Reconnexion/festipod
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

Keep sign-ups unlinkable on ActivityPods, and land the pending coherence-pass work

Browse Source 
Participation privacy (decision_2026-10-29_participation-privacy-mechanism):
a sign-up is a private Join naming the meeting point, addressed to nobody,
handled by the backend on emission. Attendee lists hold member URNs hashed
from (WebID, event, a secret kept in the participant's profile), so counts
stay public and only contacts recognise anyone; the creator has no read
right and is notified anonymously. Each person's participations collection,
created by the backend at the first sign-up, is readable by their /contacts
WAC group only, never world-readable. The member URN is sticky per
(meeting point, participant) and every collection write is verified by
reading back, so a refused write leaves the act unrecorded and retryable.
The EventRef mechanism and its browser-side provisioning are gone.

The backend now runs with WebACL on, as the reference apps do, on its own
secure datasets festipod / settings-festipod instead of the pod provider's
settings dataset; pod-notifications needs it. The compose header and the
deployment leaf say how to reset a stack whose datasets predate this.

The rights matrix covers the new mechanism live (148 hard lines), including
a forged contact Accept between throwaway accounts: the stranger enters the
contacts list (platform defect, reported upstream) but is refused the profile
and the participations. Tests may attack as long as they never break the dev
environment (rule_tests-never-break-the-dev-environment).

Also lands the coherence-pass work that was still uncommitted: contacts as
the Pod's social graph and invite links, image upload to the Pod, the
meeting-point form, profile completion gate, and the doctrine for them.
Superseded briefs and decisions are deleted rather than annotated.
This commit is contained in:
Sylvain Duchesne
2026-10-30 17:06:38 +01:00
parent f90651eb9a
commit 908f7ea973
138 changed files with 8347 additions and 3679 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/services/public-read.service.js
+14 -32
View File
@@ -5,15 +5,18 @@ const { hasPublicIntent } = require('./public-intent');
const { isInActorPod } = require('./actor-pod');
const { createKeyedSerializer } = require('./keyed-serializer');
const { neverThrowingMatcher, verifiedEmit, uriOf, singleUriOf, hasAsType } = require('./emitted-activity');
const { grantsPublicRead, hasOwnPublicRead, hasInheritedPublicRead, revocationGraph, FOAF_AGENT } = require('./public-read-acl');
const {
grantsPublicRead,
hasOwnPublicRead,
hasInheritedPublicRead,
revocationGraph,
aclUriOf,
readAcl,
putOwnRights,
FOAF_AGENT
} = require('./public-read-acl');
const { recordGrant, forgetGrant, isGrantedByFestipod } = require('./public-read-ledger');
/** The ACL document URI of a pod resource: `{origin}/_acl{path}` (the pod's `getAclUriFromResourceUri`). */
const aclUriOf = resourceUri => {
const { origin, pathname } = new URL(resourceUri);
return `${origin}/_acl${pathname}`;
};
const APODS_ATTENDEES = 'http://activitypods.org/ns/core#attendees';
/** The attendees collection an event names (compacted or full-IRI key), when it names exactly one. */
@@ -165,22 +168,9 @@ module.exports = {
this.logger.error(`Could not re-decide public read on ${resourceUri} after a late write: ${e.message}`);
}
},
/**
* The resource's ACL as the pod serves it to the app: `{ status, authorizations }`, the
* authorizations only when the pod answered 200. Unlike `pod-permissions.get`, which answers
* `false` for ANY failure — indistinguishable from "no public read" — a failure here is reported,
* so a caller can tell "not public" from "unknown". Read where `revoke` writes (`aclUriOf`).
*/
/** The resource's ACL as the pod serves it to the app (`public-read-acl.js` `readAcl`). */
async readAcl(ctx, resourceUri, actorUri) {
const { status, body } =
(await ctx.call('pod-permissions.fetch', {
url: aclUriOf(resourceUri),
headers: { Accept: 'application/ld+json' },
actorUri
})) || {};
if (status !== 200 || !body || typeof body !== 'object') return { status: typeof status === 'number' ? status : 0 };
const graph = body['@graph'] !== undefined ? body['@graph'] : body['@id'] || body.id ? [body] : [];
return { status, authorizations: Array.isArray(graph) ? graph : [graph] };
return readAcl(ctx, resourceUri, actorUri);
},
/**
* Makes `resourceUri` world-readable and records it as FESTIPOD's grant — only when its ACL was
@@ -277,17 +267,9 @@ module.exports = {
return false;
}
const aclUri = aclUriOf(resourceUri);
const document = revocationGraph(acl.authorizations, resourceUri, actorUri, aclUri);
const app = await ctx.call('app.get');
const document = revocationGraph(acl.authorizations, resourceUri, actorUri, aclUriOf(resourceUri));
if (aborted()) return false;
const { status } = await ctx.call('signature.proxy.query', {
url: aclUri,
method: 'PUT',
headers: { 'Content-Type': 'application/ld+json' },
body: JSON.stringify(document),
actorUri: app.id || app['@id']
});
const status = await putOwnRights(ctx, resourceUri, document);
if (status !== 204 && status !== 200) {
throw new Error(`The pod refused to revoke the public-read grant on ${resourceUri} (HTTP ${status})`);
}