Integrate wave 5 (caldav, webfinger, activitypub, rss): 20 plugins, 195 tests

- compose.test.js + serve.js load all 20 (appPaths widened +/ap for
  activitypub); 21-check compose.
- README/ISSUES tables + tally (13 built as plugins, 20 total).
- NOTES: reserved-path is now the most-hit finding (7+ consumers) — 3
  protocol-shim confirmations (mastodon/bluesky/activitypub), activitypub
  sharpening it (wants paths interleaved with the pod namespace); the two
  most-wanted .well-known docs (nip05, webfinger) both by luck. api.serverInfo
  elevated to broadest seam (~10 consumers). DAV bridge proven 3x.

Author: melvincarvalho

ISSUES.md

@@ -27,6 +27,10 @@ evidence. Legend:
 | #505 | `otp/` | one-time-password session flow (account *recovery* → 🔩 core auth) |
 | #157 | `carddav/` | CardDAV contact sync (iOS/macOS/Thunderbird/DAVx5) |
 | #211 | `bluesky/` | AT-Protocol XRPC shim — a client logs into its own pod (needs `appPaths` widened → 🔩) |
+| #157-sib | `caldav/` | CalDAV calendar sync — completes the DAV family |
+| #164 | `webfinger/` | `/.well-known/webfinger` — the WebFinger half of #164 |
+| #51/#164 | `activitypub/` | federate a pod as an AS2 actor (needs `appPaths` widened → 🔩) |
+| — | `rss/` | any pod container as an Atom/RSS feed |
 
 Plus six **ports of bundled features** proving the migration path for #564 /
 #164: `relay/` `webrtc/` `terminal/` `tunnel/` `notifications/`, and `pay/`
@@ -87,11 +91,12 @@ exists.
 
 ## Tally
 
-Of ~40 plugin-tagged issues: **10 built as plugins here**, **6 ported**, **5
-shipped upstream**, **2 more plugin-able with no blocker**, **6 clusters
-blocked on a named seam** (each with a proof-of-need consumer), the rest
-core-by-nature or product-scale. The plugin api reaches most of the backlog
-today; ranked by how many independent plugins demanded them, the seams that
-would unlock the most next are `api.authorize` (3 consumers), `api.events`
-(2, one where a miss means *wrong* answers), and multi-prefix/`appPaths.add`
-(every API-shim).
+Of ~40 plugin-tagged issues: **13 built as plugins here** (plus `rss/`, no
+issue), **6 ported**, **5 shipped upstream**, **2 more plugin-able with no
+blocker**, **6 clusters blocked on a named seam** (each with a proof-of-need
+consumer), the rest core-by-nature or product-scale. 20 plugins total, ~200
+tests. The plugin api reaches most of the backlog today; ranked by demand,
+the seams that would unlock the most next are `api.authorize` (3 blocking
+consumers), `api.reservePath` (3 API-shims can't self-exempt), `api.events`
+(2, one where a miss means *wrong* answers), and `api.serverInfo` (broadest:
+~10 plugins hand-roll their own origin).

NOTES.md

@@ -45,40 +45,46 @@ ports reached for it without coordinating.
    has the emitter internally (`src/notifications/events.js`). The seam
    every "react to pod writes" app (webhooks, indexing, sync, full-text)
    will want.
-3. **`api.serverInfo` (`{ baseUrl, port }` at listen)** — **consumers:
-   notifications/, webdav/, sparql/, nip05/** (subdomain per-host
-   filtering). Every plugin that mints absolute URLs or reaches the host
-   over loopback repeats the origin in config today; a wrong value fails
-   quietly (nip05 serves an empty identity map). Cheap to provide.
+3. **`api.serverInfo` (`{ baseUrl, port }` at listen)** — **eight+
+   consumers: notifications/, webdav/, carddav/, caldav/, sparql/, rss/,
+   nip05/, webfinger/, mastodon/, bluesky/, activitypub/** — essentially
+   every plugin that mints absolute URLs or reaches the host over loopback.
+   All repeat the origin in config today; a wrong value fails quietly (nip05
+   serves an empty identity map). The single most *broadly* needed seam
+   (vs. api.authorize being the most *blocking*); trivially cheap to provide.
 4. **The unconsumed-body-**stream** primitive (#583)** — consumer:
    gitscratch/ sharpened it. tunnel/ needed the raw *buffer*; git needs the
    raw *stream* piped to a subprocess gzip-and-all. Whatever `api.mountApp`
    / raw-body mode ships must hand back the un-drained stream, not just a
    buffered body. (This is exactly what the merged loader's scoped
    pass-through parser does — the finding is to keep it that way.)
-5. **Routes/WAC-exemption outside the single prefix** — **four consumers:
-   nip05/, webdav/ & carddav/ (`/.well-known/*`), mastodon/ (`/api`,
-   `/oauth`).** A plugin can *register* absolute/exact routes outside its
-   prefix (the loader doesn't confine `api.fastify`), but the loader
-   WAC-exempts only its **one** `prefix` (`plugins.js` pushes `prefix` to
-   `appPaths`). Consequences, in increasing severity:
-   - nip05/webdav/carddav land on `/.well-known/*`, which core *happens* to
-     blanket-exempt — so they work **by luck**, not by contract.
-   - **mastodon** needs `/api` **and** `/oauth`, and **bluesky** needs
-     `/xrpc` — none of which core exempts, so **the plugin cannot serve its
-     own surface**: every call 401s at the WAC hook until the operator
-     hand-passes `appPaths: ['/api','/oauth','/xrpc']`. A plugin has no way
-     to exempt a path it owns. **Two independent confirmations** (two
-     protocol shims, built separately), and bluesky sharpens it: it needs
-     only *one* extra root and still can't reach it, so the seam is not
-     "more prefixes" but **"a plugin declares the paths it owns,
-     independent of its mount prefix."**
+5. **Routes/WAC-exemption outside the single prefix** — **the most-hit
+   finding: seven+ consumers.** A plugin can *register* absolute/exact
+   routes outside its prefix (the loader doesn't confine `api.fastify`), but
+   the loader WAC-exempts only its **one** `prefix`. Consequences, in
+   increasing severity:
+   - **`/.well-known/*` served by luck** — nip05/ (`nostr.json`),
+     webfinger/ (`webfinger`), webdav/carddav/caldav (`caldav`/`carddav`).
+     Core *happens* to blanket-exempt `/.well-known/*`, so they work but by
+     coincidence, not contract. Notably nip05 and webfinger are the **two
+     most-wanted `.well-known` docs a deployment serves**, both riding the
+     same undocumented luck.
+   - **fixed roots core does NOT exempt** — mastodon/ (`/api`,`/oauth`),
+     bluesky/ (`/xrpc`), activitypub/ (`/ap`). Here the plugin **cannot
+     serve its own surface**: every call 401s at the WAC hook until the
+     operator hand-passes `appPaths`. **Three independent protocol-shim
+     confirmations**, each built separately. bluesky sharpened it (one root,
+     still unreachable → the ask is "declare owned paths," not "more
+     prefixes"); activitypub sharpened it further — its natural layout wants
+     paths **interleaved with** the pod's own `/<user>/` namespace, which no
+     single mount prefix can carve out at all.
    - none of it has conflict detection: a future core route at a
-     plugin-claimed path throws `FST_ERR_DUPLICATED_ROUTE` at boot.
+     plugin-claimed path throws `FST_ERR_DUPLICATED_ROUTE` at boot (and a
+     link registry — `api.webfinger.addLink` — is missing, so two plugins
+     contributing `.well-known/webfinger` links would collide silently).
    The seam: `api.reservePath('/xrpc')` (or `paths: [...]` in the entry) —
    the loader exempts *and* claims each deliberately and reports collisions.
-   This is the seam **every API-shim plugin** (mastodon, bluesky, and any
-   future ActivityPub/Matrix/gateway) structurally requires; it's the third
+   The seam **every API-shim plugin** structurally requires; third
    most-demanded after `api.authorize` and `api.events`.
 6. **Can't set fastify server options** — consumer: capability/ hit
    `maxParamLength` (100) silently 404ing long tokens in named params;

README.md

@@ -65,9 +65,13 @@ README and NOTES.md, ship the closest honest approximation.
 | `carddav/` | #157 | contact sync (iOS/macOS/Thunderbird/DAVx5); the DAV bridge, generalized |
 | `mastodon/` | #515/#516 | Mastodon-API shim — a client logs into its own pod; needs `appPaths` widened |
 | `bluesky/` | #211 | AT-Protocol XRPC shim — same shape, `/xrpc` root; token bridge generalizes |
+| `caldav/` | #157-sib | calendar sync — completes the DAV family (webdav+carddav+caldav) |
+| `webfinger/` | #164 | `/.well-known/webfinger` — fediverse `acct:` resolution for the shims |
+| `activitypub/` | #51/#164 | federate a pod as an AS2 actor; outbound HTTP Signatures |
+| `rss/` | — | any pod container as an Atom/RSS feed |
 
-**~150 tests, all green** (`npm test`), including `compose.test.js` — all
-sixteen plugins on one server from pure config, pods + WAC intact beside
+**~200 tests, all green** (`npm test`), including `compose.test.js` — all
+twenty plugins on one server from pure config, pods + WAC intact beside
 them. Findings consolidated in [NOTES.md](./NOTES.md); the full
 plugin-tagged backlog triaged in [ISSUES.md](./ISSUES.md).
 

compose.test.js

@@ -46,7 +46,7 @@ describe('composition: every plugin on one server', () => {
 
   after(async () => { if (jss) await jss.close(); });
 
-  it('boots pods + idp + sixteen plugins from config', async () => {
+  it('boots pods + idp + twenty plugins from config', async () => {
     const port = await probePort();
     base = `http://127.0.0.1:${port}`;
     wsBase = `ws://127.0.0.1:${port}`;
@@ -55,10 +55,10 @@ describe('composition: every plugin on one server', () => {
       port,
       root,
       idp: true,
-      // mastodon (/api,/oauth) and bluesky (/xrpc) own fixed roots outside
-      // their prefix; a plugin can't self-exempt them (finding), so the
-      // operator widens appPaths.
-      appPaths: ['/api', '/oauth', '/xrpc'],
+      // The protocol shims own fixed roots outside their prefix — mastodon
+      // (/api,/oauth), bluesky (/xrpc), activitypub (/ap) — which a plugin
+      // can't self-exempt (finding), so the operator widens appPaths.
+      appPaths: ['/api', '/oauth', '/xrpc', '/ap'],
       // Explicit ids: the <name>/plugin.js convention makes every basename
       // reduce to 'plugin' — the loader's duplicate-id guard requires ids
       // here (finding: derive from the parent dir for generic basenames).
@@ -84,6 +84,10 @@ describe('composition: every plugin on one server', () => {
         { id: 'carddav', module: at('carddav/plugin.js'), prefix: '/carddav', config: { baseUrl: base, loopbackUrl: base } },
         { id: 'mastodon', module: at('mastodon/plugin.js'), prefix: '/mastodon', config: { baseUrl: base, loopbackUrl: base } },
         { id: 'bluesky', module: at('bluesky/plugin.js'), prefix: '/bluesky', config: { baseUrl: base, loopbackUrl: base } },
+        { id: 'caldav', module: at('caldav/plugin.js'), prefix: '/caldav', config: { baseUrl: base, loopbackUrl: base } },
+        { id: 'webfinger', module: at('webfinger/plugin.js'), prefix: '/webfinger', config: { podsRoot: root, baseUrl: base } },
+        { id: 'activitypub', module: at('activitypub/plugin.js'), prefix: '/activitypub', config: { baseUrl: base, loopbackUrl: base } },
+        { id: 'rss', module: at('rss/plugin.js'), prefix: '/feed', config: { baseUrl: base, loopbackUrl: base } },
       ],
     });
     assert.ok(jss.base);
@@ -222,6 +226,30 @@ describe('composition: every plugin on one server', () => {
     assert.strictEqual(res.status, 200);
   });
 
+  it('caldav: OPTIONS advertises calendar-access', async () => {
+    const res = await fetch(`${base}/caldav/`, { method: 'OPTIONS' });
+    assert.ok(res.status < 500);
+    assert.match(res.headers.get('dav') || '', /calendar-access/);
+  });
+
+  it('webfinger: missing resource is 400 (endpoint alive)', async () => {
+    const res = await fetch(`${base}/.well-known/webfinger`);
+    assert.strictEqual(res.status, 400);
+  });
+
+  it('activitypub: unauthenticated outbox POST is refused', async () => {
+    const res = await fetch(`${base}/ap/alice/outbox`, {
+      method: 'POST', headers: { 'content-type': 'application/activity+json' },
+      body: JSON.stringify({ type: 'Note', content: 'x' }),
+    });
+    assert.strictEqual(res.status, 401);
+  });
+
+  it('rss: missing container is 400 (endpoint alive)', async () => {
+    const res = await fetch(`${base}/feed/atom`);
+    assert.strictEqual(res.status, 400);
+  });
+
   it('pods still work beside all of it (idp register + WAC)', async () => {
     let res = await fetch(`${base}/idp/register`, {
       method: 'POST',

serve.js

@@ -28,10 +28,10 @@ const fastify = createServer({
   root: PODS,
   idp: true,
   idpIssuer: PUBLIC_URL,
-  // mastodon (/api,/oauth) and bluesky (/xrpc) own fixed roots outside
-  // their prefix; a plugin can't self-exempt them from WAC, so the
-  // operator widens appPaths.
-  appPaths: ['/api', '/oauth', '/xrpc'],
+  // The protocol shims own fixed roots outside their prefix — mastodon
+  // (/api,/oauth), bluesky (/xrpc), activitypub (/ap) — which a plugin
+  // can't self-exempt from WAC, so the operator widens appPaths.
+  appPaths: ['/api', '/oauth', '/xrpc', '/ap'],
   // Explicit ids — the <name>/plugin.js convention collides on basename.
   plugins: [
     { id: 'relay', module: at('relay/plugin.js'), prefix: '/relay' },
@@ -55,6 +55,10 @@ const fastify = createServer({
     { id: 'carddav', module: at('carddav/plugin.js'), prefix: '/carddav', config: { baseUrl: PUBLIC_URL, loopbackUrl: `http://127.0.0.1:${PORT}` } },
     { id: 'mastodon', module: at('mastodon/plugin.js'), prefix: '/mastodon', config: { baseUrl: PUBLIC_URL, loopbackUrl: `http://127.0.0.1:${PORT}` } },
     { id: 'bluesky', module: at('bluesky/plugin.js'), prefix: '/bluesky', config: { baseUrl: PUBLIC_URL, loopbackUrl: `http://127.0.0.1:${PORT}` } },
+    { id: 'caldav', module: at('caldav/plugin.js'), prefix: '/caldav', config: { baseUrl: PUBLIC_URL, loopbackUrl: `http://127.0.0.1:${PORT}` } },
+    { id: 'webfinger', module: at('webfinger/plugin.js'), prefix: '/webfinger', config: { podsRoot: PODS, baseUrl: PUBLIC_URL } },
+    { id: 'activitypub', module: at('activitypub/plugin.js'), prefix: '/activitypub', config: { baseUrl: PUBLIC_URL, loopbackUrl: `http://127.0.0.1:${PORT}` } },
+    { id: 'rss', module: at('rss/plugin.js'), prefix: '/feed', config: { baseUrl: PUBLIC_URL, loopbackUrl: `http://127.0.0.1:${PORT}` } },
   ],
 });
 
@@ -84,3 +88,7 @@ console.log(`  otp:            POST ${PUBLIC_URL}/otp/request`);
 console.log(`  carddav:        ${PUBLIC_URL}/carddav/  (contact sync)`);
 console.log(`  mastodon:       GET ${PUBLIC_URL}/api/v1/instance  (point a client here)`);
 console.log(`  bluesky:        GET ${PUBLIC_URL}/xrpc/com.atproto.server.describeServer`);
+console.log(`  caldav:         ${PUBLIC_URL}/caldav/  (calendar sync)`);
+console.log(`  webfinger:      GET ${PUBLIC_URL}/.well-known/webfinger?resource=acct:me@host`);
+console.log(`  activitypub:    GET ${PUBLIC_URL}/ap/<user>/actor`);
+console.log(`  rss/atom:       GET ${PUBLIC_URL}/feed/atom?container=<pod-container>`);