+    if (ctx.agentControl.serves) {
+      if (!await ctx.agentControl.serves(podBase)) return j(403, { error: 'that pod is not on this server' });
+      const claimed = claimedWebId(request);
+      if (claimed && !await ctx.agentControl.serves(claimed)) {
+        return j(403, { error: 'the token is for a WebID on another server' });
+      }
+    }
     // The pod's own server names its owner when it can, and where it does that
     // is the proof. Where it does not, the WebID must live in EXACTLY this pod
     // — its own pod base equal to podBase, not merely starting with it, which on

package/lib/gateway/gateway-core.mjs

@@ -112,7 +112,10 @@ export function asSigned(request, bytes, origin) {
 }
 
 // `origin` is the door's own, the one senders address (see asSigned).
-export async function handleDelivery(request, ident, { podPut, fetchImpl = fetch, maxBytes = DEFAULT_MAX_BYTES, paused = false, origin = null } = {}) {
+// `admit(verified)`, when given, says whether the inbox has room for this
+// delivery now; one without room is answered 503 and written nowhere, so its
+// sender tries again later. Without it every delivery that passes is written.
+export async function handleDelivery(request, ident, { podPut, fetchImpl = fetch, maxBytes = DEFAULT_MAX_BYTES, paused = false, origin = null, admit = null } = {}) {
   // The body, once, as the bytes the sender digested; the text of it is what
   // is filed and hashed, as before.
   let bytes, raw;
@@ -157,6 +160,8 @@ export async function handleDelivery(request, ident, { podPut, fetchImpl = fetch
     failed = `signature ${v.why} (${v.method}); host ${request.headers.get('host') || 'none'}${fwd ? ` forwarded-for ${fwd}` : ''}, date ${has('date')}, digest ${has('digest') === 'yes' || has('content-digest') === 'yes' ? 'yes' : 'no'}; ${params.slice(0, 300)}`;
   }
 
+  if (admit && !admit(v.verified === true)) return { status: 503, reason: 'inbox full — try later' };
+
   // No per-user secret on record = no receipt: the delivery still filters and
   // forwards, it just reads as unverified at the drain — never a failure.
   const receipt = ident.hmacSecret

package/lib/gateway/masto-gateway.mjs

@@ -605,12 +605,14 @@ async function route(request, pathname, ctx, deps, log) {
 
   // The pod sign-in, proved: a code for the app.
   if (pathname === '/api/authorize' && request.method === 'POST') {
-    const webid = await deps.verifyPodToken(request, pathname, ctx.verifier);
-    if (!webid) return json(401, { error: 'sign in at your pod first' });
     const body = await request.clone().json().catch(() => ({}));
     const found = await accountFor(ctx, body.address, host);
     if (found.error) return json(found.error[0], { error: found.error[1] });
     const { handle, rec } = found;
+    // A token for anyone but this account's owner is refused before it is
+    // checked: checking fetches the addresses it names.
+    const webid = await deps.verifyPodToken(request, pathname, ctx.verifier, { only: (w) => w === rec.webId });
+    if (!webid) return json(401, { error: 'sign in at your pod first' });
     if (keptBefore(ctx, rec)) return json(503, { error: MOVING });
     if (!usable(ctx, rec)) return json(409, { error: notReady(rec) });
     if (rec.webId !== webid) return json(403, { error: `you signed in as ${webid}, and this account belongs to ${rec.webId}` });

package/lib/gateway/notices.mjs

@@ -49,7 +49,7 @@ export async function routeNoticesApi(request, pathname, ctx, { j, verifyPodToke
   }
   if (request.method !== 'POST') return { status: 405, headers: {}, body: '' };
   if (!ctx.putNotice || !ctx.deleteNotice || !ctx.adminWebId) return j(501, { error: 'this front keeps no notices' });
-  const webid = await verifyPodToken(request, pathname, ctx.verifier);
+  const webid = await verifyPodToken(request, pathname, ctx.verifier, { only: (w) => w === ctx.adminWebId });
   if (!webid) return j(401, { error: 'a Solid-OIDC token is required' });
   if (webid !== ctx.adminWebId) return j(403, { error: 'that WebID is not the admin of this front' });
   let body;

package/lib/gateway/outbox-door.mjs

@@ -11,10 +11,10 @@ export async function ownerPostAtDoor(request, pathname, ctx, rec, handle, { cor
   const json = (status, obj, extra = {}) => ({ status,
     headers: { ...cors, 'content-type': 'application/json', 'cache-control': 'no-store', ...extra },
     body: JSON.stringify(obj) });
-  const webid = await verifyPodToken(request, pathname, ctx.verifier);
+  const isOwner = (w) => (rec.webId ? w === rec.webId : webidUnderPod(w, rec.podHome));
+  const webid = await verifyPodToken(request, pathname, ctx.verifier, { only: isOwner });
   if (!webid) return json(401, { error: 'a Solid-OIDC token proving this account\'s owner is required' });
-  const owner = rec.webId ? webid === rec.webId : webidUnderPod(webid, rec.podHome);
-  if (!owner) return json(403, { error: 'this outbox belongs to its owner alone' });
+  if (!isOwner(webid)) return json(403, { error: 'this outbox belongs to its owner alone' });
   const onPod = (u) => u.replace(rec.actorUrl.replace(/ap\/actor$/u, ''), rec.podHome);
   const { status, reason, location, object } = await handleOwnerPost(request, identFor(rec),
     { podPut: (u, b, ct) => ctx.podPut(handle, u, b, ct), ownerWebId: webid,

package/lib/gateway/private-read.mjs

@@ -17,6 +17,7 @@ import { verifyHttpSignature, makeSafeLoader } from './httpsig.mjs';
 import { asSigned } from './gateway-core.mjs';
 import { senderKeys } from './caches.mjs';
 import { keptNow } from './copy.mjs';
+import { sameOrigin } from '../core/intake/activity.mjs';
 
 const AP_CT = 'application/activity+json';
 const PUBLIC_NAMES = new Set(['https://www.w3.org/ns/activitystreams#Public', 'as:Public', 'Public']);
@@ -51,7 +52,12 @@ export async function signedReader(request, { fetchImpl = fetch, origin = null }
   const v = await verifyHttpSignature(asSigned(request, new Uint8Array(0), origin), {
     documentLoader: makeSafeLoader({ fetchImpl }), keyCache: senderKeys,
   });
-  return v.verified && typeof v.actor === 'string' ? { actor: v.actor, reason: null } : { actor: null, reason: v.reason };
+  if (!v.verified || typeof v.actor !== 'string') return { actor: null, reason: v.reason };
+  // A key document names its owner, and anyone can publish one naming anyone.
+  // Only a key on the owner's own server speaks for them — the drain's rule too
+  // (receiptVouchesFor in lib/core/intake/verify.mjs).
+  if (!sameOrigin(v.keyId, v.actor)) return { actor: null, reason: 'key-not-on-signer-origin' };
+  return { actor: v.actor, reason: null };
 }
 
 // Refused reads are told nothing, and never held at the edge.

package/lib/gateway/quiet.mjs

@@ -114,10 +114,10 @@ export const closedAnswer = (headers = {}, why = 'this address is closed') => ({
 // WebID is the row's, or lives on the row's pod for a row from before WebIDs
 // were recorded.
 export async function provedOwner(request, pathname, ctx, rec, { j, verifyPodToken, webidUnderPod }) {
-  const webid = await verifyPodToken(request, pathname, ctx.verifier);
+  const isOwner = (w) => (rec.webId ? w === rec.webId : webidUnderPod(w, rec.podHome));
+  const webid = await verifyPodToken(request, pathname, ctx.verifier, { only: isOwner });
   if (!webid) return { error: j(401, { error: 'a Solid-OIDC token proving the pod is required' }) };
-  const owner = rec.webId ? webid === rec.webId : webidUnderPod(webid, rec.podHome);
-  if (!owner) return { error: j(403, { error: "the token proves a different pod than this account's" }) };
+  if (!isOwner(webid)) return { error: j(403, { error: "the token proves a different pod than this account's" }) };
   return { webid };
 }
 

package/lib/gateway/state-api.mjs

@@ -162,8 +162,6 @@ export async function routeStateApi(request, pathname, ctx, deps) {
 
   if (pathname === '/api/state/open') {
     if (request.method !== 'POST') return j(405, { error: 'POST' });
-    const webid = await deps.verifyPodToken(request, pathname, ctx.verifier);
-    if (!webid) return j(401, { error: 'a Solid-OIDC token proving the pod is required' });
     let body = {};
     try { body = JSON.parse((await request.clone().text()) || '{}'); } catch { return j(400, { error: 'bad JSON' }); }
     // The account: named, or the one browser account kept here for this WebID.
@@ -171,8 +169,14 @@ export async function routeStateApi(request, pathname, ctx, deps) {
     // Read fresh: FediPod asks this the moment it has turned keeping on, and a
     // row read a minute earlier would still say the account is not kept.
     let rec = handle ? await (ctx.lookupFresh || ctx.lookup)(handle) : null;
+    // A token for somebody with no account here is refused before it is
+    // checked: checking fetches the addresses it names.
+    const dir = handle ? {} : (await ctx.listDirectory?.() || {});
+    const only = handle ? (w) => !!rec && w === rec.webId : (w) => Object.values(dir).some((r) => r?.webId === w);
+    const webid = await deps.verifyPodToken(request, pathname, ctx.verifier, { only });
+    if (!webid) return j(401, { error: 'a Solid-OIDC token proving the pod is required' });
     if (!handle) {
-      const rows = Object.entries(await ctx.listDirectory?.() || {})
+      const rows = Object.entries(dir)
         .filter(([, r]) => r?.webId === webid && r.openedAt && r.keeper && !r.movedTo && !r.closedAt);
       if (rows.length > 1) return j(409, { error: 'more than one account here for this sign-in; name one', handles: rows.map(([h]) => h) });
       if (rows.length === 1) [[handle, rec]] = rows;

package/lib/gateway/token-claims.mjs

@@ -5,12 +5,74 @@
 // the claim decides nothing but the address. Verifying it here would let
 // anyone make the front fetch signing keys from a server they name, on every
 // read.
+//
+// And checking one: verifyPodToken, which the front's routes share.
 
-export function claimedWebId(request) {
+import { podTokenVerifier } from './caches.mjs';
+import { namesPrivateAddress, safeFetch, readCapped } from '../shared/safefetch.mjs';
+
+function claimsOf(request) {
   const token = /^(?:DPoP|Bearer)\s+([\w-]+)\.([\w-]+)\./u.exec(request.headers.get('authorization') || '');
   if (!token) return null;
+  try { return JSON.parse(Buffer.from(token[2], 'base64url').toString('utf8')); } catch { return null; }
+}
+
+export function claimedWebId(request) {
+  const webid = claimsOf(request)?.webid;
+  return typeof webid === 'string' ? webid : null;
+}
+
+// Whether checking this token would stay off private addresses: the WebID it
+// names, its identity provider, and the key set that provider names. A token
+// the check cannot read fetches nothing. A provider whose settings cannot be
+// read here, by a fetch that refuses private addresses at every redirect, is
+// refused: the check's own fetch follows redirects anywhere.
+async function fetchesArePublic(request) {
+  const c = claimsOf(request);
+  if (!c) return true;
+  if (typeof c.webid === 'string' && await namesPrivateAddress(c.webid)) return false;
+  if (typeof c.iss !== 'string') return true;
+  if (await namesPrivateAddress(c.iss)) return false;
+  let jwks = null;
+  try {
+    const res = await safeFetch(`${c.iss.replace(/\/$/u, '')}/.well-known/openid-configuration`, { headers: { accept: 'application/json' } });
+    jwks = JSON.parse(await readCapped(res, 64 * 1024))?.jwks_uri;
+  } catch { return false; }
+  return !(typeof jwks === 'string' && await namesPrivateAddress(jwks));
+}
+
+// Verify a Solid-OIDC token (DPoP-bound) and return its WebID, or null. The
+// verifier is injected so tests stub it; in production it is the same library
+// the agent's own C2S auth uses.
+// Checking fetches the WebID and the identity provider the token names, and a
+// stranger names them. `only`, when the caller knows whose token it wants,
+// refuses a token naming anyone else before that; `publicOnly`, where any
+// token may arrive, refuses one whose check would reach a private address.
+export async function verifyPodToken(request, pathname, verifier, { only = null, publicOnly = false } = {}) {
+  const authz = request.headers.get('authorization');
+  if (!authz) return null;
+  const claimed = claimedWebId(request);
+  if (only && claimed && !only(claimed)) {
+    console.log(`front: pod token for somebody else refused unchecked on ${pathname}`);
+    return null;
+  }
+  if (publicOnly && !await fetchesArePublic(request)) {
+    console.log(`front: pod token naming a private address refused unchecked on ${pathname}`);
+    return null;
+  }
   try {
-    const claims = JSON.parse(Buffer.from(token[2], 'base64url').toString('utf8'));
-    return typeof claims?.webid === 'string' ? claims.webid : null;
-  } catch { return null; }
+    const dpop = request.headers.get('dpop');
+    // Solid-OIDC binds the token to a key the client proves on every request;
+    // a token shown without the proof is one anyone who saw it could show.
+    if (!dpop) { console.log(`front: pod token without a DPoP proof refused on ${pathname}`); return null; }
+    const v = verifier || await podTokenVerifier();
+    const url = request.url;
+    const { webid } = await v(authz, { header: dpop, method: request.method, url });
+    return webid || null;
+  } catch (e) {
+    // Said aloud: a token the front will not take is otherwise a bare 401 to
+    // the caller and nothing at all here.
+    console.log(`front: pod token refused on ${pathname}: ${e?.message || e}`);
+    return null;
+  }
 }

package/lib/server/embed.mjs

@@ -241,7 +241,7 @@ export async function ensureInboxDoor(agent, urls, log = () => {}) {
  * The policy is read from the identity's live state rather than its
  * published policy document, because both are in this process.
  */
-export async function deliverToInbox(agent, request, { podPut, gatewayWebId = null, fetchImpl = fetch } = {}) {
+export async function deliverToInbox(agent, request, { podPut, gatewayWebId = null, fetchImpl = fetch, admit = null } = {}) {
   const cfg = agent.store.getConfig() || {};
   const contacts = agent.store.getContacts();
   const bl = agent.store.getBlocklist();
@@ -258,7 +258,7 @@ export async function deliverToInbox(agent, request, { podPut, gatewayWebId = nu
     gatewayWebId,
     hmacSecret: cfg.gateway?.hmacSecret || null,
   };
-  return handleDelivery(request, ident, { podPut, fetchImpl });
+  return handleDelivery(request, ident, { podPut, fetchImpl, admit });
 }
 
 /**
@@ -304,6 +304,7 @@ export async function startEmbeddedAgent({
   autoAcceptFollows = true,
   gateToken = null,
   uiPath = '/fp/',
+  watch = null,
 }) {
   const base = podBase.endsWith('/') ? podBase : podBase + '/';
   const handle = handleFor(base);
@@ -390,6 +391,7 @@ export async function startEmbeddedAgent({
     gate: makeGate(gateToken, {
       secureCookie: authorities.secure,
       cookiePath: mount ? mount + uiPath : '/',
+      failClosed: true,
     }),
     allowed: authorities,
     embedded: true,
@@ -402,9 +404,12 @@ export async function startEmbeddedAgent({
   // A delivery landing in the inbox — through the door, or from any other
   // writer — wakes the drain at once. Only additions, and only in the inbox:
   // the drain's own DELETEs must not call it back.
+  // `watch(inbox, handler)`, from a server running many identities, is one
+  // listener for all of them; without it each listens to the store itself.
   let coalesce = null;
   let onChanged = null;
-  if (typeof resourceStore?.on === 'function') {
+  let unwatch = null;
+  if (typeof watch === 'function' || typeof resourceStore?.on === 'function') {
     const inbox = urls.inbox;
     onChanged = (identifier, activity) => {
       const kind = String(activity?.value ?? activity ?? '');
@@ -417,16 +422,19 @@ export async function startEmbeddedAgent({
       }, DRAIN_COALESCE_MS);
       coalesce.unref?.();
     };
-    resourceStore.on('changed', onChanged);
+    if (typeof watch === 'function') unwatch = watch(inbox, onChanged);
+    else resourceStore.on('changed', onChanged);
   }
 
   const stop = async () => {
-    if (onChanged) resourceStore.off('changed', onChanged);
+    if (unwatch) unwatch();
+    else if (onChanged) resourceStore.off('changed', onChanged);
     surface.streaming?.stop?.();
     clearTimeout(coalesce);
     agent.intake?.stop();
     agent.tagfeed?.stop();
     agent.bskyfeed?.stop();
+    agent.acctfeed?.stop();
     agent.deliverer?.stop();
     agent.importer?.stop();
     clearInterval(agent.schedTimer);

package/lib/shared/safefetch.mjs

@@ -122,6 +122,17 @@ export function insecureUrlReason(url, what = 'address') {
     + 'Use https:// — or a loopback address if the pod is on this machine.';
 }
 
+// Whether a URL's host is, or resolves to, a private address. A host that does
+// not resolve names no address at all, and a request to it fails on its own.
+export async function namesPrivateAddress(url) {
+  if (process.env.AP_ALLOW_PRIVATE_TARGETS === '1') return false;
+  let u;
+  try { u = new URL(url); } catch { return false; }
+  const host = u.hostname.replace(/^\[|\]$/g, '');
+  if (net.isIP(host)) return isPrivateAddress(host);
+  try { return (await dns.lookup(host, { all: true })).some((a) => isPrivateAddress(a.address)); } catch { return false; }
+}
+
 // Throws when the URL must not be requested; otherwise returns the
 // validated address to pin the connection to ({address, family}), or null
 // when the URL already names a literal IP.

package/lib/surface/surface.mjs

@@ -163,7 +163,8 @@ export function buildAdminSurface({ agent, gate, allowed, log = console.log,
     // answer a foreign Origin, per above.
     const bad = checkRequest(req, allowed, { ignoreOrigin: apiPath });
     if (bad) {
-      log(`refused: ${bad} (${req.method} ${req.url})`);
+      // The path only: an address can carry a key, and a log is kept.
+      log(`refused: ${bad} (${req.method} ${url.pathname})`);
       res.writeHead(403, { 'content-type': 'text/plain', ...securityHeaders(allowed, false) });
       res.end('forbidden\n');
       return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fedipod",
-  "version": "1.48.1",
+  "version": "1.49.1",
   "description": "Standalone single-actor ActivityPub agent whose wire face, RDF truth and state all live on a Solid pod (CSS). Bundles a Phanpy UI and a Mastodon client-API facade.",
   "type": "module",
   "license": "MIT",
@@ -55,7 +55,7 @@
     "install-service": "node bin/fedipod.mjs install-service",
     "uninstall-service": "node bin/fedipod.mjs uninstall-service",
     "prepublishOnly": "npm test",
-    "test": "node claude/smoke-tests/agent-smoke.mjs && node claude/smoke-tests/front-hard-test.mjs && node claude/smoke-tests/copy-test.mjs && node claude/smoke-tests/copy-mode-test.mjs && node claude/smoke-tests/hold-test.mjs && node claude/smoke-tests/masto-gateway-test.mjs && node scripts/check-pod-calls.mjs && node scripts/verify-ui.mjs && node --test claude/smoke-tests/forum-signup-form.test.mjs claude/smoke-tests/door-verify.test.mjs && node scripts/check-sizes.mjs && node scripts/test-dependents.mjs && node claude/validation/browser-agent/all.mjs",
+    "test": "node claude/smoke-tests/agent-smoke.mjs && node claude/smoke-tests/front-hard-test.mjs && node claude/smoke-tests/copy-test.mjs && node claude/smoke-tests/copy-mode-test.mjs && node claude/smoke-tests/hold-test.mjs && node claude/smoke-tests/masto-gateway-test.mjs && node scripts/check-pod-calls.mjs && node scripts/verify-ui.mjs && node --test claude/smoke-tests/forum-signup-form.test.mjs claude/smoke-tests/door-verify.test.mjs claude/smoke-tests/oauth-signin.test.mjs claude/smoke-tests/app-registration.test.mjs claude/smoke-tests/push-signout.test.mjs claude/smoke-tests/token-fetches.test.mjs claude/smoke-tests/signin-hardening.test.mjs claude/smoke-tests/load-fixes.test.mjs && node scripts/check-sizes.mjs && node scripts/test-dependents.mjs && node claude/validation/browser-agent/all.mjs",
     "verify-ui": "node scripts/verify-ui.mjs",
     "build:sw": "node scripts/build-app.mjs --entry web/app/sw-src.mjs --out web/app/dist/sw.js",
     "build:boot": "node scripts/build-app.mjs --entry web/app/boot.mjs --out web/app/dist/boot.js",

package/vendor/gate.cjs

@@ -88,11 +88,18 @@ function cookieValue(header, name) {
 // AP_ALLOWED_HOSTS has nothing but this token, so the gate has to be total.
 // `token` may be a function, resolved per request: an identity's secret can
 // rotate while the server runs, and the very next request sees the new one.
-function makeGate(token, { allowOrigins = [], publicEndpoints = false, secureCookie = false, cookiePath = '/' } = {}) {
+// `failClosed`: with no token, refuse rather than open — for a gate whose
+// token is only ever missing by accident (an account on a pod server).
+function makeGate(token, { allowOrigins = [], publicEndpoints = false, secureCookie = false, cookiePath = '/', failClosed = false } = {}) {
   const tokenNow = () => (typeof token === 'function' ? token() : token);
   // gate(req, res) → true when the gate handled the response (caller stops).
   function gate(req, res) {
     const t = tokenNow();
+    if (!t && failClosed) {
+      res.writeHead(401, { 'content-type': 'text/plain' });
+      res.end('fedipod: this account has no key to open its pages with\n');
+      return true;
+    }
     if (!t) return false;
     if (tokenOk(req.headers[HEADER], t)) return false;
     if (tokenOk(cookieValue(req.headers.cookie, COOKIE), t)) return false;
@@ -129,7 +136,8 @@ function makeGate(token, { allowOrigins = [], publicEndpoints = false, secureCoo
   // Websocket upgrades have no res to answer with — just allowed or not.
   gate.upgradeOk = (req) => {
     const t = tokenNow();
-    return !t || tokenOk(req.headers[HEADER], t) || tokenOk(cookieValue(req.headers.cookie, COOKIE), t);
+    if (!t) return !failClosed;
+    return tokenOk(req.headers[HEADER], t) || tokenOk(cookieValue(req.headers.cookie, COOKIE), t);
   };
 
   return gate;

package/web/admin/oauth-signin.mjs

@@ -8,15 +8,26 @@ const $ = (id) => document.getElementById(id);
 const say = (text, error = false) => { const s = $('signin-status'); s.textContent = text; s.setAttribute('role', error ? 'alert' : 'status'); };
 const webId = $('webid').href;
 const here = location.origin + location.pathname;
+const params = new URLSearchParams(location.search);
 const login = fediLogin({ dbName: 'fedipod-signin', clientName: 'FediPod sign-in', redirectUri: here });
+// The owner's own yes to this client, given by pressing Allow in this tab. It
+// rides the trip to the pod and back, and nothing else stands for it: a link
+// that lands here with a pod sign-in already stored gets nothing without it.
+// The same rule as the Gateway's app sign-in (web/app-signin/app-signin.mjs).
+const CONSENT = 'fedipod-signin-consent';
+const request = `${params.get('client_id')}\n${params.get('redirect_uri') || ''}`;
+const consented = () => { try { return sessionStorage.getItem(CONSENT) === request; } catch { return false; } };
+const consent = (on) => { try { if (on) sessionStorage.setItem(CONSENT, request); else sessionStorage.removeItem(CONSENT); } catch { /* keeps no site data */ } };
 
 // Back from the pod: this finishes the sign-in and returns to the client's
 // request, which carries the client's own parameters.
 try { await login.resume(); } catch (e) { say(e.message, true); }
 
+// Proves the pod sign-in to the account. True when nothing more is asked here.
 async function prove() {
   const s = await login.getSession();
-  if (!s) return false;
+  if (!s || !consented()) return false;
+  consent(false);
   if (s.webId !== webId) { say(`You signed in as ${s.webId}, but this account belongs to ${webId}. Sign out there and sign in as the owner.`, true); return true; }
   say('Signing you in…');
   const res = await s.fetch(here, {
@@ -30,8 +41,20 @@ async function prove() {
   return true;
 }
 
-if (location.search.includes('client_id=') && !(await prove())) $('signin').hidden = false;
+const choices = (shown) => { $('signin').hidden = !shown; $('cancel').hidden = !shown; };
+
 $('signin').addEventListener('click', async () => {
+  consent(true);
+  choices(false);
+  if (await prove()) return;
   say('Taking you to your pod…');
-  try { await login.login(webId, { returnTo: location.href, redirectUri: here }); } catch (e) { say(e.message, true); }
+  try { await login.login(webId, { returnTo: location.href, redirectUri: here }); } catch (e) { say(e.message, true); choices(true); }
+});
+$('cancel').addEventListener('click', () => {
+  consent(false);
+  choices(false);
+  say('Nothing was allowed. You can close this page.');
 });
+
+// Back from the pod after pressing Allow: finish. Otherwise ask.
+if (params.get('client_id') && !(consented() && await prove())) choices(true);

package/web/front/run.js

@@ -186,7 +186,7 @@ async function showReply(res, p) {
     // back from the server and one comes from sessionStorage, and pasting any
     // of them into innerHTML means whatever markup they contain is rendered.
     // Only the fixed wording is markup here; everything variable is text.
-    const manage = `${p.podBase.replace(/\/$/, '')}${d.doorPath}?dk-token=${encodeURIComponent(d.doorSecret)}`;
+    const manage = d.manage || `${p.podBase.replace(/\/$/, '')}${d.doorPath}?dk-token=${encodeURIComponent(d.doorSecret)}`;
     n.textContent = 'Your Fediverse account is ready. Manage it at ';
     const a = say('a', p.podBase.replace(/\/$/, '') + d.doorPath); a.href = manage;
     n.append(a, '.');