fedipod 1.6.0 → 1.8.0

package/web/app/agent.mjs

@@ -12,6 +12,7 @@ import { PodStore } from '../../lib/core/store.mjs';
 import { HttpStorage } from '../../lib/core/storage.mjs';
 import { Publisher } from '../../lib/core/publisher/index.mjs';
 import { Intake } from '../../lib/core/intake/index.mjs';
+import { C2S } from '../../lib/client/c2s.mjs';
 import { Lease } from '../../lib/core/lease.mjs';
 import { MastoApi } from '../../lib/client/masto/index.mjs';
 import { TagFeed } from '../../lib/connections/tagfeed.mjs';
@@ -84,6 +85,9 @@ export class BrowserAgent {
       // whole document back over newer state. Read what is actually there
       // before acting on it.
       await this.store.load({ force: true }).catch((e) => this.log(`re-reading state: ${e.message}`));
+      // Own posts the outbox names and the timeline index lacks come back
+      // here, before anything acts on the index.
+      await this.publisher.healStatuses().catch((e) => this.log(`healing the timeline index: ${e.message}`));
       // And start delivering again, since demote() stopped it. startQueue() is
       // idempotent, so a goActive() that was already active costs nothing.
       this.deliverer?.startQueue?.();
@@ -189,7 +193,7 @@ export class BrowserAgent {
     // builds its own urls from `config.root` (publisher.mjs), and a config
     // without one falls to the Node default — so an account set up elsewhere
     // and signed into here would keep its state under `fedipod/` while every
-    // document it published landed under `activitypods-js/`. One root, decided
+    // document it published landed under a different root. One root, decided
     // once, carried by the config everything downstream reads.
     this.store.setConfig({ ...(this.store.getConfig() || {}), ...cfg, root });
     config = this.store.getConfig();
@@ -257,9 +261,14 @@ export class BrowserAgent {
     // read-only until the owner acts on it and it takes over. Written with fresh
     // fetches, never the cached store. Passed into Intake so the drain checks it.
     this.lease = new Lease({ url: this.urls.state + 'lease.json', fetchImpl: podFetch, log: this.log });
+    // The client-to-server dispatcher, here only for what the Gateway's
+    // outbox door takes on the owner's behalf: the browser answers no
+    // /ap/outbox of its own.
+    this.c2s = new C2S({ agent: this, log: this.log });
     this.intake = new Intake({
       config: this.store.getConfig(), urls: this.urls, remote: this.remote,
       store: this.store, deliverer: this.deliverer, publisher: this.publisher, log: this.log, push: true, lease: this.lease,
+      ownerPost: (a, o) => this.c2s.dispatch(a, o),
     });
     // The Mastodon facade the service worker serves.
     //
@@ -356,6 +365,7 @@ export class BrowserAgent {
       podRequests: this.remote?.stats?.() || null,
       update: null,
       inboxCooldownFor: 0,
+      stateSkipped: this.store?.lastSkipped || [],
     };
   }
 

package/web/app/boot.mjs

@@ -16,7 +16,7 @@ import { podBaseOfWebId } from '../../lib/pod/urls.mjs';
 import { podLayout } from '../../lib/pod/root.mjs';
 import { BrowserRemotePod } from './pod-remote.mjs';
 import { beginLogin, completeLogin, getSession, signOut } from './oidc-session.mjs';
-import { unwrapKeys, isKeyEnvelope } from './keystore.mjs';
+import { generateKeys, wrapKeys, unwrapKeys, isKeyEnvelope } from './keystore.mjs';
 import { cacheOpenedKeys } from './keys-browser.mjs';
 
 const REDIRECT = `${location.origin}/`;   // the app root doubles as the OIDC callback
@@ -64,30 +64,50 @@ async function bootWorker({ reset = false } = {}) {
 //
 // The unwrap happens HERE, in the page, and not in the worker: the worker boots
 // itself whenever the browser restarts it, with nobody present to type anything.
-window.fedipodUnlock = async (password) => {
-  if (!password) throw new Error('Enter your account password.');
+//
+// Both paths below read the account's config and key the same way: with the
+// session, as the owner, through the transport rather than the bare session —
+// a pod read like any other, with the retry ladder that exists because the pod
+// host throttles bursts.
+async function readAccountState() {
   const session = await getSession();
   if (!session) throw new Error('Sign in first.');
-  // The config on the pod says where this account's state lives; the key sits
-  // beside it. Both are read with the session, as the owner.
   const podFromWebId = podBaseOfWebId(session.webId);   // a suffix-based host, or its own host
   const state = `${podFromWebId}${AP_ROOT}ap-state/`;
-  // Through the transport rather than the bare session: this is a pod read
-  // like any other, and going round it skipped the retry ladder that exists
-  // because the pod host throttles bursts.
   const remote = new BrowserRemotePod(session, { webId: session.webId, role: 'signup', log: () => {} });
   const urls = { state };
   const [cfg, doc] = await Promise.all([
     podState.readConfig(remote, urls), podState.readWrappedKeys(remote, urls),
   ]);
-  if (!cfg || !doc) throw new Error(`could not read this account's config and key under ${state}`);
+  if (!cfg) throw new Error(`could not read this account's config under ${state}`);
+  const actorUrl = `${cfg.remotePod}${cfg.root || AP_ROOT}ap/actor`;
+  return { remote, urls, cfg, doc, actorUrl };
+}
+
+window.fedipodUnlock = async (password) => {
+  if (!password) throw new Error('Enter your password.');
+  const { doc, actorUrl } = await readAccountState();
+  if (!doc) throw new Error('could not read this account\'s key on the pod');
   if (!isKeyEnvelope(doc)) throw new Error('this account\'s key is not locked — nothing to unlock');
   const rec = await unwrapKeys(doc, password);          // throws 'wrong password'
-  const actorUrl = `${cfg.remotePod}${cfg.root || AP_ROOT}ap/actor`;
   await cacheOpenedKeys(actorUrl, rec);
   await bootWorker();
 };
 
+// The same pane, for someone who no longer has the sign-up password: a new key,
+// wrapped under the password they use now, written over the pod's copy. Nothing
+// is unwrapped, so the old password is never needed. The boot that follows
+// publishes the new public key (agent.goActive → publishProfile).
+window.fedipodNewKey = async (password) => {
+  if (!password) throw new Error('Enter the password you use for your pod now.');
+  const { remote, urls, cfg, actorUrl } = await readAccountState();
+  const keys = await generateKeys();
+  keys.mintedFor = cfg.gateway?.frontActor || actorUrl;   // one key, one actor (signup.mjs)
+  await podState.writeWrappedKeys(remote, urls, await wrapKeys(keys, password));
+  await cacheOpenedKeys(actorUrl, keys);
+  await bootWorker();
+};
+
 // New account: create the account, pod, key, config and gateway attach (this
 // needs the password once), then redirect to the pod's login to establish the
 // durable session. The agent boots on return, reading config + key from the pod.
@@ -213,6 +233,25 @@ if (typeof document !== 'undefined') (async () => {
   };
   $('unlock-go')?.addEventListener('click', doUnlock);
   $('unlock-password')?.addEventListener('keydown', (e) => { if (e.key === 'Enter') doUnlock(); });
+  // The new-key path: one click reveals the confirmation, the second acts.
+  $('unlock-newkey')?.addEventListener('click', () => {
+    $('unlock-newkey-confirm').hidden = false;
+    $('unlock-password').focus();
+  });
+  const doNewKey = async () => {
+    $('unlock-error').textContent = '';
+    const btn = $('unlock-newkey-go'); btn.disabled = true;
+    try {
+      await window.fedipodNewKey($('unlock-password').value);
+      $('unlock-password').value = '';
+      location.href = '/admin/client/';
+    } catch (err) {
+      $('unlock-error').textContent = err.message || String(err);
+      btn.disabled = false;
+      $('unlock-password').select();
+    }
+  };
+  $('unlock-newkey-go')?.addEventListener('click', doNewKey);
 
 
   // The client shell's bar returns here for two things, and neither continues

package/web/app/dist/boot.js

@@ -33075,7 +33075,7 @@ var PodTransport = class {
    * says all of it. The parsed graph must mention the WebID before anything is
    * written back — an empty or foreign body must never become the new profile.
    */
-  async linkAccountInProfile({ actorUrl, accountName, kind = "person" }) {
+  async linkAccountInProfile({ actorUrl, accountName, kind = "person", outbox = null }) {
     const docUrl = this.webId.split("#")[0];
     const res = await this.fetch(docUrl, { headers: { accept: "text/turtle" } });
     if (res.status >= 400) throw new Error(`[${this.label}] GET ${docUrl} \u2192 ${res.status}`);
@@ -33091,10 +33091,16 @@ var PodTransport = class {
       [me, FOAF("account"), actor],
       [actor, RDF3("type"), FOAF("OnlineAccount")],
       [actor, RDF3("type"), kind === "group" ? AS("Group") : AS("Person")],
-      [actor, FOAF("accountName"), literal2(accountName)]
+      [actor, FOAF("accountName"), literal2(accountName)],
+      // Where a Solid client posts on this person's behalf (`as:outbox` on the
+      // WebID is what dokieli reads); only where a door exists to take it.
+      ...outbox ? [[me, AS("outbox"), namedNode2(outbox)]] : []
     ];
     const missing = wanted.filter(([s, p, o]) => !g.holds(s, p, o, doc));
-    const stale = g.statementsMatching(actor, FOAF("accountName"), null, doc).filter((st2) => st2.object.value !== accountName);
+    const stale = [
+      ...g.statementsMatching(actor, FOAF("accountName"), null, doc).filter((st2) => st2.object.value !== accountName),
+      ...outbox ? g.statementsMatching(me, AS("outbox"), null, doc).filter((st2) => st2.object.value !== outbox) : []
+    ];
     if (!missing.length && !stale.length) return false;
     const deletes = stale.map((st2) => [st2.subject, st2.predicate, st2.object]);
     if (await this.patchDocument(docUrl, missing, deletes)) return true;
@@ -33202,12 +33208,54 @@ var BrowserRemotePod = class extends PodTransport {
 // lib/pod/state.mjs
 var readWrappedKeys = (pod, urls) => pod.getJson(urls.state + "keys.json");
 var readConfig = (pod, urls) => pod.getJson(urls.state + "config.json");
+var writeWrappedKeys = (pod, urls, envelope) => pod.putJson(urls.state + "keys.json", envelope, "application/json");
 var writeConfig = (pod, urls, config) => pod.putJson(urls.state + "config.json", config, "application/json");
 async function provisionKey(pod, { stateUrl, keysUrl, envelope }) {
   await pod.setAcl(stateUrl, []);
   await pod.putJson(keysUrl, envelope, "application/json");
 }
 
+// lib/pod/root.mjs
+var OWNER_LOOKUP_MS = 5e3;
+var PUBLIC_DOC_MAX_BYTES = 1024 * 1024;
+async function podLayout(fetchImpl, providerOrigin, { timeoutMs = OWNER_LOOKUP_MS } = {}) {
+  let origin;
+  try {
+    origin = new URL(providerOrigin).origin;
+  } catch {
+    return null;
+  }
+  let res;
+  try {
+    res = await fetchImpl(
+      `${origin}/.well-known/solid`,
+      { headers: { accept: "text/turtle" }, signal: AbortSignal.timeout(timeoutMs) }
+    );
+  } catch {
+    return null;
+  }
+  if (res.status === 501) return "host";
+  if (res.status !== 200) return null;
+  let body = "";
+  try {
+    body = await readCapped(res, 64 * 1024);
+  } catch {
+    return null;
+  }
+  return /ns\/pim\/space#Storage|pim:Storage/u.test(body) ? "path" : null;
+}
+async function resourceExists(fetchImpl, url, { timeoutMs = OWNER_LOOKUP_MS } = {}) {
+  try {
+    const res = await fetchImpl(
+      url,
+      { headers: { accept: "application/activity+json" }, signal: AbortSignal.timeout(timeoutMs) }
+    );
+    return !!res && res.status === 200;
+  } catch {
+    return false;
+  }
+}
+
 // web/app/idb-kv.mjs
 var DB = "fedipod-accounts";
 function open() {
@@ -33310,6 +33358,7 @@ async function signUp(answers, { onStep = () => {
       acct.running("checking your pod");
       const head = await fetch(brought, { method: "HEAD" }).catch(() => null);
       if (!head || head.status >= 400) throw new Error(`the pod at ${brought} did not answer (HTTP ${head?.status || "no response"})`);
+      if (await resourceExists(fetch, actorUrlFor(brought))) throw new Error("The pod already hosts a FediPod account. If you want a second account, put it on a different pod.");
       prog.pod = brought;
       acct.skip("using the pod you brought");
     }
@@ -33450,36 +33499,6 @@ function podBaseOfWebId(webId) {
   return `${u.origin}${dir.endsWith("/") ? dir : dir + "/"}`;
 }
 
-// lib/pod/root.mjs
-var OWNER_LOOKUP_MS = 5e3;
-var PUBLIC_DOC_MAX_BYTES = 1024 * 1024;
-async function podLayout(fetchImpl, providerOrigin, { timeoutMs = OWNER_LOOKUP_MS } = {}) {
-  let origin;
-  try {
-    origin = new URL(providerOrigin).origin;
-  } catch {
-    return null;
-  }
-  let res;
-  try {
-    res = await fetchImpl(
-      `${origin}/.well-known/solid`,
-      { headers: { accept: "text/turtle" }, signal: AbortSignal.timeout(timeoutMs) }
-    );
-  } catch {
-    return null;
-  }
-  if (res.status === 501) return "host";
-  if (res.status !== 200) return null;
-  let body = "";
-  try {
-    body = await readCapped(res, 64 * 1024);
-  } catch {
-    return null;
-  }
-  return /ns\/pim\/space#Storage|pim:Storage/u.test(body) ? "path" : null;
-}
-
 // web/app/oidc-session.mjs
 var DB2 = "fedipod-oidc";
 var STORE = "session";
@@ -33725,8 +33744,7 @@ async function bootWorker({ reset = false } = {}) {
   worker.postMessage({ type: "boot", frontOrigin: location.origin });
   await booted;
 }
-window.fedipodUnlock = async (password) => {
-  if (!password) throw new Error("Enter your account password.");
+async function readAccountState() {
   const session = await getSession();
   if (!session) throw new Error("Sign in first.");
   const podFromWebId = podBaseOfWebId(session.webId);
@@ -33738,13 +33756,28 @@ window.fedipodUnlock = async (password) => {
     readConfig(remote, urls),
     readWrappedKeys(remote, urls)
   ]);
-  if (!cfg || !doc) throw new Error(`could not read this account's config and key under ${state}`);
+  if (!cfg) throw new Error(`could not read this account's config under ${state}`);
+  const actorUrl = `${cfg.remotePod}${cfg.root || AP_ROOT}ap/actor`;
+  return { remote, urls, cfg, doc, actorUrl };
+}
+window.fedipodUnlock = async (password) => {
+  if (!password) throw new Error("Enter your password.");
+  const { doc, actorUrl } = await readAccountState();
+  if (!doc) throw new Error("could not read this account's key on the pod");
   if (!isKeyEnvelope(doc)) throw new Error("this account's key is not locked \u2014 nothing to unlock");
   const rec = await unwrapKeys(doc, password);
-  const actorUrl = `${cfg.remotePod}${cfg.root || AP_ROOT}ap/actor`;
   await cacheOpenedKeys(actorUrl, rec);
   await bootWorker();
 };
+window.fedipodNewKey = async (password) => {
+  if (!password) throw new Error("Enter the password you use for your pod now.");
+  const { remote, urls, cfg, actorUrl } = await readAccountState();
+  const keys = await generateKeys();
+  keys.mintedFor = cfg.gateway?.frontActor || actorUrl;
+  await writeWrappedKeys(remote, urls, await wrapKeys(keys, password));
+  await cacheOpenedKeys(actorUrl, keys);
+  await bootWorker();
+};
 window.fedipodSignup = async ({ onStep, ...answers }) => {
   await signUp(answers, { onStep, frontOrigin: location.origin });
   const { authorizationUrl } = await beginLogin({ issuer: answers.issuer, redirectUri: REDIRECT });
@@ -33849,6 +33882,25 @@ if (typeof document !== "undefined") (async () => {
   $("unlock-password")?.addEventListener("keydown", (e) => {
     if (e.key === "Enter") doUnlock();
   });
+  $("unlock-newkey")?.addEventListener("click", () => {
+    $("unlock-newkey-confirm").hidden = false;
+    $("unlock-password").focus();
+  });
+  const doNewKey = async () => {
+    $("unlock-error").textContent = "";
+    const btn = $("unlock-newkey-go");
+    btn.disabled = true;
+    try {
+      await window.fedipodNewKey($("unlock-password").value);
+      $("unlock-password").value = "";
+      location.href = "/admin/client/";
+    } catch (err) {
+      $("unlock-error").textContent = err.message || String(err);
+      btn.disabled = false;
+      $("unlock-password").select();
+    }
+  };
+  $("unlock-newkey-go")?.addEventListener("click", doNewKey);
   if (params.has("signout") || params.has("add")) {
     if (params.has("signout")) {
       try {