webfinger + didweb: consume api.serverInfo (#601) — Stage-3 retrofit

The two silent-failure consumers, per NEXT.md's recommended first move.
Both derived every absolute URL from a required config.baseUrl and
hard-failed boot without it; now the origin comes from api.serverInfo()
(#601, merged JSS 0.0.218), resolved at REQUEST time (with port 0 the
port exists only once listening). config.baseUrl stays as an optional
override for reverse-proxy edge cases.

didweb's is the strongest before/after: a mismatched host silently minted
a valid-looking DID whose id didn't match its fetch URL (silent
corruption a resolver caches), not just a config chore. Tests now boot
WITHOUT config.baseUrl and assert the JRD/DID URLs still resolve to the
real origin — the retrofit proof. README findings marked RESOLVED (the
origin half; config.podsRoot data-root repetition remains). 5/5 + 6/6;
composition intact (only the known notifications inotify flake).

Author: melvincarvalho

didweb/README.md

@@ -115,13 +115,17 @@ pod card at `podsRoot` if present, else from a minted server key.
    DID under the always-safe `<prefix>/<user>/did.json`, and the test asserts
    that mount is byte-identical.
 
-3. **`config.podsRoot` + `config.baseUrl` repetition, again** (see `webfinger/`,
-   `nip05/`, `notifications/`). A plugin can learn neither the data root nor
-   its own origin, so both are repeated in config and can be pointed at the
-   wrong place — here the failure mode is that the resolver *confidently mints
-   a valid-looking DID* off a stale/empty pod or a mismatched host, which a
-   resolver then caches. `api.storage.serverRoot` (read-only) and
-   `api.serverInfo` remain the candidate seams. Subdomain-mode did:web
+3. **`config.baseUrl` repetition — RESOLVED by `api.serverInfo()` (#601,
+   merged JSS 0.0.218).** The did:web `id` (`did:web:<host>`) and every
+   service URL now derive from `api.serverInfo().baseUrl`, resolved at
+   request time; `config.baseUrl` is an *optional* override and the boot no
+   longer hard-fails without it. This mattered most here of all the
+   consumers — a mismatched host silently mints a valid-looking DID whose
+   `id` doesn't match the URL it was fetched from, which a resolver then
+   caches — so landing the seam fixes a *silent-corruption* failure, not just
+   a config chore. **`config.podsRoot` is still a repetition** (see
+   `nip05/`): a plugin can't learn the *data root* — the remaining
+   `api.storage.serverRoot` candidate. Subdomain-mode did:web
    (`did:web:alice.pod.example` → `https://alice.pod.example/.well-known/did.json`)
    is out of reach for the same reason `nip05/` couldn't do per-host filtering:
    a plugin can read `request.headers.host` but has no way to learn the base

didweb/plugin.js

@@ -204,24 +204,21 @@ async function hasCard(dir) {
 export async function activate(api) {
   const prefix = api.prefix || '/didweb';
   const podsRoot = api.config.podsRoot ?? null;
-  const baseUrl = (api.config.baseUrl || '').replace(/\/$/, '');
+  // Origin from api.serverInfo() (#601), resolved at REQUEST time (with port 0
+  // the real port exists only once listening); config.baseUrl is an optional
+  // override for reverse-proxy edge cases. The did:web id (did:web:<host>) and
+  // every service URL derive from it — this used to require config.baseUrl and
+  // hard-fail boot; that finding is the serverInfo seam, merged in JSS 0.0.218.
+  const resolveBaseUrl = () => (api.config.baseUrl
+    ? String(api.config.baseUrl).replace(/\/$/, '')
+    : api.serverInfo().baseUrl.replace(/\/$/, ''));
+  // did:web host = the baseUrl authority with the port colon percent-encoded.
+  const resolveEncHost = () => new URL(resolveBaseUrl()).host.replace(/:/g, '%3A');
   // Optional: an AP-actor path template (as webfinger/ uses) → a service entry.
   const actorPathTemplate = api.config.actorPathTemplate || null;
   // Optional: arbitrary extra service entries appended verbatim.
   const extraServices = Array.isArray(api.config.serviceEndpoints)
     ? api.config.serviceEndpoints : [];
-
-  if (!baseUrl) {
-    // A DID document is nothing but absolute URLs and a did:web id derived
-    // from this server's own host, and the plugin api exposes no server
-    // origin (same finding as webfinger/, activitypub/, mastodon/). Without
-    // it there is no truthful `id` to mint — hard boot failure.
-    throw new Error(
-      'didweb plugin requires config.baseUrl — the plugin api exposes no server '
-      + 'origin, and the did:web id (did:web:<host>) plus every service URL is '
-      + 'derived from it (same finding as webfinger/activitypub/mastodon).',
-    );
-  }
   if (!podsRoot) {
     // Still activate: the root/server DID (`did:web:<host>`) is servable from
     // a minted key alone, and a purely additive resolver shouldn't fail the
@@ -231,11 +228,6 @@ export async function activate(api) {
       + '(the plugin api cannot learn the data root itself)');
   }
 
-  // did:web host = the baseUrl authority with the port colon percent-encoded.
-  const host = new URL(baseUrl).host;           // e.g. "pod.example" or "127.0.0.1:3000"
-  const encHost = host.replace(/:/g, '%3A');    // did:web percent-encodes the port colon
-  const didFor = (user) => (user ? `did:web:${encHost}:${user}` : `did:web:${encHost}`);
-
   // Minted Ed25519 keys persist here, one JSON per scope (root → `_root`).
   const keysDir = path.join(api.storage.pluginDir(), 'keys');
   fsSync.mkdirSync(keysDir, { recursive: true });
@@ -276,6 +268,9 @@ export async function activate(api) {
    */
   async function buildDidDoc(user) {
     if (user !== null && !(await podExists(user))) return null;
+    const baseUrl = resolveBaseUrl();
+    const encHost = resolveEncHost();
+    const didFor = (u) => (u ? `did:web:${encHost}:${u}` : `did:web:${encHost}`);
     const did = didFor(user);
     const podPath = user ? `/${user}/` : '/';
     const webid = `${baseUrl}${podPath}profile/card#me`;
@@ -349,7 +344,7 @@ export async function activate(api) {
     const user = request.params.user;
     if (!LOCAL_PART.test(user) || user.startsWith('.')) return notFound(reply, 'no such DID');
     const doc = await buildDidDoc(user);
-    if (!doc) return notFound(reply, `no such DID: did:web:${encHost}:${user}`);
+    if (!doc) return notFound(reply, `no such DID: did:web:${resolveEncHost()}:${user}`);
     return sendDoc(reply, doc);
   }
 
@@ -386,7 +381,9 @@ export async function activate(api) {
       + `serving pathed DIDs under ${prefix}/<user>/did.json only`);
   }
 
-  api.log.info(`didweb: root DID did:web:${encHost} at `
+  // Host isn't logged here: the did:web host comes from api.serverInfo() at
+  // request time, and at activate the ephemeral port may not be resolved yet.
+  api.log.info('didweb: root DID at '
     + `${wellKnown ? '/.well-known/did.json and ' : ''}${prefix}/did.json; `
     + `pathed DIDs at ${pathed ? '/<user>/did.json and ' : ''}${prefix}/<user>/did.json`
     + (podsRoot ? ` from ${podsRoot}` : ' (no podsRoot: pathed DIDs 404)'));

didweb/test.js

@@ -91,7 +91,10 @@ describe('didweb plugin', () => {
       plugins: [{
         module: PLUGIN,
         prefix: '/didweb',
-        config: { podsRoot: root, baseUrl: base, actorPathTemplate: '/ap/<user>/actor' },
+        // No baseUrl: the did:web host + service URLs now come from
+        // api.serverInfo() (#601). The encHost assertions below (derived from
+        // the real probed origin) must still hold — that's the retrofit proof.
+        config: { podsRoot: root, actorPathTemplate: '/ap/<user>/actor' },
       }],
     });
   });

webfinger/README.md

@@ -130,13 +130,14 @@ lifted out of `--activitypub` into an always-on, multi-protocol plugin.
    let the endpoint actually be the shared, extensible surface the issue
    describes.
 
-3. **`config.podsRoot` / `baseUrl` repetition (as in nip05, notifications,
-   mastodon, webdav).** A plugin cannot learn the data root or the server's
-   own origin, so the operator repeats both in config. Here `baseUrl` is a
-   hard requirement — every URL in a JRD (WebID, profile page, actor,
-   issuer) is absolute against it — so unlike nip05 the plugin *hard-fails*
-   boot without it. `podsRoot` is the same repetition nip05 documents, with
-   the same failure mode: point it at the wrong directory and every lookup
-   confidently 404s while the rest of the server works.
-   `api.storage.serverRoot` and `api.serverInfo` (both read-only) remain the
-   candidate seams.
+3. **`baseUrl` repetition — RESOLVED by `api.serverInfo()` (#601, merged JSS
+   0.0.218).** A plugin now learns its own origin: every JRD URL (WebID,
+   profile page, actor, issuer) is built from `api.serverInfo().baseUrl`,
+   resolved at request time. `config.baseUrl` remains an *optional* override
+   for reverse-proxy edge cases, and the boot no longer hard-fails without
+   it. This was the origin half of the old finding; `api.serverInfo` was one
+   of the top-demanded seams (~23 consumers) and landing it retired that
+   demand here. **`config.podsRoot` is still a repetition** (as in nip05):
+   a plugin cannot learn the *data root*, and pointing it at the wrong
+   directory confidently 404s every lookup while the rest of the server
+   works — the remaining `api.storage.serverRoot` candidate.

webfinger/plugin.js

@@ -96,25 +96,20 @@ export function parseResource(resource) {
 export async function activate(api) {
   const prefix = api.prefix || '/webfinger';
   const podsRoot = api.config.podsRoot ?? null;
-  const baseUrl = (api.config.baseUrl || '').replace(/\/$/, '');
+  // The server's own origin comes from api.serverInfo() (#601), resolved at
+  // REQUEST time (with port 0 the real port exists only once listening).
+  // config.baseUrl stays as an optional override for reverse-proxy edge
+  // cases. Every URL in a JRD (WebID, profile page, actor, issuer) is
+  // absolute against it — this used to require config.baseUrl and hard-fail
+  // boot; that whole finding is the serverInfo seam, merged in JSS 0.0.218.
+  const resolveBaseUrl = () => (api.config.baseUrl
+    ? String(api.config.baseUrl).replace(/\/$/, '')
+    : api.serverInfo().baseUrl.replace(/\/$/, ''));
   // `null`/`''` disables the `self` (ActivityPub actor) link — "IF
   // applicable" from the issue: a deployment without AP actors omits it.
   const actorPathTemplate = 'actorPathTemplate' in api.config
     ? api.config.actorPathTemplate
     : '/<user>/actor';
-
-  if (!baseUrl) {
-    // A JRD is nothing but absolute URLs of this server's own origin, and
-    // the plugin api exposes no server origin (same finding as mastodon/,
-    // notifications/, webdav/). Without it there is nothing truthful to
-    // serve, so unlike nip05 (whose document carries no self-origin URLs)
-    // this is a hard boot failure.
-    throw new Error(
-      'webfinger plugin requires config.baseUrl — the plugin api exposes no '
-      + 'server origin, and every URL in a JRD (WebID, profile page, actor, '
-      + 'issuer) is absolute against it (same finding as mastodon/notifications).',
-    );
-  }
   if (!podsRoot) {
     // Without a data root the plugin cannot resolve any user, so every
     // query 404s. Still activate (a purely additive discovery endpoint
@@ -138,7 +133,7 @@ export async function activate(api) {
   }
 
   /** Build the JRD for a resolved pod. `subject` echoes the query verbatim. */
-  function buildJrd(user, subject) {
+  function buildJrd(user, subject, baseUrl) {
     const podPath = user ? `/${user}/` : '/';
     const webid = `${baseUrl}${podPath}profile/card#me`;
     const profilePage = `${baseUrl}${podPath}profile/card`;
@@ -186,7 +181,7 @@ export async function activate(api) {
     }
     return reply
       .header('content-type', 'application/jrd+json; charset=utf-8')
-      .send(buildJrd(parsed.user, resource));
+      .send(buildJrd(parsed.user, resource, resolveBaseUrl()));
   }
 
   // Contract-safe mount: under the plugin's own prefix (WAC-exempt via the

webfinger/test.js

@@ -54,7 +54,10 @@ describe('webfinger plugin', () => {
       plugins: [{
         module: PLUGIN,
         prefix: '/webfinger',
-        config: { podsRoot: root, baseUrl: base },
+        // No baseUrl: the origin now comes from api.serverInfo() (#601).
+        // The JRD's absolute URLs (issuer, actor, WebID) below must still
+        // resolve to the server's real origin — that's the retrofit proof.
+        config: { podsRoot: root },
       }],
     });
   });