holosphere 1.1.20 → 2.0.0-alpha1

package/src/storage/backends/activitypub/server.js

@@ -0,0 +1,653 @@
+/**
+ * Self-hosted ActivityPub server for HoloSphere
+ * Provides federation with Mastodon, Pleroma, and other ActivityPub servers
+ */
+
+import express from 'express';
+import crypto from 'crypto';
+import { createPersistentStorage } from '../../persistent-storage.js';
+
+const ACTIVITY_STREAMS_CONTEXT = 'https://www.w3.org/ns/activitystreams';
+const SECURITY_CONTEXT = 'https://w3id.org/security/v1';
+
+/**
+ * ActivityPub Server for HoloSphere
+ */
+export class ActivityPubServer {
+  constructor(config = {}) {
+    this.config = {
+      port: config.port || 3000,
+      domain: config.domain || 'localhost',
+      dataDir: config.dataDir,
+      ...config,
+    };
+
+    this.app = express();
+    this.storage = null;
+    this.actors = new Map();
+    this.subscriptions = new Map();
+    this.server = null;
+
+    // Generate server key pair for signing
+    this.serverKeyPair = null;
+  }
+
+  async start() {
+    // Initialize storage
+    this.storage = await createPersistentStorage('activitypub', {
+      dataDir: this.config.dataDir,
+    });
+
+    // Generate or load server keys
+    await this._initializeKeys();
+
+    // Middleware
+    this.app.use(express.json({
+      type: ['application/json', 'application/activity+json', 'application/ld+json'],
+    }));
+
+    // CORS for federation
+    this.app.use((req, res, next) => {
+      res.header('Access-Control-Allow-Origin', '*');
+      res.header('Access-Control-Allow-Headers', 'Content-Type, Accept, Signature, Date, Digest');
+      res.header('Access-Control-Allow-Methods', 'GET, POST, OPTIONS');
+      if (req.method === 'OPTIONS') {
+        return res.sendStatus(200);
+      }
+      next();
+    });
+
+    // WebFinger endpoint (required for federation discovery)
+    this.app.get('/.well-known/webfinger', this._handleWebFinger.bind(this));
+
+    // NodeInfo endpoints (optional but recommended)
+    this.app.get('/.well-known/nodeinfo', this._handleNodeInfoWellKnown.bind(this));
+    this.app.get('/nodeinfo/2.0', this._handleNodeInfo.bind(this));
+
+    // Actor endpoints
+    this.app.get('/actor/:name', this._handleGetActor.bind(this));
+    this.app.post('/actor/:name/inbox', this._handlePostInbox.bind(this));
+    this.app.get('/actor/:name/outbox', this._handleGetOutbox.bind(this));
+    this.app.post('/actor/:name/outbox', this._handlePostOutbox.bind(this));
+    this.app.get('/actor/:name/followers', this._handleGetFollowers.bind(this));
+    this.app.get('/actor/:name/following', this._handleGetFollowing.bind(this));
+
+    // Object endpoints (for HoloSphere data)
+    this.app.get('/objects/:appName/:holonId/:lensName', this._handleGetCollection.bind(this));
+    this.app.get('/objects/:appName/:holonId/:lensName/:key', this._handleGetObject.bind(this));
+
+    // API endpoints (for HoloSphere client)
+    this.app.post('/api/actors', this._handleCreateActor.bind(this));
+    this.app.post('/api/data', this._handleWriteData.bind(this));
+    this.app.get('/api/data/*', this._handleReadData.bind(this));
+    this.app.delete('/api/data/*', this._handleDeleteData.bind(this));
+
+    // SSE for real-time subscriptions
+    this.app.get('/subscribe', this._handleSubscribe.bind(this));
+
+    // Health check
+    this.app.get('/health', (req, res) => {
+      res.json({ status: 'ok', timestamp: Date.now() });
+    });
+
+    // Start server
+    return new Promise((resolve) => {
+      this.server = this.app.listen(this.config.port, () => {
+        console.log(`ActivityPub server listening on port ${this.config.port}`);
+        console.log(`Domain: ${this.config.domain}`);
+        resolve();
+      });
+    });
+  }
+
+  async _initializeKeys() {
+    // Try to load existing keys
+    const keysKey = '_server_keys';
+    const existingKeys = await this.storage.get(keysKey);
+
+    if (existingKeys) {
+      this.serverKeyPair = existingKeys;
+    } else {
+      // Generate new RSA key pair
+      const { publicKey, privateKey } = crypto.generateKeyPairSync('rsa', {
+        modulusLength: 2048,
+        publicKeyEncoding: { type: 'spki', format: 'pem' },
+        privateKeyEncoding: { type: 'pkcs8', format: 'pem' },
+      });
+
+      this.serverKeyPair = { publicKey, privateKey };
+      await this.storage.put(keysKey, this.serverKeyPair);
+    }
+  }
+
+  // ============ WebFinger ============
+
+  _handleWebFinger(req, res) {
+    const resource = req.query.resource;
+    if (!resource) {
+      return res.status(400).json({ error: 'resource parameter required' });
+    }
+
+    // Parse acct:user@domain
+    const match = resource.match(/^acct:(.+)@(.+)$/);
+    if (!match) {
+      return res.status(400).json({ error: 'invalid resource format' });
+    }
+
+    const username = match[1];
+    const domain = match[2];
+
+    // Check if domain matches (allow localhost variants)
+    const validDomains = [this.config.domain, 'localhost', `localhost:${this.config.port}`];
+    if (!validDomains.includes(domain)) {
+      return res.status(404).json({ error: 'user not found' });
+    }
+
+    const baseUrl = this._getBaseUrl();
+
+    res.set('Content-Type', 'application/jrd+json');
+    res.json({
+      subject: resource,
+      aliases: [`${baseUrl}/actor/${username}`],
+      links: [
+        {
+          rel: 'self',
+          type: 'application/activity+json',
+          href: `${baseUrl}/actor/${username}`,
+        },
+      ],
+    });
+  }
+
+  // ============ NodeInfo ============
+
+  _handleNodeInfoWellKnown(req, res) {
+    const baseUrl = this._getBaseUrl();
+    res.json({
+      links: [
+        {
+          rel: 'http://nodeinfo.diaspora.software/ns/schema/2.0',
+          href: `${baseUrl}/nodeinfo/2.0`,
+        },
+      ],
+    });
+  }
+
+  _handleNodeInfo(req, res) {
+    res.json({
+      version: '2.0',
+      software: {
+        name: 'holosphere-activitypub',
+        version: '1.0.0',
+      },
+      protocols: ['activitypub'],
+      usage: {
+        users: { total: this.actors.size },
+        localPosts: 0,
+      },
+      openRegistrations: true,
+    });
+  }
+
+  // ============ Actor Endpoints ============
+
+  async _handleGetActor(req, res) {
+    const { name } = req.params;
+    const baseUrl = this._getBaseUrl();
+
+    // Load or create actor
+    let actor = await this._getOrCreateActor(name);
+
+    const actorObject = {
+      '@context': [ACTIVITY_STREAMS_CONTEXT, SECURITY_CONTEXT],
+      id: `${baseUrl}/actor/${name}`,
+      type: 'Service',
+      preferredUsername: name,
+      name: `HoloSphere: ${name}`,
+      summary: `HoloSphere application: ${name}`,
+      inbox: `${baseUrl}/actor/${name}/inbox`,
+      outbox: `${baseUrl}/actor/${name}/outbox`,
+      followers: `${baseUrl}/actor/${name}/followers`,
+      following: `${baseUrl}/actor/${name}/following`,
+      publicKey: {
+        id: `${baseUrl}/actor/${name}#main-key`,
+        owner: `${baseUrl}/actor/${name}`,
+        publicKeyPem: actor.publicKey || this.serverKeyPair.publicKey,
+      },
+    };
+
+    res.set('Content-Type', 'application/activity+json');
+    res.json(actorObject);
+  }
+
+  async _handlePostInbox(req, res) {
+    const { name } = req.params;
+    const activity = req.body;
+
+    // TODO: Verify HTTP Signature for federation security
+    // For now, accept all activities
+
+    try {
+      await this._processIncomingActivity(name, activity);
+      res.status(202).send();
+    } catch (error) {
+      console.error('Inbox error:', error);
+      res.status(500).json({ error: error.message });
+    }
+  }
+
+  async _handleGetOutbox(req, res) {
+    const { name } = req.params;
+    const baseUrl = this._getBaseUrl();
+
+    // Get activities from storage
+    const activities = await this._getActorActivities(name);
+
+    const collection = {
+      '@context': ACTIVITY_STREAMS_CONTEXT,
+      id: `${baseUrl}/actor/${name}/outbox`,
+      type: 'OrderedCollection',
+      totalItems: activities.length,
+      orderedItems: activities,
+    };
+
+    res.set('Content-Type', 'application/activity+json');
+    res.json(collection);
+  }
+
+  async _handlePostOutbox(req, res) {
+    const { name } = req.params;
+    const activity = req.body;
+
+    // Verify authorization (API key or signature)
+    const apiKey = req.headers.authorization?.replace('Bearer ', '');
+    const actor = await this._getOrCreateActor(name);
+
+    if (actor.apiKey && actor.apiKey !== apiKey) {
+      return res.status(401).json({ error: 'unauthorized' });
+    }
+
+    try {
+      const result = await this._processOutgoingActivity(name, activity);
+      res.status(201).json(result);
+    } catch (error) {
+      console.error('Outbox error:', error);
+      res.status(500).json({ error: error.message });
+    }
+  }
+
+  async _handleGetFollowers(req, res) {
+    const { name } = req.params;
+    const baseUrl = this._getBaseUrl();
+
+    const actor = await this._getOrCreateActor(name);
+    const followers = actor.followers || [];
+
+    res.set('Content-Type', 'application/activity+json');
+    res.json({
+      '@context': ACTIVITY_STREAMS_CONTEXT,
+      id: `${baseUrl}/actor/${name}/followers`,
+      type: 'OrderedCollection',
+      totalItems: followers.length,
+      orderedItems: followers,
+    });
+  }
+
+  async _handleGetFollowing(req, res) {
+    const { name } = req.params;
+    const baseUrl = this._getBaseUrl();
+
+    const actor = await this._getOrCreateActor(name);
+    const following = actor.following || [];
+
+    res.set('Content-Type', 'application/activity+json');
+    res.json({
+      '@context': ACTIVITY_STREAMS_CONTEXT,
+      id: `${baseUrl}/actor/${name}/following`,
+      type: 'OrderedCollection',
+      totalItems: following.length,
+      orderedItems: following,
+    });
+  }
+
+  // ============ Object Endpoints ============
+
+  async _handleGetCollection(req, res) {
+    const { appName, holonId, lensName } = req.params;
+    const path = `${appName}/${holonId}/${lensName}`;
+    const baseUrl = this._getBaseUrl();
+
+    const items = await this._getDataByPrefix(path);
+
+    const collection = {
+      '@context': ACTIVITY_STREAMS_CONTEXT,
+      id: `${baseUrl}/objects/${path}`,
+      type: 'OrderedCollection',
+      totalItems: items.length,
+      orderedItems: items.map(item => this._dataToObject(item, path)),
+    };
+
+    res.set('Content-Type', 'application/activity+json');
+    res.json(collection);
+  }
+
+  async _handleGetObject(req, res) {
+    const { appName, holonId, lensName, key } = req.params;
+    const path = `${appName}/${holonId}/${lensName}/${key}`;
+
+    const data = await this.storage.get(`data:${path}`);
+    if (!data || data._deleted) {
+      return res.status(404).json({ error: 'not found' });
+    }
+
+    res.set('Content-Type', 'application/activity+json');
+    res.json(this._dataToObject(data, path));
+  }
+
+  // ============ API Endpoints ============
+
+  async _handleCreateActor(req, res) {
+    const { name, apiKey } = req.body;
+
+    if (!name) {
+      return res.status(400).json({ error: 'name required' });
+    }
+
+    const actor = await this._getOrCreateActor(name);
+    if (apiKey) {
+      actor.apiKey = apiKey;
+      await this.storage.put(`actor:${name}`, actor);
+    }
+
+    res.json({
+      name,
+      id: `${this._getBaseUrl()}/actor/${name}`,
+      publicKey: actor.publicKey,
+    });
+  }
+
+  async _handleWriteData(req, res) {
+    const { path, data, actorName } = req.body;
+
+    if (!path || !data) {
+      return res.status(400).json({ error: 'path and data required' });
+    }
+
+    // Store data
+    const record = {
+      ...data,
+      _meta: {
+        ...(data._meta || {}),
+        timestamp: Date.now(),
+        path,
+      },
+    };
+
+    await this.storage.put(`data:${path}`, record);
+
+    // Create activity
+    if (actorName) {
+      await this._createActivity(actorName, 'Create', record, path);
+    }
+
+    // Notify subscribers
+    this._notifySubscribers(path, record);
+
+    res.json({ success: true, path });
+  }
+
+  async _handleReadData(req, res) {
+    const path = req.params[0];
+
+    // Check if this is a prefix query
+    const isPrefix = path.split('/').length <= 3;
+
+    if (isPrefix) {
+      const items = await this._getDataByPrefix(path);
+      res.json(items);
+    } else {
+      const data = await this.storage.get(`data:${path}`);
+      if (!data || data._deleted) {
+        return res.status(404).json({ error: 'not found' });
+      }
+      res.json(data);
+    }
+  }
+
+  async _handleDeleteData(req, res) {
+    const path = req.params[0];
+    const actorName = req.query.actor;
+
+    // Tombstone delete
+    const existing = await this.storage.get(`data:${path}`);
+    if (existing) {
+      const tombstone = {
+        id: existing.id,
+        _deleted: true,
+        _deletedAt: Date.now(),
+      };
+      await this.storage.put(`data:${path}`, tombstone);
+
+      // Create delete activity
+      if (actorName) {
+        await this._createActivity(actorName, 'Delete', { id: path }, path);
+      }
+
+      // Notify subscribers
+      this._notifySubscribers(path, tombstone);
+    }
+
+    res.json({ success: true });
+  }
+
+  // ============ Subscriptions ============
+
+  _handleSubscribe(req, res) {
+    const path = req.query.path || '';
+
+    // Set up SSE
+    res.writeHead(200, {
+      'Content-Type': 'text/event-stream',
+      'Cache-Control': 'no-cache',
+      'Connection': 'keep-alive',
+    });
+
+    // Send initial ping
+    res.write('event: ping\ndata: connected\n\n');
+
+    // Register subscription
+    const subId = crypto.randomUUID();
+    this.subscriptions.set(subId, { path, res });
+
+    // Clean up on close
+    req.on('close', () => {
+      this.subscriptions.delete(subId);
+    });
+  }
+
+  _notifySubscribers(path, data) {
+    for (const [id, sub] of this.subscriptions) {
+      if (path.startsWith(sub.path)) {
+        try {
+          sub.res.write(`event: update\ndata: ${JSON.stringify({ path, data })}\n\n`);
+        } catch (e) {
+          this.subscriptions.delete(id);
+        }
+      }
+    }
+  }
+
+  // ============ Helper Methods ============
+
+  _getBaseUrl() {
+    const protocol = this.config.protocol || 'http';
+    const port = this.config.port;
+    const domain = this.config.domain;
+
+    if (domain === 'localhost' || domain.includes(':')) {
+      return `${protocol}://${domain}`;
+    }
+    if (port === 80 || port === 443) {
+      return `${protocol}://${domain}`;
+    }
+    return `${protocol}://${domain}:${port}`;
+  }
+
+  async _getOrCreateActor(name) {
+    // Check cache
+    if (this.actors.has(name)) {
+      return this.actors.get(name);
+    }
+
+    // Check storage
+    let actor = await this.storage.get(`actor:${name}`);
+    if (!actor) {
+      // Create new actor
+      const { publicKey, privateKey } = crypto.generateKeyPairSync('rsa', {
+        modulusLength: 2048,
+        publicKeyEncoding: { type: 'spki', format: 'pem' },
+        privateKeyEncoding: { type: 'pkcs8', format: 'pem' },
+      });
+
+      actor = {
+        name,
+        publicKey,
+        privateKey,
+        followers: [],
+        following: [],
+        createdAt: Date.now(),
+      };
+
+      await this.storage.put(`actor:${name}`, actor);
+    }
+
+    this.actors.set(name, actor);
+    return actor;
+  }
+
+  async _processIncomingActivity(actorName, activity) {
+    const type = activity.type;
+
+    switch (type) {
+      case 'Follow':
+        await this._handleFollow(actorName, activity);
+        break;
+      case 'Undo':
+        if (activity.object?.type === 'Follow') {
+          await this._handleUnfollow(actorName, activity);
+        }
+        break;
+      case 'Create':
+      case 'Update':
+      case 'Delete':
+        // Store federated content
+        await this._storeFederatedActivity(actorName, activity);
+        break;
+    }
+
+    // Store activity
+    await this.storage.put(`inbox:${actorName}:${Date.now()}`, activity);
+  }
+
+  async _processOutgoingActivity(actorName, activity) {
+    const baseUrl = this._getBaseUrl();
+
+    // Assign ID if not present
+    if (!activity.id) {
+      activity.id = `${baseUrl}/activities/${crypto.randomUUID()}`;
+    }
+
+    // Set actor if not present
+    if (!activity.actor) {
+      activity.actor = `${baseUrl}/actor/${actorName}`;
+    }
+
+    // Store activity
+    await this.storage.put(`outbox:${actorName}:${Date.now()}`, activity);
+
+    // Handle based on type
+    if (activity.type === 'Create' && activity.object?.['holosphere:data']) {
+      const data = activity.object['holosphere:data'];
+      const path = activity.object['holosphere:path'];
+      if (path) {
+        await this.storage.put(`data:${path}`, data);
+        this._notifySubscribers(path, data);
+      }
+    }
+
+    return activity;
+  }
+
+  async _handleFollow(actorName, activity) {
+    const actor = await this._getOrCreateActor(actorName);
+    const follower = activity.actor;
+
+    if (!actor.followers.includes(follower)) {
+      actor.followers.push(follower);
+      await this.storage.put(`actor:${actorName}`, actor);
+    }
+
+    // Send Accept response
+    // TODO: Implement federation delivery
+  }
+
+  async _handleUnfollow(actorName, activity) {
+    const actor = await this._getOrCreateActor(actorName);
+    const follower = activity.actor;
+
+    actor.followers = actor.followers.filter(f => f !== follower);
+    await this.storage.put(`actor:${actorName}`, actor);
+  }
+
+  async _storeFederatedActivity(actorName, activity) {
+    // Store federated content for potential use
+    const key = `federated:${actorName}:${Date.now()}`;
+    await this.storage.put(key, activity);
+  }
+
+  async _getActorActivities(actorName) {
+    const activities = await this.storage.getAll(`outbox:${actorName}:`);
+    return activities.sort((a, b) => (b.published || 0) - (a.published || 0));
+  }
+
+  async _getDataByPrefix(prefix) {
+    const all = await this.storage.getAll(`data:${prefix}`);
+    return all.filter(item => item && !item._deleted);
+  }
+
+  async _createActivity(actorName, type, data, path) {
+    const baseUrl = this._getBaseUrl();
+    const activity = {
+      '@context': ACTIVITY_STREAMS_CONTEXT,
+      id: `${baseUrl}/activities/${crypto.randomUUID()}`,
+      type,
+      actor: `${baseUrl}/actor/${actorName}`,
+      published: new Date().toISOString(),
+      object: this._dataToObject(data, path),
+    };
+
+    await this.storage.put(`outbox:${actorName}:${Date.now()}`, activity);
+    return activity;
+  }
+
+  _dataToObject(data, path) {
+    const baseUrl = this._getBaseUrl();
+    return {
+      '@context': ACTIVITY_STREAMS_CONTEXT,
+      id: `${baseUrl}/objects/${path}`,
+      type: 'Note',
+      content: JSON.stringify(data),
+      'holosphere:data': data,
+      'holosphere:path': path,
+      published: data._meta?.timestamp ? new Date(data._meta.timestamp).toISOString() : new Date().toISOString(),
+    };
+  }
+
+  stop() {
+    if (this.server) {
+      this.server.close();
+    }
+  }
+}
+
+export default ActivityPubServer;