v4: users sign in to one gerbeur instance with their account on another — topic instances, each with its own admins, domain and data, had no way to share accounts. Sign-in is federated over a subset of OpenID Connect, the authorization code flow with PKCE: each instance is an identity provider for its own users and a client for the others', and signs what it tells them with an Ed25519 key kept in federation_keys and published at /.well-known/jwks.json, beside its metadata at /.well-known/openid-configuration. Only sign-in is federated: an account from another instance is a local users row linked to (issuer, subject) in user_identities, with no password (password_hash ''), so sessions, roles, permissions, the socket and every foreign key work as before.

A remote user is name@host here, in users.username, in paths (/@alice@music.example) and in mentions, through one handle rule in shared/validation.ts that paths, MENTION_RE and Markdown all build on; Markdown undoes GFM's email autolink of a handle. Their name, email and avatar come from their home at each sign-in and by its signed events (federation_outbox, delivered by the federation job with backoff): a rename at home leaves the old handle an alias here, and a password change or a withdrawn grant ends their sessions here. Their password, email, avatar and name can't change here (assertLocalUser), nor can they sign in elsewhere from here.

An admin keeps the trusted and blocked instances on /manage (federation:manage): a trusted instance's users sign in from a button on the login page, a blocked one's can't and are signed out at once, and any other's join with an invite from the register page. The /authorize page asks the user once per instance, and /settings lists the instances their account signs in to, each disconnectable; /login?next= brings a signed-out visitor back to /authorize. Emails stay unique among local accounts only, and migration 0024 adds the tables, makes that index partial and reserves authorize and federation as category slugs. remote/gerbeur-instance.ts is the only way to other instances: https and public addresses only, no redirects, no certificate fallback, unless GERBEUR_FEDERATION_ALLOW_PRIVATE lets two instances on one machine talk.

298 backend tests and 702 frontend tests pass, and deno check, deno fmt, deno lint, tsc, eslint, doc:lint and i18n:compile --strict are clean; checked end to end with two built instances on one machine: sign-in through the other's login and consent pages, consent skipped once granted and asked again after disconnecting, a rename and a password change at home reaching the other, and blocking; screenshots of the login, consent, profile, settings and manage pages at 1280 and 390px.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

api/services/federation-peer-service.ts

@@ -0,0 +1,125 @@
+/**
+ * Keeps the instances an admin trusts or blocks for federated sign-in
+ * (`federation_peers`). Users of a trusted instance sign in here directly,
+ * those of a blocked one never do, and an instance on neither list is invite
+ * only. `federation-service.ts` reads it at each sign-in, `/manage` edits it
+ * through `routes/federation.ts`, and the login page offers the trusted ones.
+ *
+ * @module
+ */
+
+import { APIException } from "../lib/api-exception.ts";
+import { db } from "../db/connection.ts";
+import { PUBLIC_URL } from "../config.ts";
+import {
+  type FederationPeer,
+  instanceHost,
+  isPeerStatus,
+  parseInstance,
+  type PeerStatus,
+} from "../../shared/federation.ts";
+import { fetchMetadata } from "../remote/gerbeur-instance.ts";
+import { closeUserSockets } from "./ws-service.ts";
+
+interface PeerRow {
+  issuer: string;
+  status: string;
+  name: string | null;
+  created_at: string;
+}
+
+/** Converts a row to a {@link FederationPeer}. */
+function rowToPeer(row: PeerRow): FederationPeer {
+  return {
+    issuer: row.issuer,
+    host: instanceHost(row.issuer),
+    name: row.name,
+    status: isPeerStatus(row.status) ? row.status : "blocked",
+    createdAt: new Date(row.created_at),
+  };
+}
+
+/**
+ * Returns what an admin decided about the instance at `issuer`, or null when
+ * it is on neither list.
+ */
+export function getPeerStatus(issuer: string): PeerStatus | null {
+  const row = db.prepare(
+    `SELECT status FROM federation_peers WHERE issuer = ?;`,
+  ).get(issuer) as { status: string } | undefined;
+  return row && isPeerStatus(row.status) ? row.status : null;
+}
+
+/**
+ * Returns the instances on the lists, by name: every one for `/manage`, or
+ * only the trusted ones, which the login page offers.
+ */
+export function listPeers(trustedOnly: boolean): FederationPeer[] {
+  const rows = db.prepare(
+    `SELECT issuer, status, name, created_at FROM federation_peers
+      ${trustedOnly ? "WHERE status = 'trusted'" : ""}
+      ORDER BY lower(coalesce(name, issuer));`,
+  ).all() as unknown as PeerRow[];
+  return rows.map(rowToPeer);
+}
+
+/**
+ * Puts the instance `instance` names on the list of `status`, for `/manage`,
+ * and returns it. It must answer as a gerbeur instance, whose name is kept.
+ * Blocking one ends the sessions of its users here at once: their tokens stop
+ * counting by `getSessionState`, and this closes their sockets.
+ *
+ * @throws {APIException} 400 when `instance` names no instance, or this one,
+ * 502 when it doesn't answer as a gerbeur instance.
+ */
+export async function setPeer(
+  instance: string,
+  status: PeerStatus,
+): Promise<FederationPeer> {
+  const issuer = parseInstance(instance);
+  if (!issuer) throw new APIException(400, "Not an instance's address");
+  if (issuer === PUBLIC_URL) {
+    throw new APIException(400, "That is this instance");
+  }
+  let name: string;
+  try {
+    name = (await fetchMetadata(issuer)).gerbeur_site_name;
+  } catch (err) {
+    console.error(`[federation] ${issuer} can't be added:`, err);
+    throw new APIException(502, "That address doesn't answer as a gerbeur");
+  }
+  db.prepare(
+    `INSERT INTO federation_peers (issuer, status, name, created_at)
+       VALUES (?, ?, ?, ?)
+     ON CONFLICT (issuer) DO UPDATE SET status = excluded.status, name = excluded.name;`,
+  ).run(issuer, status, name, new Date().toISOString());
+
+  if (status === "blocked") {
+    const users = db.prepare(
+      `SELECT user_id FROM user_identities WHERE issuer = ?;`,
+    ).all(issuer) as { user_id: string }[];
+    for (const { user_id } of users) {
+      closeUserSockets(user_id, "Instance blocked");
+    }
+  }
+
+  const row = db.prepare(
+    `SELECT issuer, status, name, created_at FROM federation_peers WHERE issuer = ?;`,
+  ).get(issuer) as unknown as PeerRow;
+  return rowToPeer(row);
+}
+
+/**
+ * Takes the instance whose host is `host` off the lists, for `/manage`: its
+ * users are invite only again, and those already here may sign in again if it
+ * was blocked.
+ *
+ * @throws {APIException} 404 when no listed instance has that host.
+ */
+export function removePeer(host: string): void {
+  const peer = listPeers(false).find((p) => p.host === host.toLowerCase());
+  if (!peer) throw new APIException(404, "Instance not found");
+  db.prepare(`DELETE FROM federation_peers WHERE issuer = ?;`).run(
+    peer.issuer,
+  );
+}