fedipod 1.50.2 → 1.56.0

package/web/app/fediacct-browser.mjs

@@ -2,33 +2,31 @@
 // OTHER servers, in the browser.
 //
 // Same FediAccounts client the Node agent uses (lib/fediacct.mjs): the same
-// OAuth dance and authenticated calls. What the browser adds is the owner's
-// per-connection storage choice, the same one Bluesky has:
-//
-//  - "browser": the credential lives in IndexedDB on this device (default).
-//  - "pod": it lives in the owner-only pod state, so it follows the owner to
-//    any browser they sign in from.
-//
-// A record carries which backend it lives in; list() merges both, and moving a
-// connection is a re-write to the other backend. App registrations and the
-// short-lived OAuth "pending" state stay in IndexedDB (per browser), and the
-// pending state is persisted so a connection survives the worker being
-// idle-killed between the redirect out and the code coming back.
+// OAuth dance and authenticated calls. The credentials live in the owner-only
+// pod state, on the pod only (lib/core/pod-only.mjs), so they follow the owner
+// to any browser they sign in from. Records an earlier build kept in this
+// browser's IndexedDB are still read, and moveToPod() takes them to the pod.
+// App registrations and the short-lived OAuth "pending" state stay in
+// IndexedDB (per browser), and the pending state is persisted so a connection
+// survives the worker being idle-killed between the redirect out and the code
+// coming back.
 import { FediAccounts } from '../../lib/connections/fediacct.mjs';
 import { kvAll, kvPut, kvDel } from './idb-kv.mjs';
 
-const POD_DOC = 'fediaccts.json';   // { id: record } for pod-stored connections
+const POD_DOC = 'fediaccts.json';   // { id: record }
 const PEND_TTL_MS = 10 * 60_000;
 
 export class BrowserFediAccounts extends FediAccounts {
   constructor({ store, actorId = null, log = console.log } = {}) {
     super({ localDir: '/fediaccts', actorId, log });   // localDir unused; storage below
     this.store = store;
-    this._recs = new Map();     // browser (IndexedDB) records, id → record
+    this._recs = new Map();     // records still in this browser (IndexedDB), id → record
     this._apps = new Map();     // host → app registration
   }
 
-  async load() {
+  // `fromPod`: the pod's records read as well (agent.mjs says when).
+  async load({ fromPod = false } = {}) {
+    if (fromPod) await this.store.refresh?.([POD_DOC], { ifChanged: true }).catch((e) => this.log(`connected accounts: ${e.message}`));
     const all = await kvAll().catch(() => ({}));
     for (const [k, v] of Object.entries(all)) {
       if (k.startsWith('rec:')) this._recs.set(k.slice(4), v);
@@ -47,8 +45,8 @@ export class BrowserFediAccounts extends FediAccounts {
 
   read(id) {
     let rec = null; let where = null;
-    if (this._recs.has(id)) { rec = this._recs.get(id); where = 'browser'; }
-    else { const p = this._podMap()[id]; if (p) { rec = p; where = 'pod'; } }
+    const p = this._podMap()[id];
+    if (p) { rec = p; where = 'pod'; } else if (this._recs.has(id)) { rec = this._recs.get(id); where = 'browser'; }
     if (!rec) return null;
     if (rec.mintedFor && this.actorId && rec.mintedFor !== this.actorId) {
       this.log(`fediaccts/${id} belongs to ${rec.mintedFor} — not reusing it for ${this.actorId}`);
@@ -58,17 +56,23 @@ export class BrowserFediAccounts extends FediAccounts {
   }
 
   write(rec) {
-    const where = rec.storage || 'browser';
-    const clean = { ...rec, storage: where };
-    if (where === 'pod') {
-      const map = { ...this._podMap(), [clean.id]: clean };
-      this.store.write(POD_DOC, map); this.store.flush?.().catch(() => {});
-      this._recs.delete(clean.id); kvDel('rec:' + clean.id).catch(() => {});
-    } else {
-      this._recs.set(clean.id, clean); kvPut('rec:' + clean.id, clean).catch((e) => this.log(`fediacct persist: ${e.message}`));
-      const map = this._podMap();
-      if (clean.id in map) { delete map[clean.id]; this.store.write(POD_DOC, map); this.store.flush?.().catch(() => {}); }
-    }
+    const clean = { ...rec, storage: 'pod' };
+    const map = { ...this._podMap(), [clean.id]: clean };
+    this.store.write(POD_DOC, map); this.store.flush?.().catch(() => {});
+  }
+
+  // The records still in this browser, onto the pod, and out of the browser
+  // once the pod has them. One the pod already holds is newer there.
+  async moveToPod() {
+    const moving = [...this._recs.values()].filter((r) => !r.mintedFor || !this.actorId || r.mintedFor === this.actorId);
+    if (!moving.length) return 0;
+    const map = { ...this._podMap() };
+    for (const r of moving) if (!(r.id in map)) map[r.id] = { ...r, storage: 'pod' };
+    this.store.write(POD_DOC, map);
+    if (!await this.store.commit()) return 0;
+    for (const r of moving) { this._recs.delete(r.id); await kvDel('rec:' + r.id).catch(() => {}); }
+    this.log(`${moving.length} connected account(s) moved from this browser to the pod`);
+    return moving.length;
   }
 
   // Best-effort: tell the server to revoke our token (RFC 7009), so a
@@ -109,8 +113,6 @@ export class BrowserFediAccounts extends FediAccounts {
     }));
   }
 
-  // Move a connection between backends (the Options menu's Storage control).
-  setStorage(id, where) { const rec = this.read(id); if (rec && (where === 'pod' || where === 'browser')) { this.write({ ...rec, storage: where }); return this.roster().find(r => r.id === id) || null; } return null; }
 
   // One app registration per host, remembered — over IndexedDB.
   async appFor(host, redirectUri) {

package/web/app/idb-kv.mjs

@@ -1,7 +1,7 @@
-// idb-kv.mjs — a tiny per-origin key/value store on IndexedDB, for the browser
-// agent's "on this device, never the pod" storage: a connected account's
-// credential when the owner chooses to keep it in this browser rather than let
-// it follow them to their pod. Shared by atproto-browser and fediacct-browser.
+// idb-kv.mjs — a tiny per-origin key/value store on IndexedDB, for what the
+// browser agent keeps on this device: app registrations, the short OAuth
+// pending state, and connected-account credentials an earlier build kept here
+// until they move to the pod. Shared by atproto-browser and fediacct-browser.
 const DB = 'fedipod-accounts';
 
 function open() {

package/web/app/shims/prelude.js

@@ -54,5 +54,6 @@ globalThis.Buffer ??= (() => {
     concat: (list) => { const n = list.reduce((s, x) => s + x.length, 0); const o = new Buf(n); let i = 0; for (const x of list) { o.set(x, i); i += x.length; } return o; },
     alloc: (n) => new Buf(n),
     isBuffer: (x) => x instanceof Uint8Array,
+    byteLength: (d, enc) => (typeof d === 'string' ? fromString(d, enc).length : d.byteLength ?? d.length),
   };
 })();

package/web/app/sw-src.mjs

@@ -10,10 +10,28 @@ import { BrowserAgent } from './agent.mjs';
 import { getSession } from './oidc-session.mjs';
 import { ADMIN_PATHS } from './admin-facade.mjs';
 import { bridge } from '../../lib/client/masto/bridge.mjs';
+import { kvGet, kvPut } from './idb-kv.mjs';
 
 let agent = null;
 let booting = null;
 
+// What the agent has said lately, for the manage page's Show the log: the last
+// 300 lines, kept in this browser across the worker's restarts, each with this
+// browser's own date and time.
+const LOG_KEEP = 300;
+let logLines = [];
+let logTimer = null;
+const logRead = kvGet('log').then((kept) => { logLines = [...(Array.isArray(kept) ? kept : []), ...logLines].slice(-LOG_KEEP); }).catch(() => {});
+function agentLog(m) {
+  console.log('[sw-agent]', m);
+  const at = new Date().toLocaleString(undefined, { month: '2-digit', day: '2-digit', hour: 'numeric', minute: '2-digit', second: '2-digit' });
+  logLines.push(`${at}  ${m}`);
+  if (logLines.length > LOG_KEEP) logLines.splice(0, logLines.length - LOG_KEEP);
+  clearTimeout(logTimer);
+  logTimer = setTimeout(() => { logRead.then(() => kvPut('log', logLines)).catch(() => {}); }, 1500);
+}
+const recentLog = async () => { await logRead; return logLines; };
+
 const FACADE = /^\/(api\/v[12]\/|oauth\/|nodeinfo\/)/;   // Mastodon paths only — never the front's own /api/handle, /api/attach, /api/relay
 const FACADE_EXACT = new Set(['/.well-known/nodeinfo', '/.well-known/oauth-authorization-server', '/nodeinfo/2.0']);
 const isFacade = (p) => FACADE.test(p) || FACADE_EXACT.has(p);
@@ -109,7 +127,8 @@ self.addEventListener('activate', (e) => e.waitUntil(self.clients.claim()));
 async function bootFromSession(frontOrigin, restart) {
   const oidc = await getSession();
   if (!oidc) throw new Error('no session — sign in first');
-  const a = new BrowserAgent({ log: (m) => console.log('[sw-agent]', m) });
+  const a = new BrowserAgent({ log: agentLog });
+  a.recentLog = recentLog;
   await a.boot({ oidc, frontOrigin: frontOrigin || self.location.origin, restart });
   agent = a;
   return a;
@@ -135,7 +154,9 @@ self.addEventListener('message', (e) => {
     return;
   }
   if (e.data?.type !== 'boot') return;
-  ensureBooting(e.data.frontOrigin)
+  const booted = ensureBooting(e.data.frontOrigin);
+  e.waitUntil(stillWorking(booted));
+  booted
     .then(() => e.source?.postMessage({ type: 'booted' }))
     // `code` matters: a boot that failed only because this browser has never
     // opened the signing key is not a failure the page should show as one — it
@@ -151,9 +172,29 @@ self.addEventListener('fetch', (e) => {
   // sending its owner back to that sign-in: the gateway's, not this browser's
   // agent, whose own client signs in from a page on this origin.
   if (url.pathname.startsWith('/oauth/') && !sameOriginReferrer(e.request)) return;
-  e.respondWith(serve(e.request, url));
+  const served = serve(e.request, url);
+  e.respondWith(served);
+  e.waitUntil(stillWorking(served));
 });
 
+// A browser stops a worker about thirty seconds after its last event, however
+// far the agent's own work has got. Each request keeps it up until the agent's
+// start and its inbox rounds are done, for at most four minutes (a browser
+// allows one event five); the next request carries it on.
+const STILL_WORKING_MS = 4 * 60_000;
+function stillWorking(first) {
+  const work = (async () => {
+    await Promise.resolve(first).catch(() => {});
+    const a = agent;
+    if (!a) return;
+    await a.provisioning?.catch(() => {});
+    await a.intake?.settled?.();
+  })().catch(() => {});
+  let timer;
+  const cap = new Promise((r) => { timer = setTimeout(r, STILL_WORKING_MS); });
+  return Promise.race([work, cap]).finally(() => clearTimeout(timer));
+}
+
 async function serve(request, url) {
   // Before anything is booted or read: is this caller allowed to be here at all?
   const refuse = notAllowed(request, url);