fedipod 1.49.1 → 1.50.0

package/bin/fedipod.mjs

@@ -70,9 +70,6 @@
 //                         into profiles/<its handle>/. Installs made before the
 //                         2026-07-30 rename keep ~/.activitypod until they run
 //                         `--to`; new ones get ~/.fedipod.
-//   fedipod passwd    set/change the UI password (REQUIRED before any
-//                         non-loopback exposure — it turns the instant
-//                         OAuth redirect into a real login form)
 //   fedipod tokens    list client tokens; --revoke <prefix> / --revoke-all
 //   fedipod revoke-credential --email you@example.org
 //                         kill this machine's pod credential server-side and
@@ -93,7 +90,7 @@ const COMMANDS = new Map([
   ['up', run.up], ['start', run.start], ['run', run.start], ['stop', run.stop], ['status', run.status],
   ['https', run.https],
   ['setup', setup.setup], ['rotate-key', setup.rotateKey], ['revoke-credential', setup.revokeCredential],
-  ['tokens', setup.tokens], ['passwd', setup.passwd], ['keys', setup.keys],
+  ['tokens', setup.tokens], ['keys', setup.keys],
   ['state', state.state], ['upgrade', state.upgrade], ['profiles', state.profiles], ['home', state.home],
   ['export', state.exportCollectionsCmd],
   ['update', service.update], ['install-service', service.service], ['uninstall-service', service.service],
@@ -109,7 +106,7 @@ const command = COMMANDS.get(cmd);
 if (command) {
   await command();
 } else {
-console.log('usage: fedipod <setup|start|stop|status|state|upgrade|rebuild|home|passwd'
+console.log('usage: fedipod <setup|start|stop|status|state|upgrade|rebuild|home'
   + '|tokens|revoke-credential|install-service|archive|alias|import|keys|front> [--flags]');
 console.log('  keys: where the signing key lives; --to pod|local moves it (pod = multi-device signing)');
 console.log('  https: the local certificate agents serve TLS with; --trust mints a local CA for strict clients');

package/cli.md

@@ -77,20 +77,15 @@ nothing local is overwritten.  Agent must be running.
 ## Security
 
 ```
-fedipod passwd                           # require a password when a client logs in
 fedipod tokens                           # list client logins; --revoke <prefix> or --revoke-all
 fedipod revoke-credential --email EMAIL  # cut this machine off from the pod account
 ```
-A new password takes effect when a running agent restarts.
 
-**A client hosted somewhere else now needs one.** A client running on its own
-site (Elk, Phanpy on someone's own domain) asks the agent to send the sign-in
-result back to that site. Without a password there is nothing to approve that
-with — and the agent used to do it anyway, which meant any page you happened
-to have open could ask for the same thing and be given a key to your account.
-So: no password, no sending credentials off this machine. Clients that live on
-the agent itself (the bundled one, a dist in `ui/`, anything on
-`https://localhost:<port>`) are unaffected and need no password.
+**A client hosted somewhere else is approved at your pod.** A client running
+on its own site (Elk, Phanpy on someone's own domain) asks the agent to send
+the sign-in result back to that site; you approve it by signing in at your pod
+and pressing Allow. Clients that live on the agent itself (the bundled one, a
+dist in `ui/`, anything on `https://localhost:<port>`) need nothing.
 
 ## Bluesky
 

package/lib/client/masto/index.mjs

@@ -26,7 +26,6 @@ import * as accounts from './accounts.mjs';
 import * as timelines from './timelines.mjs';
 import * as statuses from './statuses.mjs';
 import * as media from './media.mjs';
-export { hashPassword } from './oauth.mjs';
 export { pollParams } from './body.mjs';
 export { attachmentType, extensionFor } from './media.mjs';
 
@@ -74,7 +73,6 @@ export class MastoApi {
     // loss — the client says "scheduled" and the post never appears. Refusing
     // it is worse UX and better behaviour.
     this.scheduling = scheduling;
-    this.authzAttempts = [];            // password-attempt timestamps
   }
 
   get store() { return this.agent.store; }
@@ -182,7 +180,6 @@ export class MastoApi {
   tokenOf(...a) { return oauth.tokenOf(this, ...a); }
   authed(...a) { return oauth.authed(this, ...a); }
   redirectAllowed(...a) { return oauth.redirectAllowed(this, ...a); }
-  rateLimited(...a) { return oauth.rateLimited(this, ...a); }
 
   // render.mjs
   selfAccount(...a) { return render.selfAccount(this, ...a); }

package/lib/client/masto/oauth.mjs

@@ -1,6 +1,6 @@
 // oauth.mjs — how a client gets in: registered apps and client documents,
 // authorization codes and PKCE, the bearer tokens and their scopes, the
-// password gate, and the three /oauth endpoints plus app registration.
+// owner's approval at their pod, and the three /oauth endpoints plus app registration.
 
 import crypto from 'node:crypto';
 import { isCrossSiteNavigation } from '../../shared/guard.mjs';
@@ -8,8 +8,6 @@ import { safeFetch, readCapped } from '../../shared/safefetch.mjs';
 import { readBody } from './body.mjs';
 
 const TOKEN_TTL_MS = 90 * 24 * 60 * 60 * 1000;   // tokens age out after 90 days
-const AUTHZ_WINDOW_MS = 60_000;
-const AUTHZ_MAX_ATTEMPTS = 5;
 const CODE_TTL_MS = 5 * 60_000;                  // an authorization code is short-lived
 const MAX_APPS = 200;                            // registered third-party clients, capped
 const MAX_REDIRECTS = 10;                        // return addresses one client may register
@@ -22,20 +20,6 @@ const CLIENT_DOC_WINDOW_MS = 60_000;
 const CLIENT_DOC_MAX_FETCHES = 20;               // outbound lookups per window
 const CLIENT_DOC_MAX = 64 * 1024;                // it names a client; it is not a payload
 
-// scrypt check for the optional UI password ({ saltHex, hashHex } record —
-// see hashPassword, used by the passwd CLI).
-export function hashPassword(password) {
-  const salt = crypto.randomBytes(16);
-  const hash = crypto.scryptSync(String(password), salt, 32);
-  return { saltHex: salt.toString('hex'), hashHex: hash.toString('hex') };
-}
-export function checkPassword(rec, password) {
-  try {
-    const hash = crypto.scryptSync(String(password), Buffer.from(rec.saltHex, 'hex'), 32);
-    return crypto.timingSafeEqual(hash, Buffer.from(rec.hashHex, 'hex'));
-  } catch { return false; }
-}
-
 const escapeHtml = (s) => String(s).replace(/[&<>"']/g, c =>
   ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c]));
 
@@ -85,48 +69,6 @@ button[hidden]{display:none}
   return true;
 }
 
-function sendLoginForm(res, params, error = '', client = null, status = null, headers = {}) {
-  const hidden = [...params.entries()].filter(([k]) => k !== 'password')
-    .map(([k, v]) => `<input type="hidden" name="${escapeHtml(k)}" value="${escapeHtml(v)}">`).join('\n');
-  // Name what is asking, so the owner approves a client they can see rather
-  // than an opaque one. The destination the code will be sent to is the fact
-  // that matters for a cross-site client.
-  let asking = '<p>Enter the agent password to authorize this client.</p>';
-  if (client && (client.name || client.redirect)) {
-    let where = '';
-    try { where = client.redirect ? new URL(client.redirect).host : ''; } catch { /* oob or blank */ }
-    const who = client.name ? escapeHtml(client.name) : (where ? escapeHtml(where) : 'A client');
-    asking = `<p><strong>${who}</strong> is asking to access your account`
-      + `${where ? `, sending the authorization to <code>${escapeHtml(where)}</code>` : ''}.</p>`
-      + `<p>Scope: <code>${escapeHtml(client.scope || 'read')}</code>. Enter the agent password to allow it.</p>`;
-  }
-  res.writeHead(status || (error ? 401 : 200),
-    { 'content-type': 'text/html; charset=utf-8', ...headers });
-  res.end(`<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">
-<title>FediPod — authorize</title>
-<style>:root{color-scheme:light dark;font-size:125%;--heading:#1a4f8a}
-body{font:1rem system-ui,sans-serif;max-width:22rem;margin:15vh auto;padding:0 1rem}
-h1{color:var(--heading)}
-code{word-break:break-all}
-@media (prefers-color-scheme:dark){:root{--heading:#7fb3e8}}
-input,button{font:inherit;width:100%;padding:.5rem;margin:.3rem 0;box-sizing:border-box}
-.err{color:#b00020}
-@media (prefers-color-scheme:dark){.err{color:#ff8a8a}}</style></head><body>
-<main>
-<h1>FediPod</h1>
-${asking}
-${error ? `<p class="err" id="login-err" role="alert">${escapeHtml(error)}</p>` : ''}
-<form method="POST" action="/oauth/authorize">
-${hidden}
-<label for="password">Agent password</label>
-<input type="password" id="password" name="password" autofocus autocomplete="current-password"
-  ${error ? 'aria-invalid="true" aria-describedby="login-err"' : ''}>
-<button type="submit">Authorize</button>
-</form>
-</main></body></html>`);
-  return true;
-}
-
 // What one request needs. Mastodon's four coarse scopes; a client that was
 // granted a granular `write:statuses` satisfies `write` here, which is the
 // direction that cannot let anything through that `write` would not.
@@ -439,22 +381,13 @@ export function redirectAllowed(api, redirect) {
   } catch { return false; }
 }
 
-export function rateLimited(api) {
-  const now = Date.now();
-  api.authzAttempts = api.authzAttempts.filter(t => now - t < AUTHZ_WINDOW_MS);
-  if (api.authzAttempts.length >= AUTHZ_MAX_ATTEMPTS) return true;
-  api.authzAttempts.push(now);
-  return false;
-}
-
 export async function handle(api, ctx) {
   const { req, res, pathname, url, send } = ctx;   // eslint-disable-line no-unused-vars
 
   // --- oauth ---
-  // With no UI password configured this is "theater": whoever can reach the
-  // loopback surface IS the trusted user, and authorize redirects at once.
-  // With a password set (required before any non-loopback exposure), the
-  // authorize step becomes a real login form.
+  // On loopback this is "theater": whoever can reach the surface IS the
+  // trusted user, and authorize answers at once. Anywhere else the owner
+  // approves the client by signing in at their pod.
   if (pathname === '/api/v1/apps' && req.method === 'POST') {
     const body = await readBody(req);
     const problem = redirectsProblem(body.redirect_uris);
@@ -475,14 +408,12 @@ export async function handle(api, ctx) {
     });
   }
   if (pathname === '/oauth/authorize' && (req.method === 'GET' || req.method === 'POST')) {
-    const pw = api.store.getConfig()?.uiPassword;   // { saltHex, hashHex } scrypt record
     let params = url.searchParams;
     let body = null;
     if (req.method === 'POST') { body = await readBody(req); params = new URLSearchParams(body); }
     const redirect = params.get('redirect_uri') || '';
     // The owner's pod sign-in, proved: a Solid-OIDC token with its DPoP proof,
-    // from the WebID this account belongs to. It stands in for the password
-    // everywhere below.
+    // from the WebID this account belongs to. It is how a client is approved.
     let proved = false;
     if (req.method === 'POST' && req.headers.authorization && req.headers.dpop && api.podAuth) {
       const proof = await api.podAuth(req, pathname);
@@ -513,7 +444,7 @@ export async function handle(api, ctx) {
     //
     // /api/v1/apps takes any redirect_uri from anyone — as it must, that is
     // how a fediverse client registers — and the instant-authorize path below
-    // mints without a password whenever the request "is this machine". A page
+    // mints at once whenever the request "is this machine". A page
     // in another tab is this machine. So: register a client whose redirect is
     // your own server, navigate the owner's browser to /oauth/authorize, and
     // the code arrives at your address. The agent's own CA is in the browser's
@@ -530,12 +461,10 @@ export async function handle(api, ctx) {
       api.log(`authorize refused: cross-site navigation to the mint from ${req.headers.referer || 'nowhere'}`);
       return send(403, { error: 'a cross-site navigation may not authorize a client' });
     }
-    // 2. With NO password set there is nothing to authorize a third party
-    //    WITH. The password-less path is honest only for a client on an
-    //    address this agent itself answers on — where "whoever reaches the
-    //    port is the owner" is a statement about the machine rather than
-    //    about a web page. Anything pointing elsewhere has to be approved by
-    //    somebody who knows the password.
+    // 2. The unapproved path is honest only for a client on an address this
+    //    agent itself answers on — where "whoever reaches the port is the
+    //    owner" is a statement about the machine rather than about a web
+    //    page. Anything pointing elsewhere is approved by the owner at their pod.
     const client = { name: app?.name || doc?.name || null, redirect, scope: params.get('scope') || 'read' };
     // A proof method named and not known is refused rather than read as the
     // weakest one, whose proof is the challenge itself.
@@ -543,13 +472,12 @@ export async function handle(api, ctx) {
     if (params.get('code_challenge') && challengeMethod && challengeMethod !== 'S256' && challengeMethod !== 'plain') {
       return send(400, { error: 'code_challenge_method must be S256 or plain' });
     }
-    if (external && !proved && !api.store.getConfig()?.uiPassword && !api.redirectAllowed(redirect)) {
-      // With a pod to sign in at, the owner approves the client there.
+    if (external && !proved && !api.redirectAllowed(redirect)) {
+      // The owner approves the client at their pod.
       if (req.method === 'GET' && ownerWebId) return sendPodSigninPage(res, client, ownerWebId, api.mount || '', ownAddress(api));
-      api.log(`authorize refused: no UI password, and "${redirect}" is not an address of this agent`);
+      api.log(`authorize refused: "${redirect}" is not an address of this agent, and nothing approved it`);
       return send(403, {
-        error: 'this client asks to be sent somewhere other than this agent, and no password is '
-          + 'set to approve that with. Run `fedipod passwd` and try again.',
+        error: 'this client asks to be sent somewhere other than this account; approve it by signing in at your pod',
       });
     }
     if (app) {
@@ -573,26 +501,10 @@ export async function handle(api, ctx) {
       api.log(`authorize refused: redirect_uri "${redirect}" is not this agent`);
       return send(400, { error: 'redirect_uri must be an address of this agent' });
     }
-    if (req.method === 'POST' && !proved) {
-      if (api.rateLimited()) {
-        api.log('authorize rate limited');
-        // 429, not 401: a client that reads this as a wrong password will
-        // ask the person to type it again, which is the one thing that
-        // cannot help. Retry-After says how long the wait actually is.
-        return sendLoginForm(res, params, 'too many attempts — wait a minute', client,
-          429, { 'retry-after': String(Math.ceil(AUTHZ_WINDOW_MS / 1000)) });
-      }
-      if (!pw || !checkPassword(pw, body.password || '')) {
-        return sendLoginForm(res, params, 'wrong password — try again', client);
-      }
-    } else if (pw && !proved) {
-      // The login/approve screen names what is asking before the owner types
-      // the password — a cross-site client cannot forge past that.
-      return sendLoginForm(res, params, '', client);
-    } else if (!proved && api.allowed && !api.allowed.isLocalRequest(req) && !api.throughDoor?.(req)) {
-      // With a pod to sign in at, the owner does that instead of a password.
+    if (!proved && api.allowed && !api.allowed.isLocalRequest(req) && !api.throughDoor?.(req)) {
+      // The owner signs in at their pod and approves the client there.
       if (req.method === 'GET' && ownerWebId) return sendPodSigninPage(res, client, ownerWebId, api.mount || '', ownAddress(api));
-      // No password set, and this request did not come from this machine.
+      // Not proved, and this request did not come from this machine.
       //
       // The instant-authorize path is honest theatre on loopback: whoever can
       // reach it IS the trusted user. It stops being theatre the moment an
@@ -602,11 +514,11 @@ export async function handle(api, ctx) {
       // — update_credentials included, which is precisely the authority the
       // isLocal check on /setup and /config exists to withhold. /oauth is
       // dispatched before that check ever runs, so it needs its own.
-      api.log(`authorize refused: no UI password, and "${req.headers.host}" is not this machine`);
+      api.log(`authorize refused: not approved at the pod, and "${req.headers.host}" is not this machine`);
       return send(403, {
         error: api.embedded
           ? 'Open your account\'s management page first, then sign in from there.'
-          : 'Signing in from another machine needs a password. On the machine that runs your account, run: fedipod passwd',
+          : 'Signing in from another machine goes through your pod: sign in there to approve this app.',
       });
     }
     // External clients get a bound code; the local flow keeps code==token.
@@ -696,11 +608,10 @@ export async function handle(api, ctx) {
         // would mean a second round trip before it knows who it is.
         ...(api.urls?.actor ? { activitypub_actor_id: api.urls.actor } : {}) });
     }
-    // Local flow: the code IS the token, minted by /oauth/authorize after the
-    // password gate. Minting one here for an unrecognised code handed a
-    // bearer to anyone who could reach the port — and a non-browser client
-    // sends no Origin, so the firewall never saw it. That defeated `passwd`
-    // on any agent deliberately exposed through AP_ALLOWED_HOSTS.
+    // Local flow: the code IS the token, minted by /oauth/authorize. Minting
+    // one here for an unrecognised code handed a bearer to anyone who could
+    // reach the port — and a non-browser client sends no Origin, so the
+    // firewall never saw it.
     if (!body.code || !api.tokens().includes(body.code)) {
       api.log('token refused: code is not a live authorization');
       return send(400, { error: 'invalid_grant' });

package/lib/core/agent.mjs

@@ -210,8 +210,8 @@ export class Agent {
       this.log(`this actor was retired on ${config.retiredAt} — run setup for a new identity`);
       return false;
     }
-    // A rename is a merge into the existing config, never a rewrite — the
-    // UI password and anything else set later must survive it.
+    // A rename is a merge into the existing config, never a rewrite —
+    // anything set later must survive it.
     if (name && name !== config.name) {
       this.store.setConfig({ ...config, name });
       config = this.store.getConfig();
@@ -235,11 +235,7 @@ export class Agent {
     // came out bare. Pod state is the authority; this is the cache of it.
     this.recordHandle(config.handle);
 
-    // Said once, where the config is finally known. Exposure without a gate
-    // token is refused before the socket opens (startAgent), so reaching here
-    // means the token is set and the whole surface is behind it. A UI password
-    // is the second, per-person half: without one, anyone who has the token
-    // gets a client bearer for the asking.
+    // Said once, where the config is finally known.
     // An install made before the shape changed goes on working, which is why
     // nothing here refuses — but it should not go on SILENTLY. The whole reason
     // this is said out loud is that bbba587 changed a default and every install
@@ -253,11 +249,6 @@ export class Agent {
     // read by nobody who lives in the GUI.
     this.pendingUpgrade = pending.map(s => s.what);
 
-    if (process.env.AP_ALLOWED_HOSTS && !config.uiPassword) {
-      this.log('WARNING: AP_ALLOWED_HOSTS is set and no UI password is — anyone holding '
-        + 'AP_GATE_TOKEN can mint a client token. Run `fedipod passwd`.');
-    }
-
     if (!act) return true;                   // reading only — see the note above
 
     // Exactly one agent may act on a pod (inbox drains are destructive

package/lib/device/cli/commands/setup.mjs

@@ -1,5 +1,5 @@
 // setup.mjs — making an identity and its secrets: setup, rotate-key,
-// revoke-credential, tokens, passwd, keys.
+// revoke-credential, tokens, keys.
 
 import fs from 'node:fs';
 import path from 'node:path';
@@ -398,29 +398,6 @@ if (has('revoke-all')) {
 }
 }
 
-export async function passwd() {
-requireIdentity();
-const { Agent } = await import(new URL('../../../../run-agent.mjs', import.meta.url));
-const { hashPassword } = await import(new URL('../../../../lib/client/masto/index.mjs', import.meta.url));
-const { RemotePod } = await import(new URL('../../../../lib/device/remote.mjs', import.meta.url));
-const { apUrls } = await import(new URL('../../../../lib/core/wire.mjs', import.meta.url));
-const agent = new Agent({ home: HOME, log: () => {} });
-const cred = agent.readCredential();
-if (!cred) { console.error('no credential — run setup first'); process.exit(2); }
-const pw = await askHidden('new UI password: ');
-if (!pw) { console.error('empty password — aborted'); process.exit(2); }
-agent.remote = new RemotePod(cred);
-await agent.remote.warmup();
-agent.urls = apUrls(cred.remotePod, cred.root);
-agent.store.attach(agent.privateStorage(cred, 'state'));   // honours privateRoot
-await agent.store.load();
-const config = agent.store.getConfig();
-if (!config) { console.error('pod state empty — run setup first'); process.exit(2); }
-agent.store.setConfig({ ...config, uiPassword: hashPassword(pw) });
-await agent.store.flush();
-console.log('UI password set — /oauth/authorize now shows a login form (restart a running agent to pick it up)');
-}
-
 export async function keys() {
 // Where the signing key lives; `--to pod` moves it into pod state — with
 // the state store on a pod every device reaches, that is what lets them

package/lib/device/setup.mjs

@@ -15,7 +15,6 @@ import * as $rdf from 'rdflib';
 
 import { createAccountWithPod as realCreateAccount } from './account.mjs';
 import { mintCredential as realMint, RemotePod } from './remote.mjs';
-import { hashPassword } from '../client/masto/index.mjs';
 import { webfingerHost, apUrls, DEFAULT_ROOT } from '../core/wire.mjs';
 import { rootOf, recordLastUsed, writeJsonAtomic } from './home.mjs';
 import { insecureUrlReason } from '../shared/safefetch.mjs';
@@ -233,7 +232,7 @@ export async function runSetup({ home, agent, answers, run, deps = {}, log = ()
 
   const {
     mode, issuer, email, password, handle, name, podName,
-    kind = 'person', approveJoins = false, summary, icon, keys, uiPassword,
+    kind = 'person', approveJoins = false, summary, icon, keys,
     gateway = null, shape = 'pod', gatewayOrigin = 'https://fedipod.net',
     // The container that holds `fedipod/` (blank: the pod's root), and the
     // person's yes to a new public type index when their profile names none.
@@ -436,9 +435,6 @@ export async function runSetup({ home, agent, answers, run, deps = {}, log = ()
     done('connect');
 
     begin('publish');
-    if (uiPassword) {
-      agent.store.setConfig({ ...agent.store.getConfig(), uiPassword: hashPassword(uiPassword) });
-    }
     const published = await agent.publisher.publishProfile();
     await agent.store.flush();
     // Where the account lives, in the owner's public type index — made first

package/lib/shared/guard.mjs

@@ -72,10 +72,10 @@ export function isLoopbackSocket(req) {
 // means something on this machine is relaying, and a stock
 // `proxy_pass http://127.0.0.1:<port>;` rewrites Host to a loopback authority
 // and connects from loopback. Every caller then looks local, which is what the
-// local-only routes and the password-less authorize path were trusting.
+// local-only routes and the unapproved authorize path were trusting.
 //
 // A secret is all that is left, and AP_GATE_TOKEN is the one every route
-// checks — a uiPassword guards the OAuth login and nothing else. Returns a
+// checks; an app's sign-in is approved at the owner's pod. Returns a
 // reason string when the agent must not start, or null.
 export function exposureProblem({ allowedHosts, gateToken } = {}) {
   const exposed = String(allowedHosts || '').split(',').map(s => s.trim()).filter(Boolean);

package/lib/surface/routes/owner.mjs

@@ -5,7 +5,6 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { announceModeration } from '../../core/social.mjs';
 import { addRemoveActivity, publicHandle } from '../../core/wire.mjs';
-import { hashPassword } from '../../client/masto/index.mjs';
 import { tildify } from '../../shared/files.mjs';
 import { AGENT_VERSION } from '../static.mjs';
 
@@ -71,8 +70,6 @@ export async function get(p, ctx, req, res, url) {   // eslint-disable-line no-u
       approveJoins: !!cfg.approveJoins, review: !!cfg.review,
       aliases: cfg.aliases || [],
       autoAcceptFollows: cfg.autoAcceptFollows !== false,
-      // never the record itself
-      hasUiPassword: !!cfg.uiPassword,
       quiescedAt: cfg.quiescedAt || null, movedTo: cfg.movedTo || null,
       // Per-machine, so it comes from the credential file, not pod config —
       // and it is a fact here, not a setting: moving it means moving data,
@@ -172,8 +169,8 @@ export async function post(p, body, ctx, req, res) {   // eslint-disable-line no
       // A user acting here outranks an idle active agent on another device:
       // claim the lease rather than write state that one will clobber.
       await agent.requestTakeover?.();
-      // Merge, never replace: the UI password and anything else set later
-      // must survive an edit that never mentions it.
+      // Merge, never replace: anything set later must survive an edit that
+      // never mentions it.
       const cfg = { ...agent.store.getConfig() };
       if ('name' in body) {
         if (!body.name) return json(res, 400, { error: 'a display name is required' });
@@ -210,12 +207,6 @@ export async function post(p, body, ctx, req, res) {   // eslint-disable-line no
         };
         cfg.moderators = next;
       }
-      if ('password' in body) {
-        // '' clears it. The UI password is what turns the instant OAuth
-        // redirect into a login form; switching that off is a real choice.
-        if (body.password) cfg.uiPassword = hashPassword(body.password);
-        else delete cfg.uiPassword;
-      }
       const republish = WIRE_CONFIG.some(k => k in body);
       agent.store.setConfig(cfg);
       if ('autoAcceptFollows' in body && agent.publisher) {
@@ -257,7 +248,6 @@ export async function post(p, body, ctx, req, res) {   // eslint-disable-line no
           approveJoins: !!cfg.approveJoins, review: !!cfg.review,
           autoAcceptFollows: cfg.autoAcceptFollows !== false,
           ...(isGroup() ? { moderators: cfg.moderators || [] } : {}),
-          hasUiPassword: !!cfg.uiPassword,
         },
       });
     }

package/lib/surface/surface.mjs

@@ -239,8 +239,7 @@ export function buildAdminSurface({ agent, gate, allowed, log = console.log,
       // twice over: a group has statuses (what it carried) and notifications
       // (who joined), and its operator has a bio to edit and a profile they
       // want to see the way everyone else does. The surface this opens is a
-      // login and client tokens, and `passwd` has never had a group carve-out,
-      // so a group can be gated exactly like a person before it is exposed.
+      // login and client tokens, approved at the pod like a person's.
       if (p.startsWith('/api/') || p.startsWith('/oauth/')) {
         if (await masto.handle(req, res, p, url)) return;
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fedipod",
-  "version": "1.49.1",
+  "version": "1.50.0",
   "description": "Standalone single-actor ActivityPub agent whose wire face, RDF truth and state all live on a Solid pod (CSS). Bundles a Phanpy UI and a Mastodon client-API facade.",
   "type": "module",
   "license": "MIT",

package/web/admin/index.html

@@ -220,7 +220,7 @@ pre { overflow-x: auto; background: #0001; padding: .6rem; border-radius: .3rem;
      no page there to open. Plain links — a top-level navigation sends no
      Origin, so each agent's own firewall lets it through. -->
 <section id="pane-others" aria-label="Actors on this machine" hidden>
-  <!-- Everything setup cannot work without. The bio, avatar and UI password it
+  <!-- Everything setup cannot work without. The bio and avatar it
        also offers are all changeable afterwards, so they are not asked here —
        the fuller form is what the new actor opens on. -->
   <form id="new-actor-form" hidden>

package/web/admin/record.js

@@ -7,9 +7,6 @@
 // Two rules the routes enforce and this page respects: a write is a MERGE, so a
 // form that never mentions a field cannot delete it; and anything on the wire is
 // not real until the actor is republished, which POST /config does for itself.
-//
-// The UI password is deliberately not here — `fedipod passwd` sets it. It
-// only gates /oauth/authorize, so it does nothing for a loopback-only agent.
 
 let config = null;
 // Held, because render() moves it into a generated row and empties that row's

package/web/app/admin-facade.mjs

@@ -18,7 +18,6 @@ import { publicHandle, webfingerHost } from '../../lib/core/wire.mjs';
 import * as podInbox from '../../lib/pod/inbox.mjs';
 import { normalizeImport, IMPORT_KINDS } from '../../lib/connections/import.mjs';
 import { followActor, followHandle } from '../../lib/core/social.mjs';
-import { hashPassword } from '../../lib/client/masto/index.mjs';
 
 // The identity itself — changing any means a different actor, i.e. a new setup.
 const PERMANENT_CONFIG = ['handle', 'remotePod', 'issuer', 'root', 'kind'];
@@ -121,7 +120,6 @@ export class AdminFacade {
             image: cfg.image || null, fields: cfg.fields || [],
             aliases: cfg.aliases || [],
             autoAcceptFollows: cfg.autoAcceptFollows !== false,
-            hasUiPassword: !!cfg.uiPassword,
             quiescedAt: cfg.quiescedAt || null, movedTo: cfg.movedTo || null,
             mode: a.status().mode,
             // Live from the credential's actual backend on THIS browser (a
@@ -218,10 +216,6 @@ export class AdminFacade {
             .map(f => ({ name: String(f.name).trim(), value: String(f.value ?? '').trim() }));
         }
         if ('autoAcceptFollows' in body) cfg.autoAcceptFollows = !!body.autoAcceptFollows;
-        if ('password' in body) {
-          if (body.password) cfg.uiPassword = hashPassword(body.password);
-          else delete cfg.uiPassword;
-        }
         const republish = WIRE_CONFIG.some(k => k in body);
         a.store.setConfig(cfg);
         if ('autoAcceptFollows' in body && a.publisher) a.publisher.config.autoAcceptFollows = cfg.autoAcceptFollows;