javascript-solid-server 0.0.55 → 0.0.57

package/.claude/settings.local.json

@@ -202,7 +202,12 @@
       "Bash(webledgers show:*)",
       "Bash(webledgers set-balance:*)",
       "Bash(ssh melvincarvalho.com \"pm2 list | grep jss\")",
-      "Bash(ssh melvincarvalho.com \"cd /home/ubuntu/jss && git pull && pm2 restart jss\")"
+      "Bash(ssh melvincarvalho.com \"cd /home/ubuntu/jss && git pull && pm2 restart jss\")",
+      "WebFetch(domain:registry.npmjs.org)",
+      "WebFetch(domain:solid-chat.com)",
+      "WebFetch(domain:developer.chrome.com)",
+      "WebFetch(domain:css-tricks.com)",
+      "Bash(node bin/jss.js:*)"
     ]
   }
 }

package/README.md

@@ -6,7 +6,7 @@ A minimal, fast, JSON-LD native Solid server.
 
 ## Features
 
-### Implemented (v0.0.42)
+### Implemented (v0.0.57)
 
 - **LDP CRUD Operations** - GET, PUT, POST, DELETE, HEAD
 - **N3 Patch** - Solid's native patch format for RDF updates
@@ -29,6 +29,8 @@ A minimal, fast, JSON-LD native Solid server.
 - **Content Negotiation** - Turtle <-> JSON-LD conversion, including HTML data islands
 - **CORS Support** - Full cross-origin resource sharing
 - **Git HTTP Backend** - Clone and push to containers via `git` protocol
+- **Invite-Only Registration** - CLI-managed invite codes for controlled signups
+- **Storage Quotas** - Per-user storage limits with CLI management
 - **Security** - Blocks access to dotfiles (`.git/`, `.env`, etc.) except Solid-specific ones
 
 ### HTTP Methods
@@ -76,6 +78,8 @@ jss start --port 8443 --ssl-key ./key.pem --ssl-cert ./cert.pem
 ```bash
 jss start [options]    # Start the server
 jss init [options]     # Initialize configuration
+jss invite <cmd>       # Manage invite codes (create, list, revoke)
+jss quota <cmd>        # Manage storage quotas (set, show, reconcile)
 jss --help             # Show help
 ```
 
@@ -99,6 +103,8 @@ jss --help             # Show help
 | `--mashlib-cdn` | Enable Mashlib (CDN mode) | false |
 | `--mashlib-version <ver>` | Mashlib CDN version | 2.0.0 |
 | `--git` | Enable Git HTTP backend | false |
+| `--invite-only` | Require invite code for registration | false |
+| `--default-quota <size>` | Default storage quota per pod (e.g., 50MB) | 50MB |
 | `-q, --quiet` | Suppress logs | false |
 
 ### Environment Variables
@@ -113,6 +119,8 @@ export JSS_CONNEG=true
 export JSS_SUBDOMAINS=true
 export JSS_BASE_DOMAIN=example.com
 export JSS_MASHLIB=true
+export JSS_INVITE_ONLY=true
+export JSS_DEFAULT_QUOTA=100MB
 jss start
 ```
 
@@ -379,6 +387,87 @@ git add .acl && git commit -m "Add ACL"
 
 See [git-credential-nostr](https://github.com/JavaScriptSolidServer/git-credential-nostr) for more details.
 
+## Invite-Only Registration
+
+Control who can create accounts by requiring invite codes:
+
+```bash
+jss start --idp --invite-only
+```
+
+### Managing Invite Codes
+
+```bash
+# Create a single-use invite
+jss invite create
+# Created invite code: ABCD1234
+
+# Create multi-use invite with note
+jss invite create -u 5 -n "For team members"
+
+# List all active invites
+jss invite list
+#   CODE        USES     CREATED      NOTE
+#   -------------------------------------------------------
+#   ABCD1234    0/1      2026-01-03
+#   EFGH5678    2/5      2026-01-03   For team members
+
+# Revoke an invite
+jss invite revoke ABCD1234
+```
+
+### How It Works
+
+| Mode | Registration | Pod Creation |
+|------|--------------|--------------|
+| Open (default) | Anyone can register | Anyone can create pods |
+| Invite-only | Requires valid invite code | Via registration only |
+
+When `--invite-only` is enabled:
+- The registration page shows an "Invite Code" field
+- Invalid or expired codes are rejected with an error
+- Each use decrements the invite's remaining uses
+- Depleted invites are automatically removed
+
+Invite codes are stored in `.server/invites.json` in your data directory.
+
+## Storage Quotas
+
+Limit storage per pod to prevent abuse and manage resources:
+
+```bash
+jss start --default-quota 50MB
+```
+
+### Managing Quotas
+
+```bash
+# Set quota for a user (overrides default)
+jss quota set alice 100MB
+
+# Show quota info
+jss quota show alice
+#   alice:
+#     Used:  12.5 MB
+#     Limit: 100 MB
+#     Free:  87.5 MB
+#     Usage: 12%
+
+# Recalculate from actual disk usage
+jss quota reconcile alice
+```
+
+### How It Works
+
+- Quotas are tracked incrementally on PUT, POST, and DELETE operations
+- When quota is exceeded, the server returns HTTP 507 Insufficient Storage
+- Each pod stores its quota in `/{pod}/.quota.json`
+- Use `reconcile` to fix quota drift from manual file changes
+
+### Size Formats
+
+Supported formats: `50MB`, `1GB`, `500KB`, `1TB`
+
 ## Authentication
 
 ### Simple Tokens (Development)
@@ -640,7 +729,8 @@ src/
 │   ├── container.js      # POST, pod creation
 │   └── git.js            # Git HTTP backend
 ├── storage/
-│   └── filesystem.js     # File operations
+│   ├── filesystem.js     # File operations
+│   └── quota.js          # Storage quota management
 ├── auth/
 │   ├── middleware.js     # Auth hook
 │   ├── token.js          # Simple token auth
@@ -668,7 +758,8 @@ src/
 │   ├── accounts.js       # User account management
 │   ├── keys.js           # JWKS key management
 │   ├── interactions.js   # Login/consent handlers
-│   └── views.js          # HTML templates
+│   ├── views.js          # HTML templates
+│   └── invites.js        # Invite code management
 ├── rdf/
 │   ├── turtle.js         # Turtle <-> JSON-LD
 │   └── conneg.js         # Content negotiation

package/bin/jss.js

@@ -11,6 +11,9 @@
 import { Command } from 'commander';
 import { createServer } from '../src/server.js';
 import { loadConfig, saveConfig, printConfig, defaults } from '../src/config.js';
+import { createInvite, listInvites, revokeInvite } from '../src/idp/invites.js';
+import { setQuotaLimit, getQuotaInfo, reconcileQuota, formatBytes } from '../src/storage/quota.js';
+import { parseSize } from '../src/config.js';
 import fs from 'fs-extra';
 import path from 'path';
 import { fileURLToPath } from 'url';
@@ -56,6 +59,8 @@ program
   .option('--mashlib-version <version>', 'Mashlib version for CDN mode (default: 2.0.0)')
   .option('--git', 'Enable Git HTTP backend (clone/push support)')
   .option('--no-git', 'Disable Git HTTP backend')
+  .option('--invite-only', 'Require invite code for registration')
+  .option('--no-invite-only', 'Allow open registration')
   .option('-q, --quiet', 'Suppress log output')
   .option('--print-config', 'Print configuration and exit')
   .action(async (options) => {
@@ -98,6 +103,7 @@ program
         mashlibCdn: config.mashlibCdn,
         mashlibVersion: config.mashlibVersion,
         git: config.git,
+        inviteOnly: config.inviteOnly,
       });
 
       await server.listen({ port: config.port, host: config.host });
@@ -117,6 +123,7 @@ program
           console.log(`  Mashlib: local (data browser enabled)`);
         }
         if (config.git) console.log('  Git: enabled (clone/push support)');
+        if (config.inviteOnly) console.log('  Registration: invite-only');
         console.log('\n  Press Ctrl+C to stop\n');
       }
 
@@ -204,6 +211,190 @@ program
     console.log('\nRun `jss start` to start the server.\n');
   });
 
+/**
+ * Invite command - manage invite codes
+ */
+const inviteCmd = program
+  .command('invite')
+  .description('Manage invite codes for registration');
+
+inviteCmd
+  .command('create')
+  .description('Create a new invite code')
+  .option('-u, --uses <number>', 'Maximum uses (default: 1)', parseInt, 1)
+  .option('-n, --note <text>', 'Optional note/description')
+  .option('-r, --root <path>', 'Data directory')
+  .action(async (options) => {
+    try {
+      // Set DATA_ROOT if provided
+      if (options.root) {
+        process.env.DATA_ROOT = path.resolve(options.root);
+      }
+
+      const { code, invite } = await createInvite({
+        maxUses: options.uses,
+        note: options.note || ''
+      });
+
+      console.log(`\nCreated invite code: ${code}`);
+      if (invite.maxUses > 1) {
+        console.log(`Uses: 0/${invite.maxUses}`);
+      }
+      if (invite.note) {
+        console.log(`Note: ${invite.note}`);
+      }
+      console.log('');
+    } catch (err) {
+      console.error(`Error: ${err.message}`);
+      process.exit(1);
+    }
+  });
+
+inviteCmd
+  .command('list')
+  .description('List all invite codes')
+  .option('-r, --root <path>', 'Data directory')
+  .action(async (options) => {
+    try {
+      // Set DATA_ROOT if provided
+      if (options.root) {
+        process.env.DATA_ROOT = path.resolve(options.root);
+      }
+
+      const invites = await listInvites();
+
+      if (invites.length === 0) {
+        console.log('\nNo invite codes found.\n');
+        return;
+      }
+
+      console.log('\n  CODE        USES     CREATED      NOTE');
+      console.log('  ' + '-'.repeat(55));
+
+      for (const invite of invites) {
+        const uses = `${invite.uses}/${invite.maxUses}`.padEnd(8);
+        const created = invite.created.split('T')[0];
+        const note = invite.note || '';
+        console.log(`  ${invite.code}    ${uses} ${created}   ${note}`);
+      }
+      console.log('');
+    } catch (err) {
+      console.error(`Error: ${err.message}`);
+      process.exit(1);
+    }
+  });
+
+inviteCmd
+  .command('revoke <code>')
+  .description('Revoke an invite code')
+  .option('-r, --root <path>', 'Data directory')
+  .action(async (code, options) => {
+    try {
+      // Set DATA_ROOT if provided
+      if (options.root) {
+        process.env.DATA_ROOT = path.resolve(options.root);
+      }
+
+      const success = await revokeInvite(code);
+
+      if (success) {
+        console.log(`\nRevoked invite code: ${code.toUpperCase()}\n`);
+      } else {
+        console.log(`\nInvite code not found: ${code.toUpperCase()}\n`);
+        process.exit(1);
+      }
+    } catch (err) {
+      console.error(`Error: ${err.message}`);
+      process.exit(1);
+    }
+  });
+
+/**
+ * Quota command - manage storage quotas
+ */
+const quotaCmd = program
+  .command('quota')
+  .description('Manage storage quotas for pods');
+
+quotaCmd
+  .command('set <username> <size>')
+  .description('Set quota limit for a user (e.g., 50MB, 1GB)')
+  .option('-r, --root <path>', 'Data directory')
+  .action(async (username, size, options) => {
+    try {
+      if (options.root) {
+        process.env.DATA_ROOT = path.resolve(options.root);
+      }
+
+      const bytes = parseSize(size);
+      if (bytes === 0) {
+        console.error('Invalid size format. Use e.g., 50MB, 1GB');
+        process.exit(1);
+      }
+
+      const quota = await setQuotaLimit(username, bytes);
+      console.log(`\nQuota set for ${username}: ${formatBytes(quota.limit)}`);
+      console.log(`Current usage: ${formatBytes(quota.used)} (${Math.round(quota.used / quota.limit * 100)}%)\n`);
+    } catch (err) {
+      console.error(`Error: ${err.message}`);
+      process.exit(1);
+    }
+  });
+
+quotaCmd
+  .command('show <username>')
+  .description('Show quota info for a user')
+  .option('-r, --root <path>', 'Data directory')
+  .action(async (username, options) => {
+    try {
+      if (options.root) {
+        process.env.DATA_ROOT = path.resolve(options.root);
+      }
+
+      const quota = await getQuotaInfo(username);
+
+      if (quota.limit === 0) {
+        console.log(`\n${username}: No quota set (unlimited)\n`);
+      } else {
+        console.log(`\n${username}:`);
+        console.log(`  Used:  ${formatBytes(quota.used)}`);
+        console.log(`  Limit: ${formatBytes(quota.limit)}`);
+        console.log(`  Free:  ${formatBytes(quota.limit - quota.used)}`);
+        console.log(`  Usage: ${quota.percent}%\n`);
+      }
+    } catch (err) {
+      console.error(`Error: ${err.message}`);
+      process.exit(1);
+    }
+  });
+
+quotaCmd
+  .command('reconcile <username>')
+  .description('Recalculate quota usage from actual disk usage')
+  .option('-r, --root <path>', 'Data directory')
+  .action(async (username, options) => {
+    try {
+      if (options.root) {
+        process.env.DATA_ROOT = path.resolve(options.root);
+      }
+
+      console.log(`Calculating actual disk usage for ${username}...`);
+      const quota = await reconcileQuota(username);
+
+      if (quota.limit === 0) {
+        console.log(`\n${username}: No quota configured\n`);
+      } else {
+        console.log(`\nReconciled ${username}:`);
+        console.log(`  Used:  ${formatBytes(quota.used)}`);
+        console.log(`  Limit: ${formatBytes(quota.limit)}`);
+        console.log(`  Usage: ${Math.round(quota.used / quota.limit * 100)}%\n`);
+      }
+    } catch (err) {
+      console.error(`Error: ${err.message}`);
+      process.exit(1);
+    }
+  });
+
 /**
  * Helper: Prompt for input
  */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "javascript-solid-server",
-  "version": "0.0.55",
+  "version": "0.0.57",
   "description": "A minimal, fast Solid server",
   "main": "src/index.js",
   "type": "module",

package/src/config.js

@@ -42,6 +42,15 @@ export const defaults = {
   mashlibCdn: false,
   mashlibVersion: '2.0.0',
 
+  // Git HTTP backend
+  git: false,
+
+  // Invite-only registration
+  inviteOnly: false,
+
+  // Storage quota (bytes) - 50MB default
+  defaultQuota: 50 * 1024 * 1024,
+
   // Logging
   logger: true,
   quiet: false,
@@ -71,8 +80,24 @@ const envMap = {
   JSS_MASHLIB: 'mashlib',
   JSS_MASHLIB_CDN: 'mashlibCdn',
   JSS_MASHLIB_VERSION: 'mashlibVersion',
+  JSS_GIT: 'git',
+  JSS_INVITE_ONLY: 'inviteOnly',
+  JSS_DEFAULT_QUOTA: 'defaultQuota',
 };
 
+/**
+ * Parse a size string like "50MB" or "1GB" to bytes
+ */
+export function parseSize(str) {
+  const match = str.match(/^(\d+(?:\.\d+)?)\s*(B|KB|MB|GB|TB)?$/i);
+  if (!match) return parseInt(str, 10) || 0;
+
+  const num = parseFloat(match[1]);
+  const unit = (match[2] || 'B').toUpperCase();
+  const multipliers = { B: 1, KB: 1024, MB: 1024**2, GB: 1024**3, TB: 1024**4 };
+  return Math.floor(num * (multipliers[unit] || 1));
+}
+
 /**
  * Parse a value from environment variable string
  */
@@ -88,6 +113,11 @@ function parseEnvValue(value, key) {
     return parseInt(value, 10);
   }
 
+  // Size values (quota)
+  if (key === 'defaultQuota') {
+    return parseSize(value);
+  }
+
   return value;
 }
 

package/src/handlers/container.js

@@ -1,6 +1,7 @@
 import * as storage from '../storage/filesystem.js';
+import { initializeQuota, checkQuota, updateQuotaUsage } from '../storage/quota.js';
 import { getAllHeaders } from '../ldp/headers.js';
-import { isContainer, getEffectiveUrlPath } from '../utils/url.js';
+import { isContainer, getEffectiveUrlPath, getPodName } from '../utils/url.js';
 import { generateProfile, generatePreferences, generateTypeIndex, serialize } from '../webid/profile.js';
 import { generateOwnerAcl, generatePrivateAcl, generateInboxAcl, generatePublicFolderAcl, serializeAcl } from '../wac/parser.js';
 import { createToken } from '../auth/token.js';
@@ -106,7 +107,21 @@ export async function handlePost(request, reply) {
       }
     }
 
+    // Check storage quota before writing
+    const podName = getPodName(request);
+    if (podName) {
+      const { allowed, error } = await checkQuota(podName, content.length, request.defaultQuota || 0);
+      if (!allowed) {
+        return reply.code(507).send({ error: 'Insufficient Storage', message: error });
+      }
+    }
+
     success = await storage.write(newStoragePath, content);
+
+    // Update quota usage after successful write
+    if (success && podName) {
+      await updateQuotaUsage(podName, content.length);
+    }
   }
 
   if (!success) {
@@ -139,8 +154,9 @@ export async function handlePost(request, reply) {
  * @param {string} webId - User's WebID URI
  * @param {string} podUri - Pod root URI (e.g., https://alice.example.com/ or https://example.com/alice/)
  * @param {string} issuer - OIDC issuer URI
+ * @param {number} defaultQuota - Default storage quota in bytes (optional)
  */
-export async function createPodStructure(name, webId, podUri, issuer) {
+export async function createPodStructure(name, webId, podUri, issuer, defaultQuota = 0) {
   const podPath = `/${name}/`;
 
   // Create pod directory structure
@@ -193,6 +209,11 @@ export async function createPodStructure(name, webId, podUri, issuer) {
   const profileAcl = generatePublicFolderAcl(`${podUri}profile/`, webId);
   await storage.write(`${podPath}profile/.acl`, serializeAcl(profileAcl));
 
+  // Initialize storage quota if configured
+  if (defaultQuota > 0) {
+    await initializeQuota(name, defaultQuota);
+  }
+
   return { podPath, podUri };
 }
 

package/src/handlers/resource.js

@@ -1,7 +1,8 @@
 import * as storage from '../storage/filesystem.js';
+import { checkQuota, updateQuotaUsage } from '../storage/quota.js';
 import { getAllHeaders, getNotFoundHeaders } from '../ldp/headers.js';
 import { generateContainerJsonLd, serializeJsonLd } from '../ldp/container.js';
-import { isContainer, getContentType, isRdfContentType, getEffectiveUrlPath, safeJsonParse } from '../utils/url.js';
+import { isContainer, getContentType, isRdfContentType, getEffectiveUrlPath, safeJsonParse, getPodName } from '../utils/url.js';
 import { parseN3Patch, applyN3Patch, validatePatch } from '../patch/n3-patch.js';
 import { parseSparqlUpdate, applySparqlUpdate } from '../patch/sparql-update.js';
 import {
@@ -504,11 +505,28 @@ export async function handlePut(request, reply) {
     }
   }
 
+  // Check storage quota before writing
+  const podName = getPodName(request);
+  const oldSize = stats?.size || 0;
+  const sizeDelta = content.length - oldSize;
+
+  if (podName && sizeDelta > 0) {
+    const { allowed, error } = await checkQuota(podName, sizeDelta, request.defaultQuota || 0);
+    if (!allowed) {
+      return reply.code(507).send({ error: 'Insufficient Storage', message: error });
+    }
+  }
+
   const success = await storage.write(storagePath, content);
   if (!success) {
     return reply.code(500).send({ error: 'Write failed' });
   }
 
+  // Update quota usage after successful write
+  if (podName && sizeDelta !== 0) {
+    await updateQuotaUsage(podName, sizeDelta);
+  }
+
   const origin = request.headers.origin;
   const headers = getAllHeaders({ isContainer: false, origin, resourceUrl, connegEnabled });
   headers['Location'] = resourceUrl;
@@ -549,11 +567,20 @@ export async function handleDelete(request, reply) {
     }
   }
 
+  // Get file size before deletion for quota update
+  const fileSize = stats.size || 0;
+
   const success = await storage.remove(storagePath);
   if (!success) {
     return reply.code(500).send({ error: 'Delete failed' });
   }
 
+  // Update quota usage (subtract deleted file size)
+  const podName = getPodName(request);
+  if (podName && fileSize > 0) {
+    await updateQuotaUsage(podName, -fileSize);
+  }
+
   const origin = request.headers.origin;
   const headers = getAllHeaders({ isContainer: false, origin, resourceUrl });
   Object.entries(headers).forEach(([k, v]) => reply.header(k, v));

package/src/idp/index.js

@@ -27,7 +27,7 @@ import { addTrustedIssuer } from '../auth/solid-oidc.js';
  * @param {string} options.issuer - The issuer URL
  */
 export async function idpPlugin(fastify, options) {
-  const { issuer } = options;
+  const { issuer, inviteOnly = false } = options;
 
   if (!issuer) {
     throw new Error('IdP requires issuer URL');
@@ -274,7 +274,7 @@ export async function idpPlugin(fastify, options) {
 
   // Registration routes
   fastify.get('/idp/register', async (request, reply) => {
-    return handleRegisterGet(request, reply);
+    return handleRegisterGet(request, reply, inviteOnly);
   });
 
   // Registration - rate limited to prevent spam accounts
@@ -287,7 +287,7 @@ export async function idpPlugin(fastify, options) {
       }
     }
   }, async (request, reply) => {
-    return handleRegisterPost(request, reply, issuer);
+    return handleRegisterPost(request, reply, issuer, inviteOnly);
   });
 
   fastify.log.info(`IdP initialized with issuer: ${issuer}`);

package/src/idp/interactions.js

@@ -7,6 +7,7 @@ import { authenticate, findById, createAccount } from './accounts.js';
 import { loginPage, consentPage, errorPage, registerPage } from './views.js';
 import * as storage from '../storage/filesystem.js';
 import { createPodStructure } from '../handlers/container.js';
+import { validateInvite } from './invites.js';
 
 // Security: Maximum body size for IdP form submissions (1MB)
 const MAX_BODY_SIZE = 1024 * 1024;
@@ -309,16 +310,16 @@ export async function handleAbort(request, reply, provider) {
  * Handle GET /idp/register
  * Shows registration page
  */
-export async function handleRegisterGet(request, reply) {
+export async function handleRegisterGet(request, reply, inviteOnly = false) {
   const uid = request.query.uid || null;
-  return reply.type('text/html').send(registerPage(uid));
+  return reply.type('text/html').send(registerPage(uid, null, null, inviteOnly));
 }
 
 /**
  * Handle POST /idp/register
  * Creates account and pod
  */
-export async function handleRegisterPost(request, reply, issuer) {
+export async function handleRegisterPost(request, reply, issuer, inviteOnly = false) {
   const uid = request.query.uid || null;
 
   // Parse body
@@ -328,7 +329,7 @@ export async function handleRegisterPost(request, reply, issuer) {
   if (Buffer.isBuffer(parsedBody)) {
     // Security: check body size
     if (parsedBody.length > MAX_BODY_SIZE) {
-      return reply.code(413).type('text/html').send(registerPage(null, 'Request body exceeds maximum size.'));
+      return reply.code(413).type('text/html').send(registerPage(null, 'Request body exceeds maximum size.', null, inviteOnly));
     }
     const bodyStr = parsedBody.toString();
     if (contentType.includes('application/json')) {
@@ -344,32 +345,39 @@ export async function handleRegisterPost(request, reply, issuer) {
   } else if (typeof parsedBody === 'string') {
     // Security: check body size
     if (parsedBody.length > MAX_BODY_SIZE) {
-      return reply.code(413).type('text/html').send(registerPage(null, 'Request body exceeds maximum size.'));
+      return reply.code(413).type('text/html').send(registerPage(null, 'Request body exceeds maximum size.', null, inviteOnly));
     }
     const params = new URLSearchParams(parsedBody);
     parsedBody = Object.fromEntries(params.entries());
   }
 
-  const { username, password, confirmPassword } = parsedBody;
+  const { username, password, confirmPassword, invite } = parsedBody;
+
+  // Validate invite code if invite-only mode is enabled
+  if (inviteOnly) {
+    const inviteResult = await validateInvite(invite);
+    if (!inviteResult.valid) {
+      return reply.code(403).type('text/html').send(registerPage(uid, inviteResult.error, null, inviteOnly));
+    }
+  }
 
   // Validate input
   if (!username || !password) {
-    return reply.type('text/html').send(registerPage(uid, 'Username and password are required'));
+    return reply.type('text/html').send(registerPage(uid, 'Username and password are required', null, inviteOnly));
   }
 
   // Validate username format
   const usernameRegex = /^[a-z0-9]+$/;
   if (!usernameRegex.test(username)) {
-    return reply.type('text/html').send(registerPage(uid, 'Username must contain only lowercase letters and numbers'));
+    return reply.type('text/html').send(registerPage(uid, 'Username must contain only lowercase letters and numbers', null, inviteOnly));
   }
 
   if (username.length < 3) {
-    return reply.type('text/html').send(registerPage(uid, 'Username must be at least 3 characters'));
+    return reply.type('text/html').send(registerPage(uid, 'Username must be at least 3 characters', null, inviteOnly));
   }
 
-
   if (password !== confirmPassword) {
-    return reply.type('text/html').send(registerPage(uid, 'Passwords do not match'));
+    return reply.type('text/html').send(registerPage(uid, 'Passwords do not match', null, inviteOnly));
   }
 
   try {
@@ -393,7 +401,7 @@ export async function handleRegisterPost(request, reply, issuer) {
     const podPath = `${username}/`;
     const podExists = await storage.exists(podPath);
     if (podExists) {
-      return reply.type('text/html').send(registerPage(uid, 'Username is already taken'));
+      return reply.type('text/html').send(registerPage(uid, 'Username is already taken', null, inviteOnly));
     }
 
     // Create pod structure
@@ -413,10 +421,10 @@ export async function handleRegisterPost(request, reply, issuer) {
     if (uid) {
       return reply.redirect(`/idp/interaction/${uid}`);
     } else {
-      return reply.type('text/html').send(registerPage(null, null, `Account created! You can now sign in as "${username}".`));
+      return reply.type('text/html').send(registerPage(null, null, `Account created! You can now sign in as "${username}".`, inviteOnly));
     }
   } catch (err) {
     request.log.error(err, 'Registration error');
-    return reply.type('text/html').send(registerPage(uid, err.message));
+    return reply.type('text/html').send(registerPage(uid, err.message, null, inviteOnly));
   }
 }

package/src/idp/invites.js

@@ -0,0 +1,181 @@
+/**
+ * Invite code management for invite-only registration
+ * Stores codes in /data/.server/invites.json
+ */
+
+import { promises as fs } from 'fs';
+import { join } from 'path';
+import crypto from 'crypto';
+import { getDataRoot } from '../utils/url.js';
+
+const INVITES_DIR = '.server';
+const INVITES_FILE = 'invites.json';
+
+/**
+ * Get path to invites file
+ */
+function getInvitesPath() {
+  return join(getDataRoot(), INVITES_DIR, INVITES_FILE);
+}
+
+/**
+ * Ensure .server directory exists
+ */
+async function ensureServerDir() {
+  const dirPath = join(getDataRoot(), INVITES_DIR);
+  try {
+    await fs.mkdir(dirPath, { recursive: true });
+  } catch (err) {
+    if (err.code !== 'EEXIST') throw err;
+  }
+}
+
+/**
+ * Load all invites from storage
+ * @returns {Promise<object>} Map of code -> invite data
+ */
+export async function loadInvites() {
+  try {
+    const data = await fs.readFile(getInvitesPath(), 'utf-8');
+    return JSON.parse(data);
+  } catch (err) {
+    if (err.code === 'ENOENT') {
+      return {};
+    }
+    throw err;
+  }
+}
+
+/**
+ * Save invites to storage
+ * @param {object} invites - Map of code -> invite data
+ */
+async function saveInvites(invites) {
+  await ensureServerDir();
+  await fs.writeFile(getInvitesPath(), JSON.stringify(invites, null, 2));
+}
+
+/**
+ * Generate a random invite code
+ * @returns {string} 8-character uppercase alphanumeric code
+ */
+function generateCode() {
+  const bytes = crypto.randomBytes(6);
+  // Base64 encode and take first 8 chars, uppercase, remove ambiguous chars
+  return bytes.toString('base64')
+    .replace(/[+/=]/g, '')
+    .substring(0, 8)
+    .toUpperCase()
+    .replace(/O/g, '0')
+    .replace(/I/g, '1')
+    .replace(/L/g, '1');
+}
+
+/**
+ * Create a new invite code
+ * @param {object} options
+ * @param {number} options.maxUses - Maximum number of uses (default 1)
+ * @param {string} options.note - Optional note/description
+ * @returns {Promise<{code: string, invite: object}>}
+ */
+export async function createInvite({ maxUses = 1, note = '' } = {}) {
+  const invites = await loadInvites();
+
+  // Generate unique code
+  let code;
+  do {
+    code = generateCode();
+  } while (invites[code]);
+
+  const invite = {
+    created: new Date().toISOString(),
+    maxUses,
+    uses: 0,
+    note
+  };
+
+  invites[code] = invite;
+  await saveInvites(invites);
+
+  return { code, invite };
+}
+
+/**
+ * List all invite codes
+ * @returns {Promise<Array<{code: string, ...invite}>>}
+ */
+export async function listInvites() {
+  const invites = await loadInvites();
+  return Object.entries(invites).map(([code, invite]) => ({
+    code,
+    ...invite
+  }));
+}
+
+/**
+ * Revoke (delete) an invite code
+ * @param {string} code - The invite code to revoke
+ * @returns {Promise<boolean>} True if code existed and was deleted
+ */
+export async function revokeInvite(code) {
+  const invites = await loadInvites();
+  const upperCode = code.toUpperCase();
+
+  if (!invites[upperCode]) {
+    return false;
+  }
+
+  delete invites[upperCode];
+  await saveInvites(invites);
+  return true;
+}
+
+/**
+ * Validate and consume an invite code
+ * @param {string} code - The invite code to validate
+ * @returns {Promise<{valid: boolean, error?: string}>}
+ */
+export async function validateInvite(code) {
+  if (!code || typeof code !== 'string') {
+    return { valid: false, error: 'Invite code required' };
+  }
+
+  const invites = await loadInvites();
+  const upperCode = code.toUpperCase().trim();
+  const invite = invites[upperCode];
+
+  if (!invite) {
+    return { valid: false, error: 'Invalid invite code' };
+  }
+
+  if (invite.uses >= invite.maxUses) {
+    return { valid: false, error: 'Invite code has been fully used' };
+  }
+
+  // Consume one use
+  invite.uses += 1;
+  await saveInvites(invites);
+
+  return { valid: true };
+}
+
+/**
+ * Check if an invite code is valid without consuming it
+ * @param {string} code - The invite code to check
+ * @returns {Promise<boolean>}
+ */
+export async function isValidInvite(code) {
+  if (!code || typeof code !== 'string') {
+    return false;
+  }
+
+  const invites = await loadInvites();
+  const upperCode = code.toUpperCase().trim();
+  const invite = invites[upperCode];
+
+  if (!invite) {
+    return false;
+  }
+
+  return invite.uses < invite.maxUses;
+}

package/src/idp/views.js

@@ -296,7 +296,13 @@ export function errorPage(title, message) {
 /**
  * Registration page HTML
  */
-export function registerPage(uid = null, error = null, success = null) {
+export function registerPage(uid = null, error = null, success = null, inviteOnly = false) {
+  const inviteField = inviteOnly ? `
+      <label for="invite">Invite Code</label>
+      <input type="text" id="invite" name="invite" required
+             placeholder="Enter your invite code" style="text-transform: uppercase;">
+  ` : '';
+
   return `
 <!DOCTYPE html>
 <html lang="en">
@@ -310,14 +316,16 @@ export function registerPage(uid = null, error = null, success = null) {
   <div class="container">
     <div class="logo">${solidLogo}</div>
     <h1>Create Account</h1>
-    <p class="subtitle">Register for a new Solid Pod</p>
+    <p class="subtitle">Register for a new Solid Pod${inviteOnly ? ' (invite required)' : ''}</p>
 
     ${error ? `<div class="error">${escapeHtml(error)}</div>` : ''}
     ${success ? `<div class="error" style="background: #efe; border-color: #cfc; color: #060;">${escapeHtml(success)}</div>` : ''}
 
     <form method="POST" action="/idp/register${uid ? `?uid=${uid}` : ''}">
+      ${inviteField}
+
       <label for="username">Username</label>
-      <input type="text" id="username" name="username" required autofocus
+      <input type="text" id="username" name="username" required ${!inviteOnly ? 'autofocus' : ''}
              placeholder="Choose a username" pattern="[a-z0-9]+"
              title="Lowercase letters and numbers only">
 

package/src/server.js

@@ -46,6 +46,10 @@ export function createServer(options = {}) {
   const mashlibVersion = options.mashlibVersion ?? '2.0.0';
   // Git HTTP backend is OFF by default - enables clone/push via git protocol
   const gitEnabled = options.git ?? false;
+  // Invite-only registration is OFF by default - open registration
+  const inviteOnly = options.inviteOnly ?? false;
+  // Default storage quota per pod (50MB default, 0 = unlimited)
+  const defaultQuota = options.defaultQuota ?? 50 * 1024 * 1024;
 
   // Set data root via environment variable if provided
   if (options.root) {
@@ -93,6 +97,7 @@ export function createServer(options = {}) {
   fastify.decorateRequest('mashlibEnabled', null);
   fastify.decorateRequest('mashlibCdn', null);
   fastify.decorateRequest('mashlibVersion', null);
+  fastify.decorateRequest('defaultQuota', null);
   fastify.addHook('onRequest', async (request) => {
     request.connegEnabled = connegEnabled;
     request.notificationsEnabled = notificationsEnabled;
@@ -102,6 +107,7 @@ export function createServer(options = {}) {
     request.mashlibEnabled = mashlibEnabled;
     request.mashlibCdn = mashlibCdn;
     request.mashlibVersion = mashlibVersion;
+    request.defaultQuota = defaultQuota;
 
     // Extract pod name from subdomain if enabled
     if (subdomainsEnabled && baseDomain) {
@@ -125,7 +131,7 @@ export function createServer(options = {}) {
 
   // Register Identity Provider plugin if enabled
   if (idpEnabled) {
-    fastify.register(idpPlugin, { issuer: idpIssuer });
+    fastify.register(idpPlugin, { issuer: idpIssuer, inviteOnly });
   }
 
   // Register rate limiting plugin

package/src/storage/quota.js

@@ -0,0 +1,202 @@
+/**
+ * Storage quota management
+ * Tracks and enforces per-pod storage limits
+ */
+
+import { promises as fs } from 'fs';
+import { join } from 'path';
+import { getDataRoot } from '../utils/url.js';
+
+const QUOTA_FILE = '.quota.json';
+
+/**
+ * Get quota file path for a pod
+ */
+function getQuotaPath(podName) {
+  return join(getDataRoot(), podName, QUOTA_FILE);
+}
+
+/**
+ * Load quota data for a pod
+ * @param {string} podName - The pod name
+ * @returns {Promise<{limit: number, used: number}>}
+ */
+export async function loadQuota(podName) {
+  try {
+    const data = await fs.readFile(getQuotaPath(podName), 'utf-8');
+    return JSON.parse(data);
+  } catch (err) {
+    if (err.code === 'ENOENT') {
+      // No quota file - return defaults (will be initialized on first write)
+      return { limit: 0, used: 0 };
+    }
+    throw err;
+  }
+}
+
+/**
+ * Save quota data for a pod
+ * @param {string} podName - The pod name
+ * @param {object} quota - Quota data
+ */
+export async function saveQuota(podName, quota) {
+  await fs.writeFile(getQuotaPath(podName), JSON.stringify(quota, null, 2));
+}
+
+/**
+ * Initialize quota for a new pod
+ * @param {string} podName - The pod name
+ * @param {number} limit - Quota limit in bytes
+ */
+export async function initializeQuota(podName, limit) {
+  const quota = { limit, used: 0 };
+  await saveQuota(podName, quota);
+  return quota;
+}
+
+/**
+ * Calculate actual disk usage for a pod (for reconciliation)
+ * @param {string} podName - The pod name
+ * @returns {Promise<number>} Total bytes used
+ */
+export async function calculatePodSize(podName) {
+  const podPath = join(getDataRoot(), podName);
+  return calculateDirSize(podPath);
+}
+
+/**
+ * Recursively calculate directory size
+ */
+async function calculateDirSize(dirPath) {
+  let total = 0;
+
+  try {
+    const entries = await fs.readdir(dirPath, { withFileTypes: true });
+
+    for (const entry of entries) {
+      const fullPath = join(dirPath, entry.name);
+
+      // Skip quota file itself
+      if (entry.name === QUOTA_FILE) continue;
+
+      if (entry.isDirectory()) {
+        total += await calculateDirSize(fullPath);
+      } else if (entry.isFile()) {
+        const stat = await fs.stat(fullPath);
+        total += stat.size;
+      }
+    }
+  } catch (err) {
+    // Directory might not exist or be inaccessible
+    if (err.code !== 'ENOENT') {
+      throw err;
+    }
+  }
+
+  return total;
+}
+
+/**
+ * Check if a write operation would exceed quota
+ * @param {string} podName - The pod name
+ * @param {number} additionalBytes - Bytes to be added
+ * @param {number} defaultQuota - Default quota limit
+ * @returns {Promise<{allowed: boolean, quota: object, error?: string}>}
+ */
+export async function checkQuota(podName, additionalBytes, defaultQuota) {
+  let quota = await loadQuota(podName);
+
+  // Initialize if no quota set
+  if (quota.limit === 0 && defaultQuota > 0) {
+    quota = await initializeQuota(podName, defaultQuota);
+  }
+
+  // No quota enforcement if limit is 0
+  if (quota.limit === 0) {
+    return { allowed: true, quota };
+  }
+
+  const projectedUsage = quota.used + additionalBytes;
+
+  if (projectedUsage > quota.limit) {
+    const usedMB = (quota.used / (1024 * 1024)).toFixed(2);
+    const limitMB = (quota.limit / (1024 * 1024)).toFixed(2);
+    return {
+      allowed: false,
+      quota,
+      error: `Storage quota exceeded. Used: ${usedMB}MB / ${limitMB}MB`
+    };
+  }
+
+  return { allowed: true, quota };
+}
+
+/**
+ * Update quota usage after a write
+ * @param {string} podName - The pod name
+ * @param {number} bytesChange - Bytes added (positive) or removed (negative)
+ */
+export async function updateQuotaUsage(podName, bytesChange) {
+  const quota = await loadQuota(podName);
+
+  // Skip if no quota initialized
+  if (quota.limit === 0) return quota;
+
+  quota.used = Math.max(0, quota.used + bytesChange);
+  await saveQuota(podName, quota);
+  return quota;
+}
+
+/**
+ * Set quota limit for a pod
+ * @param {string} podName - The pod name
+ * @param {number} limit - New limit in bytes
+ */
+export async function setQuotaLimit(podName, limit) {
+  let quota = await loadQuota(podName);
+
+  // If no quota exists, calculate current usage
+  if (quota.limit === 0) {
+    quota.used = await calculatePodSize(podName);
+  }
+
+  quota.limit = limit;
+  await saveQuota(podName, quota);
+  return quota;
+}
+
+/**
+ * Get quota info for a pod
+ * @param {string} podName - The pod name
+ * @returns {Promise<{limit: number, used: number, percent: number}>}
+ */
+export async function getQuotaInfo(podName) {
+  const quota = await loadQuota(podName);
+  const percent = quota.limit > 0 ? Math.round((quota.used / quota.limit) * 100) : 0;
+  return { ...quota, percent };
+}
+
+/**
+ * Reconcile quota with actual disk usage
+ * @param {string} podName - The pod name
+ */
+export async function reconcileQuota(podName) {
+  const quota = await loadQuota(podName);
+  if (quota.limit === 0) return quota;
+
+  const actualUsed = await calculatePodSize(podName);
+  quota.used = actualUsed;
+  await saveQuota(podName, quota);
+  return quota;
+}
+
+/**
+ * Format bytes as human-readable string
+ */
+export function formatBytes(bytes) {
+  if (bytes === 0) return '0 B';
+  const k = 1024;
+  const sizes = ['B', 'KB', 'MB', 'GB', 'TB'];
+  const i = Math.floor(Math.log(bytes) / Math.log(k));
+  return parseFloat((bytes / Math.pow(k, i)).toFixed(2)) + ' ' + sizes[i];
+}

package/src/utils/url.js

@@ -143,6 +143,43 @@ export function getResourceName(urlPath) {
   return parts[parts.length - 1];
 }
 
+/**
+ * Extract pod name from URL path or request
+ * @param {string|object} pathOrRequest - URL path string or Fastify request object
+ * @returns {string|null} - Pod name or null if not found
+ */
+export function getPodName(pathOrRequest) {
+  // If it's a request object
+  if (typeof pathOrRequest === 'object') {
+    // Subdomain mode: pod name from hostname
+    if (pathOrRequest.subdomainsEnabled && pathOrRequest.podName) {
+      return pathOrRequest.podName;
+    }
+    // Path mode: extract from URL
+    const urlPath = pathOrRequest.url?.split('?')[0] || '';
+    return getPodNameFromPath(urlPath);
+  }
+
+  // If it's a string path
+  return getPodNameFromPath(pathOrRequest);
+}
+
+/**
+ * Extract pod name from URL path
+ * @param {string} urlPath - URL path (e.g., /alice/public/file.txt)
+ * @returns {string|null} - Pod name or null
+ */
+function getPodNameFromPath(urlPath) {
+  const parts = urlPath.split('/').filter(Boolean);
+  if (parts.length === 0) return null;
+
+  // First segment is the pod name (skip system paths)
+  const firstPart = parts[0];
+  if (firstPart.startsWith('.')) return null; // .well-known, .acl, etc.
+
+  return firstPart;
+}
+
 /**
  * Determine content type from file extension
  * @param {string} filePath