fedipod 1.49.0 → 1.49.1

package/lib/client/masto/index.mjs

@@ -178,6 +178,7 @@ export class MastoApi {
   registerApp(...a) { return oauth.registerApp(this, ...a); }
   mintCode(...a) { return oauth.mintCode(this, ...a); }
   consumeCode(...a) { return oauth.consumeCode(this, ...a); }
+  peekCode(...a) { return oauth.peekCode(this, ...a); }
   tokenOf(...a) { return oauth.tokenOf(this, ...a); }
   authed(...a) { return oauth.authed(this, ...a); }
   redirectAllowed(...a) { return oauth.redirectAllowed(this, ...a); }

package/lib/client/masto/oauth.mjs

@@ -46,38 +46,38 @@ const escapeHtml = (s) => String(s).replace(/[&<>"']/g, c =>
 const parseRedirects = (v) => (Array.isArray(v) ? v : String(v || '').split(/\s+/))
   .map(s => s.trim()).filter(Boolean);
 
+// The account's Fediverse address, @handle@host, or null before it has one.
+const ownAddress = (api) => {
+  const handle = api.store.getConfig()?.handle;
+  return handle && api.host ? `@${handle}@${api.host}` : null;
+};
+
 // The sign-in page for an account whose owner signs in at their pod: no
 // password of ours exists, and none is asked for. The page carries the
 // client's request in its address, signs the owner in at the pod with the
 // fediverse-session library, and proves that sign-in back to /oauth/authorize.
-function sendPodSigninPage(res, client, webId, mount = '') {
-  let asking = '';
-  let allow = 'Allow';
-  if (client && (client.name || client.redirect)) {
-    let where = '';
-    try { where = client.redirect ? new URL(client.redirect).host : ''; } catch { /* oob or blank */ }
-    const who = client.name ? escapeHtml(client.name) : (where ? escapeHtml(where) : 'A client');
-    asking = `<p><strong>${who}</strong> is asking to use your account`
-      + `${where ? `, and you will be sent back to <code>${escapeHtml(where)}</code>` : ''}.</p>`;
-    allow = `Allow ${who}`;
-  }
+function sendPodSigninPage(res, client, webId, mount = '', address = null) {
+  let where = '';
+  try { where = client?.redirect ? new URL(client.redirect).host : ''; } catch { /* oob or blank */ }
+  const app = escapeHtml(client?.name || where || 'this app');
+  const question = `Allow ${app} to access your ${address ? `${escapeHtml(address)} ` : ''}account?`;
   res.writeHead(200, { 'content-type': 'text/html; charset=utf-8', 'cache-control': 'no-cache' });
   res.end(`<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">
-<title>Sign in with your pod</title>
+<title>${question}</title>
 <style>:root{color-scheme:light dark;--heading:#1a4f8a;--btn:#3d6b35;--line:#9a9a9a}
 body{font:20px Arial,Helvetica,sans-serif;max-width:28rem;margin:12vh auto;padding:0 1rem}
 h1{color:var(--heading);font-size:1.5rem}
-code{word-break:break-all;background:rgba(120,120,120,.12);padding:.05em .35em;border-radius:4px}
+h1,p{overflow-wrap:anywhere}
 button{font:inherit;padding:.6rem 1.1rem;background:var(--btn);color:#fff;border:none;border-radius:9px;cursor:pointer}
 button[hidden]{display:none}
 #cancel{background:transparent;color:inherit;border:2px solid currentColor;margin-left:.6rem}
 #signin-status{min-height:1.5em;padding:.6rem .8rem;border:1px solid var(--line);border-radius:8px;margin-top:1rem}
+#signin-status:empty{min-height:0;padding:0;border:0;margin:0}
 @media (prefers-color-scheme:dark){:root{--heading:#7fb3e8;--btn:#4a7a40}}</style></head><body>
 <main>
-<h1>Sign in with your pod</h1>
-${asking}
-<p>This account belongs to <a id="webid" href="${escapeHtml(webId)}">${escapeHtml(webId)}</a>. Sign in at that pod to allow it.</p>
-<p><button type="button" id="signin" hidden>${allow}</button><button type="button" id="cancel" hidden>Cancel</button></p>
+<h1>${question}</h1>
+<a id="webid" href="${escapeHtml(webId)}" hidden></a>
+<p><button type="button" id="signin" hidden>Allow</button><button type="button" id="cancel" hidden>Cancel</button></p>
 <p id="signin-status" role="status" aria-live="polite"></p>
 </main>
 <script type="module" src="${escapeHtml(mount)}/oauth/session/signin.mjs"></script>
@@ -396,6 +396,13 @@ export function mintCode(api, { clientId, redirectUri, scope, challenge = null,
   return code;
 }
 
+// The live record for a code, left in place: the exchange checks it first,
+// so a caller who cannot prove it does not use it up for the one who can.
+export function peekCode(api, code) {
+  const now = Date.now();
+  return api.store.read('oauth-codes.json', []).find(c => c.code === code && now - c.createdAt < CODE_TTL_MS) || null;
+}
+
 export function consumeCode(api, code) {
   const now = Date.now();
   const all = api.store.read('oauth-codes.json', []);
@@ -424,7 +431,11 @@ export function redirectAllowed(api, redirect) {
   try {
     const u = new URL(redirect);
     if (u.protocol !== 'http:' && u.protocol !== 'https:') return false;
-    return api.allowed.has(u.host.toLowerCase());
+    if (!api.allowed.has(u.host.toLowerCase())) return false;
+    // A suffixed pod shares its host with other pods: its own addresses are
+    // those under its path, and the rest of the host is somebody else's.
+    const mount = api.mount || '';
+    return !mount || u.pathname === mount || u.pathname.startsWith(`${mount}/`);
   } catch { return false; }
 }
 
@@ -482,7 +493,7 @@ export async function handle(api, ctx) {
     // The way back from the pod's login: no client named, only the pod's
     // code. The page finishes the sign-in and returns to the client's request.
     if (req.method === 'GET' && !params.get('client_id') && params.get('code') && params.get('state') && ownerWebId) {
-      return sendPodSigninPage(res, null, ownerWebId, api.mount || '');
+      return sendPodSigninPage(res, null, ownerWebId, api.mount || '', ownAddress(api));
     }
     const app = api.findApp(params.get('client_id') || '');
     // A client that published its own metadata document needs no
@@ -526,9 +537,15 @@ export async function handle(api, ctx) {
     //    about a web page. Anything pointing elsewhere has to be approved by
     //    somebody who knows the password.
     const client = { name: app?.name || doc?.name || null, redirect, scope: params.get('scope') || 'read' };
+    // A proof method named and not known is refused rather than read as the
+    // weakest one, whose proof is the challenge itself.
+    const challengeMethod = params.get('code_challenge_method');
+    if (params.get('code_challenge') && challengeMethod && challengeMethod !== 'S256' && challengeMethod !== 'plain') {
+      return send(400, { error: 'code_challenge_method must be S256 or plain' });
+    }
     if (external && !proved && !api.store.getConfig()?.uiPassword && !api.redirectAllowed(redirect)) {
       // With a pod to sign in at, the owner approves the client there.
-      if (req.method === 'GET' && ownerWebId) return sendPodSigninPage(res, client, ownerWebId, api.mount || '');
+      if (req.method === 'GET' && ownerWebId) return sendPodSigninPage(res, client, ownerWebId, api.mount || '', ownAddress(api));
       api.log(`authorize refused: no UI password, and "${redirect}" is not an address of this agent`);
       return send(403, {
         error: 'this client asks to be sent somewhere other than this agent, and no password is '
@@ -574,7 +591,7 @@ export async function handle(api, ctx) {
       return sendLoginForm(res, params, '', client);
     } else if (!proved && api.allowed && !api.allowed.isLocalRequest(req) && !api.throughDoor?.(req)) {
       // With a pod to sign in at, the owner does that instead of a password.
-      if (req.method === 'GET' && ownerWebId) return sendPodSigninPage(res, client, ownerWebId, api.mount || '');
+      if (req.method === 'GET' && ownerWebId) return sendPodSigninPage(res, client, ownerWebId, api.mount || '', ownAddress(api));
       // No password set, and this request did not come from this machine.
       //
       // The instant-authorize path is honest theatre on loopback: whoever can
@@ -619,7 +636,7 @@ export async function handle(api, ctx) {
     // challenge is the whole of its proof. The code carries the document's
     // URL as the client it was bound to.
     if (!app && body.code_verifier && /^https:\/\//iu.test(String(body.client_id || ''))) {
-      const rec = api.consumeCode(body.code || '');
+      const rec = api.peekCode(body.code || '');
       if (!rec || rec.clientId !== body.client_id
         || (body.redirect_uri && rec.redirectUri !== body.redirect_uri)) {
         api.log('token refused: code is not a live authorization for that client document');
@@ -629,6 +646,7 @@ export async function handle(api, ctx) {
         api.log('token refused: the verifier does not answer the challenge this code was made with');
         return send(400, { error: 'invalid_grant' });
       }
+      if (!api.consumeCode(body.code || '')) return send(400, { error: 'invalid_grant' });
       return send(200, { access_token: api.mintToken(rec.scope || 'read'), token_type: 'Bearer',
         scope: rec.scope || 'read', created_at: Math.floor(Date.now() / 1000),
         ...(api.urls?.actor ? { activitypub_actor_id: api.urls.actor } : {}) });
@@ -638,7 +656,7 @@ export async function handle(api, ctx) {
     // challenge it presented at authorize (RFC 7636). Sending a verifier is
     // what says which of the two flows this is.
     if (app && body.code_verifier) {
-      const rec = api.consumeCode(body.code || '');
+      const rec = api.peekCode(body.code || '');
       if (!rec || rec.clientId !== app.clientId || (body.redirect_uri && rec.redirectUri !== body.redirect_uri)) {
         api.log('token refused: code is not a live authorization for this client');
         return send(400, { error: 'invalid_grant' });
@@ -649,6 +667,7 @@ export async function handle(api, ctx) {
         api.log('token refused: the verifier does not answer the challenge this code was made with');
         return send(400, { error: 'invalid_grant' });
       }
+      if (!api.consumeCode(body.code || '')) return send(400, { error: 'invalid_grant' });
       return send(200, { access_token: api.mintToken(rec.scope || 'read'), token_type: 'Bearer',
         scope: rec.scope || 'read', created_at: Math.floor(Date.now() / 1000),
         ...(api.urls?.actor ? { activitypub_actor_id: api.urls.actor } : {}) });
@@ -658,7 +677,7 @@ export async function handle(api, ctx) {
       const known = Buffer.from(app.clientSecret);
       const okSecret = given.length === known.length && crypto.timingSafeEqual(given, known);
       if (!okSecret) { api.log('token refused: client secret mismatch'); return send(401, { error: 'invalid_client' }); }
-      const rec = api.consumeCode(body.code || '');
+      const rec = api.peekCode(body.code || '');
       if (!rec || rec.clientId !== app.clientId || (body.redirect_uri && rec.redirectUri !== body.redirect_uri)) {
         api.log('token refused: code is not a live authorization for this client');
         return send(400, { error: 'invalid_grant' });
@@ -669,6 +688,7 @@ export async function handle(api, ctx) {
         api.log('token refused: this code was made with a challenge and the verifier does not answer it');
         return send(400, { error: 'invalid_grant' });
       }
+      if (!api.consumeCode(body.code || '')) return send(400, { error: 'invalid_grant' });
       return send(200, { access_token: api.mintToken(rec.scope || 'read'), token_type: 'Bearer',
         scope: rec.scope || 'read', created_at: Math.floor(Date.now() / 1000),
         // Which actor the token acts for. A Mastodon client ignores it; an

package/lib/connections/tagfeed.mjs

@@ -29,6 +29,20 @@ const DEFAULTS = {
   intervalMin: 15,
 };
 const PER_TAG = 20;              // statuses requested per tag per sweep
+// One copy of each tag's timeline per process, for every account sweeping it:
+// a server running many accounts asks the instance once per tag in this
+// window, not once per account. Just under the shortest default interval.
+const SHARED_TTL_MS = 12 * 60_000;
+const sharedTimelines = new Map();   // `${instance}|${tag}` → { at, answer }
+export function timelineOnce(key, load) {
+  const now = Date.now();
+  const held = sharedTimelines.get(key);
+  if (held && now - held.at < SHARED_TTL_MS) return held.answer;
+  const answer = load().catch((e) => { sharedTimelines.delete(key); throw e; });
+  sharedTimelines.set(key, { at: now, answer });
+  if (sharedTimelines.size > 500) sharedTimelines.delete(sharedTimelines.keys().next().value);
+  return answer;
+}
 const MAX_NEW_PER_SWEEP = 8;     // dereference budget per sweep — stay light
 // …and no one tag may take more than this much of it. Without a per-tag share
 // the budget was spent in list order: the first two or three busy tags used it
@@ -141,21 +155,27 @@ export class TagFeed {
       try {
         const { safeFetch, retryAfterMs, readCapped } = await import('../shared/safefetch.mjs');
         const url = `${instance}/api/v1/timelines/tag/${encodeURIComponent(tag)}?limit=${PER_TAG}`;
-        const res = this.fetcher === globalThis.fetch
-          ? await safeFetch(url, { headers: { accept: 'application/json' } })
-          : await this.fetcher(url, { headers: { accept: 'application/json' } });
-        if (res.status >= 400) {
+        const load = async () => {
+          const res = this.fetcher === globalThis.fetch
+            ? await safeFetch(url, { headers: { accept: 'application/json' } })
+            : await this.fetcher(url, { headers: { accept: 'application/json' } });
+          if (res.status >= 400) return { status: res.status, retryAfter: retryAfterMs(res), list: null };
+          // Somebody else's server, polled on our schedule: bounded, because
+          // res.json() would buffer a timeline of whatever size it sent.
+          return { status: res.status, list: JSON.parse(await readCapped(res, MAX_TIMELINE_BYTES)) };
+        };
+        // Shared only with the real network: a fetcher handed in is a test's own.
+        const got = this.fetcher === globalThis.fetch ? await timelineOnce(`${instance}|${tag}`, load) : await load();
+        if (got.status >= 400) {
           // This is somebody else's server, polled on OUR schedule, and it had
           // no way to ask us to stop: a 429 or a 503 logged a line and the next
           // sweep arrived on the same cadence regardless. One refusal now ends
           // the sweep — the remaining tags are on the same instance, so there
           // is nothing to be gained by asking them too.
-          this._backOff(res.status, retryAfterMs(res));
+          this._backOff(got.status, got.retryAfter);
           return;
         }
-        // Somebody else's server, polled on our schedule: bounded, because
-        // res.json() would buffer a timeline of whatever size it sent.
-        list = JSON.parse(await readCapped(res, MAX_TIMELINE_BYTES));
+        list = got.list;
       } catch (e) {
         // A network failure is the same signal, minus the courtesy.
         this.log(`tagfeed #${tag}: ${e.message}`);

package/lib/core/agent.mjs

@@ -25,7 +25,7 @@ import { AcctFeed } from '../connections/acctfeed.mjs';
 import { BskyFeed } from '../connections/bskyfeed.mjs';
 import { BskyGroup } from '../connections/bskygroup.mjs';
 import { Lease } from './lease.mjs';
-import { publishDue } from './scheduled.mjs';
+import { publishDue, nextToPublish } from './scheduled.mjs';
 import { apUrls, assertionKeyId, publicHandle } from './wire.mjs';
 import { followActor, unfollowActor, resolveHandle } from './social.mjs';
 import * as podInbox from '../pod/inbox.mjs';
@@ -306,6 +306,9 @@ export class Agent {
       proofKeyId: assertionKeyId(this.urls),
       log: this.log, passive: this.viewer,
       onGone: () => this.publisher.publishCollections({ followers: true }),
+      // Inside a pod server, a long-lived process: several followers' servers
+      // at once rather than one after another.
+      parallel: this.embedded ? 6 : 1,
     });
     this.publisher = new Publisher({
       config, remote: this.remote, store: this.store,
@@ -317,6 +320,9 @@ export class Agent {
       // origin, so it can be advertised. Standalone it is on loopback, and
       // naming it in a world-readable actor would send clients nowhere.
       clientOrigin: this.embedded ? this.urls.base : null,
+      // There, a post is answered once it is on the pod and delivery carries
+      // on behind; a process that may be stopped any moment waits for it.
+      background: this.embedded,
     });
     // Intake is constructed even for viewers — its signed fetchAP powers
     // search/deref; start() (draining) is active-only.
@@ -553,11 +559,17 @@ export class Agent {
     this.tagfeed.start();
     this.startBsky();
     this.startAccts();
-    // Scheduled posts and polls whose time is up: a 30s sweep does what has
-    // come due (lib/core/scheduled.mjs).
+    // Scheduled posts and polls whose time is up: every 30s the clock is
+    // compared with the next one due, and only then is anything done
+    // (lib/core/scheduled.mjs).
     clearInterval(this.schedTimer);
+    let publishing = false;
     this.schedTimer = setInterval(() => {
-      publishDue(this.store, this.publisher, this.log).catch(err => this.log(`scheduled: ${err.message}`));
+      const due = nextToPublish(this.store);
+      if (publishing || due == null || due > Date.now()) return;
+      publishing = true;
+      publishDue(this.store, this.publisher, this.log).catch(err => this.log(`scheduled: ${err.message}`))
+        .finally(() => { publishing = false; });
     }, 30_000);
     this.schedTimer.unref();
     // A CSV import interrupted by a restart or a handoff picks back up here.

package/lib/core/deliver.mjs

@@ -66,7 +66,7 @@ export class Deliverer {
   // placing a post as it lands — which records what to send and leaves the
   // sending to the run it starts.
   constructor({ store, keyId, rsaPrivate, actorId = null, edPrivate = null, proofKeyId = null,
-    log = console.log, passive = false, defer = false, onGone = null }) {
+    log = console.log, passive = false, defer = false, onGone = null, parallel = 1 }) {
     this.store = store;
     this.defer = defer;
     // Called after followers at a gone inbox are dropped: the agent republishes
@@ -81,7 +81,9 @@ export class Deliverer {
     // How many fresh deliveries one attempt may carry. The Node deliverer
     // opens a socket per recipient; the browser's relay deliverer sends a
     // list, and sets this to what the relay accepts.
-    this.batchSize = 1;
+    this.batchSize = parallel;
+    // Sent side by side, up to that many at once, rather than one after another.
+    this.parallel = parallel;
     if (!passive) this.startQueue();
   }
 
@@ -184,6 +186,10 @@ export class Deliverer {
   // with the error deliverNow would have thrown. Here one at a time; the
   // relay deliverer sends the whole list in one call.
   async deliverManyNow(targets) {
+    if (this.parallel > 1) {
+      return Promise.all(targets.map((t) => this.deliverNow(t.inbox, t.activity)
+        .then(() => ({ ok: true }), (error) => ({ error }))));
+    }
     const out = [];
     for (const t of targets) {
       try { await this.deliverNow(t.inbox, t.activity); out.push({ ok: true }); }

package/lib/core/intake/index.mjs

@@ -40,6 +40,9 @@ const POLL_MS = 2 * 60_000;      // fallback cadence when there is no push
 // With a live socket the poll is pure redundancy: it exists for the case where
 // push is down, so it slows right down while push is up.
 const POLL_PUSH_OK_MS = 10 * 60_000;
+// Inside the pod server the store's own events wake the drain, and they are
+// not lost the way a socket's are: the poll is only a backstop.
+const POLL_IN_PROCESS_MS = 60 * 60_000;
 // A container that times out will time out again in two minutes, and each
 // attempt holds one of the pod's workers for the full timeout. Sweeping stops
 // for a while instead, doubling up to half an hour.
@@ -113,7 +116,8 @@ export class Intake {
   // what makes the fallback poll a slow one.
   _pollMs() {
     if (this.pollSeconds) return this.pollSeconds * 1000;
-    return this.wsState === 'open' || this.wsState === 'in-process' ? POLL_PUSH_OK_MS : POLL_MS;
+    if (this.wsState === 'in-process') return POLL_IN_PROCESS_MS;
+    return this.wsState === 'open' ? POLL_PUSH_OK_MS : POLL_MS;
   }
 
   // `drainNow: false` and `subscribe: false` are for a browser worker the
@@ -121,6 +125,10 @@ export class Intake {
   async start({ drainNow = true, subscribe = true } = {}) {
     this.stopped = false;                     // restartable across demote/takeover cycles
     if (drainNow) await this.drain().catch(e => this.log(`drain: ${e.message}`));
+    // Embedded in the pod server, a notification socket back to that same
+    // server buys nothing — the store's own change events wake the drain.
+    // Settled before the first poll is timed, which reads it.
+    if (!this.push) this.wsState = 'in-process';
     const tick = () => {
       this.pollTimer = setTimeout(() => {
         this.drain().catch(e => this.log(`drain: ${e.message}`)).finally(() => { if (!this.stopped) tick(); });
@@ -128,10 +136,7 @@ export class Intake {
       this.pollTimer.unref?.();
     };
     tick();
-    // Embedded in the pod server, a notification socket back to that same
-    // server buys nothing — the store's own change events wake the drain.
-    if (!this.push) this.wsState = 'in-process';
-    else if (subscribe) this.subscribe().catch(e => this.log(`subscribe: ${e.message}`));
+    if (this.push && subscribe) this.subscribe().catch(e => this.log(`subscribe: ${e.message}`));
   }
 
   stop() { this.stopped = true; clearTimeout(this.pollTimer); clearTimeout(this.resubTimer); this.ws?.close(); }

package/lib/core/publisher/index.mjs

@@ -35,6 +35,7 @@ import { recordPlace, forgetPlace } from '../place.mjs';
 export class Publisher {
   constructor({ config, remote, store, deliverer, publicKeyPem, assertionKey = null, log = console.log,
     probeFetch = null, resolveMention = null, resolveActor = null, clientOrigin = null,
+    background = false,
   }) {
     this.config = config;
     this.remote = remote;
@@ -48,6 +49,8 @@ export class Publisher {
     // stranger can reach. Null on a laptop, where the surface is on loopback
     // and advertising it to the world would name somewhere nobody can go.
     this.clientOrigin = clientOrigin;
+    // Whether a new post's delivery may carry on after it is answered.
+    this.background = background;
     // A fronted identity (config.gateway.frontActor) advertises its ids on a
     // shared domain; the map tells RemotePod where each writes on the pod.
     const publicBase = config.gateway?.frontActor

package/lib/core/publisher/notes.mjs

@@ -321,7 +321,11 @@ export async function publishNote(publisher, content, { inReplyTo, attachments,
     reply?.inbox,
     ...addressedInboxes,
   ].filter(Boolean))];
-  await publisher.deliverer.deliverToAll(inboxes, create);
+  // The post is on the pod; where the process lives on, the app is answered
+  // now and delivery carries on behind.
+  const fanout = publisher.deliverer.deliverToAll(inboxes, create);
+  if (publisher.background) fanout.catch((e) => publisher.log(`delivering ${note.id}: ${e.message}`));
+  else await fanout;
   publisher.log(`note published: ${note.id} → ${inboxes.length} inbox(es)`);
   // The quoted author is asked after the note is out: their Accept names the
   // note, so it has to exist where they will look for it.

package/lib/core/scheduled.mjs

@@ -24,6 +24,18 @@ export async function publishDue(store, publisher, log = () => {}, now = Date.no
   return due.length;
 }
 
+/**
+ * When the next scheduled post or poll end falls due, in milliseconds, or null.
+ * Cheap enough to ask every 30 seconds: the timeline is read, not copied.
+ */
+export function nextToPublish(store) {
+  const at = [
+    ...store.getScheduled().map((e) => Date.parse(e.scheduledAt)),
+    ...(store.openPollEnds?.() || []),
+  ].filter(Number.isFinite);
+  return at.length ? Math.min(...at) : null;
+}
+
 /**
  * When the next thing falls due, or null when nothing is waiting: a scheduled
  * post, a poll's end, or another try at a delivery that failed.

package/lib/core/store.mjs

@@ -435,6 +435,15 @@ export class PodStore {
   // arrival order — the Mastodon-API facade serves timelines from this.
   // [{ noteId, actor, content, published, inReplyTo, kind: 'timeline'|'post'|'tag' }]
   getStatuses() { return this.read('statuses.json', []); }
+  // When each open poll closes, read in place: asked every 30 seconds, where
+  // a copy of the whole timeline each time was the whole cost of asking.
+  openPollEnds() {
+    const out = [];
+    for (const s of this.cache.get('statuses.json') || []) {
+      if (s?.kind === 'post' && s.poll && !s.poll.closed && s.poll.expiresAt) out.push(Date.parse(s.poll.expiresAt));
+    }
+    return out;
+  }
   // A count must not pay for a clone: nodeinfo and the instance document are
   // public and answer strangers, so they read the cache directly.
   countStatuses(kind = null) {
@@ -482,6 +491,11 @@ export class PodStore {
     const all = this.getStatuses();
     const i = all.findIndex(x => x.noteId === noteId);
     if (i < 0) return null;
+    // An edit is held to the size a new post is: a remote Update could
+    // otherwise put a post of megabytes into the document rewritten on every change.
+    if (typeof patch?.content === 'string' && patch.content.length > MAX_CONTENT) {
+      patch = { ...patch, content: clamp(patch.content, MAX_CONTENT), truncated: true };
+    }
     all[i] = { ...all[i], ...patch };
     this.write('statuses.json', all);
     return all[i];

package/lib/server/embed.mjs

@@ -304,6 +304,7 @@ export async function startEmbeddedAgent({
   autoAcceptFollows = true,
   gateToken = null,
   uiPath = '/fp/',
+  watch = null,
 }) {
   const base = podBase.endsWith('/') ? podBase : podBase + '/';
   const handle = handleFor(base);
@@ -390,6 +391,7 @@ export async function startEmbeddedAgent({
     gate: makeGate(gateToken, {
       secureCookie: authorities.secure,
       cookiePath: mount ? mount + uiPath : '/',
+      failClosed: true,
     }),
     allowed: authorities,
     embedded: true,
@@ -402,9 +404,12 @@ export async function startEmbeddedAgent({
   // A delivery landing in the inbox — through the door, or from any other
   // writer — wakes the drain at once. Only additions, and only in the inbox:
   // the drain's own DELETEs must not call it back.
+  // `watch(inbox, handler)`, from a server running many identities, is one
+  // listener for all of them; without it each listens to the store itself.
   let coalesce = null;
   let onChanged = null;
-  if (typeof resourceStore?.on === 'function') {
+  let unwatch = null;
+  if (typeof watch === 'function' || typeof resourceStore?.on === 'function') {
     const inbox = urls.inbox;
     onChanged = (identifier, activity) => {
       const kind = String(activity?.value ?? activity ?? '');
@@ -417,16 +422,19 @@ export async function startEmbeddedAgent({
       }, DRAIN_COALESCE_MS);
       coalesce.unref?.();
     };
-    resourceStore.on('changed', onChanged);
+    if (typeof watch === 'function') unwatch = watch(inbox, onChanged);
+    else resourceStore.on('changed', onChanged);
   }
 
   const stop = async () => {
-    if (onChanged) resourceStore.off('changed', onChanged);
+    if (unwatch) unwatch();
+    else if (onChanged) resourceStore.off('changed', onChanged);
     surface.streaming?.stop?.();
     clearTimeout(coalesce);
     agent.intake?.stop();
     agent.tagfeed?.stop();
     agent.bskyfeed?.stop();
+    agent.acctfeed?.stop();
     agent.deliverer?.stop();
     agent.importer?.stop();
     clearInterval(agent.schedTimer);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fedipod",
-  "version": "1.49.0",
+  "version": "1.49.1",
   "description": "Standalone single-actor ActivityPub agent whose wire face, RDF truth and state all live on a Solid pod (CSS). Bundles a Phanpy UI and a Mastodon client-API facade.",
   "type": "module",
   "license": "MIT",
@@ -55,7 +55,7 @@
     "install-service": "node bin/fedipod.mjs install-service",
     "uninstall-service": "node bin/fedipod.mjs uninstall-service",
     "prepublishOnly": "npm test",
-    "test": "node claude/smoke-tests/agent-smoke.mjs && node claude/smoke-tests/front-hard-test.mjs && node claude/smoke-tests/copy-test.mjs && node claude/smoke-tests/copy-mode-test.mjs && node claude/smoke-tests/hold-test.mjs && node claude/smoke-tests/masto-gateway-test.mjs && node scripts/check-pod-calls.mjs && node scripts/verify-ui.mjs && node --test claude/smoke-tests/forum-signup-form.test.mjs claude/smoke-tests/door-verify.test.mjs claude/smoke-tests/oauth-signin.test.mjs claude/smoke-tests/app-registration.test.mjs claude/smoke-tests/push-signout.test.mjs claude/smoke-tests/token-fetches.test.mjs && node scripts/check-sizes.mjs && node scripts/test-dependents.mjs && node claude/validation/browser-agent/all.mjs",
+    "test": "node claude/smoke-tests/agent-smoke.mjs && node claude/smoke-tests/front-hard-test.mjs && node claude/smoke-tests/copy-test.mjs && node claude/smoke-tests/copy-mode-test.mjs && node claude/smoke-tests/hold-test.mjs && node claude/smoke-tests/masto-gateway-test.mjs && node scripts/check-pod-calls.mjs && node scripts/verify-ui.mjs && node --test claude/smoke-tests/forum-signup-form.test.mjs claude/smoke-tests/door-verify.test.mjs claude/smoke-tests/oauth-signin.test.mjs claude/smoke-tests/app-registration.test.mjs claude/smoke-tests/push-signout.test.mjs claude/smoke-tests/token-fetches.test.mjs claude/smoke-tests/signin-hardening.test.mjs claude/smoke-tests/load-fixes.test.mjs && node scripts/check-sizes.mjs && node scripts/test-dependents.mjs && node claude/validation/browser-agent/all.mjs",
     "verify-ui": "node scripts/verify-ui.mjs",
     "build:sw": "node scripts/build-app.mjs --entry web/app/sw-src.mjs --out web/app/dist/sw.js",
     "build:boot": "node scripts/build-app.mjs --entry web/app/boot.mjs --out web/app/dist/boot.js",

package/vendor/gate.cjs

@@ -88,11 +88,18 @@ function cookieValue(header, name) {
 // AP_ALLOWED_HOSTS has nothing but this token, so the gate has to be total.
 // `token` may be a function, resolved per request: an identity's secret can
 // rotate while the server runs, and the very next request sees the new one.
-function makeGate(token, { allowOrigins = [], publicEndpoints = false, secureCookie = false, cookiePath = '/' } = {}) {
+// `failClosed`: with no token, refuse rather than open — for a gate whose
+// token is only ever missing by accident (an account on a pod server).
+function makeGate(token, { allowOrigins = [], publicEndpoints = false, secureCookie = false, cookiePath = '/', failClosed = false } = {}) {
   const tokenNow = () => (typeof token === 'function' ? token() : token);
   // gate(req, res) → true when the gate handled the response (caller stops).
   function gate(req, res) {
     const t = tokenNow();
+    if (!t && failClosed) {
+      res.writeHead(401, { 'content-type': 'text/plain' });
+      res.end('fedipod: this account has no key to open its pages with\n');
+      return true;
+    }
     if (!t) return false;
     if (tokenOk(req.headers[HEADER], t)) return false;
     if (tokenOk(cookieValue(req.headers.cookie, COOKIE), t)) return false;
@@ -129,7 +136,8 @@ function makeGate(token, { allowOrigins = [], publicEndpoints = false, secureCoo
   // Websocket upgrades have no res to answer with — just allowed or not.
   gate.upgradeOk = (req) => {
     const t = tokenNow();
-    return !t || tokenOk(req.headers[HEADER], t) || tokenOk(cookieValue(req.headers.cookie, COOKIE), t);
+    if (!t) return !failClosed;
+    return tokenOk(req.headers[HEADER], t) || tokenOk(cookieValue(req.headers.cookie, COOKIE), t);
   };
 
   return gate;