FEP-ae97: Update proposal (#813)

- Added sequence diagram describing the registration process.
- Require server to return keys on a repeated registration request.
- Do not accept key IDs provided by the server.
- Clarify that server-to-server versions of activities are used.
- Require client to verify incoming FEP-ef61 activities.
- Updated implementation list.

Reviewed-on: https://codeberg.org/fediverse/fep/pulls/813
Co-authored-by: silverpill <silverpill@firemail.cc>
Co-committed-by: silverpill <silverpill@firemail.cc>

fep/ae97/fep-ae97.md

@@ -37,6 +37,20 @@ Example:
 
 ## Registering an actor
 
+```mermaid
+sequenceDiagram
+  participant Client
+  participant Server
+  Note right of Client: Client generates signing keys and creates an actor
+  Client ->> Server: GET /.well-known/apgateway
+  Server ->> Client: Returns information about itself
+  Client ->> Server: POST /.well-known/apgateway
+  Note left of Server: Server creates an account for the actor
+  Server ->> Client: Returns HTTP signature keys
+  Note right of Client: Client adds server's keys to the actor
+  Client ->> Server: POST Update(Actor) to outbox
+```
+
 Client creates portable actor objects according to [FEP-ef61] and stores them. When a portable actor is created, the client MUST create a key for signing requests (the main actor key) and add a `Multikey` representation of it to the `assertionMethod` array as described in [FEP-521a]. The identifier of that key MUST NOT be a [compatible identifier][CompatibleIdentifiers].
 
 Before registering a portable actor on the server, the client MUST add the server URL to the `gateways` array of the actor object.
@@ -58,16 +72,20 @@ Example:
 }
 ```
 
+If the actor is already registered, the server MUST return the same keys in a response with a `200 OK` status code.
+
 If the server can't register the actor, it MUST return a `400 Bad Request` status code.
 
 If the registration is successful, the client MUST attach the RSA key to the actor object via `publicKey` property, and also add it to the `assertionMethod` array as described in [FEP-521a]. If the server's response contains other keys, they SHOULD be added to the `assertionMethod` array as well.
 
-If the client uses [compatible identifiers][CompatibleIdentifiers], then key identifiers MUST be generated with the server's [origin][Origin].
+If the client uses [compatible identifiers][CompatibleIdentifiers], then key identifiers MUST be generated with the server's [origin][Origin]. However, the client MUST NOT use key identifiers provided by the server (if they were present in the server's response).
 
 After updating the actor object, the client MUST publish an `Update` activity for it.
 
 ## Sending activities
 
+Activities generated by a client MUST adhere to ActivityPub server-to-server protocol specification.
+
 The client submits signed [FEP-ef61] activities to actor's outbox. Contrary to what ActivityPub specification prescribes in section [6. Client to Server Interactions](https://www.w3.org/TR/activitypub/#client-to-server-interactions), the server MUST NOT overwrite the ID of an activity. Instead of assigning a new ID, the server MUST verify that provided ID has not been used before. If the server accepts activity, its response MUST have `202 Accepted` status code.
 
 If activity contains a wrapped object (as in `Create` and `Update` activities), it MUST be a portable object created according to [FEP-ef61]. The server MUST validate object IDs in the same way it validates activity IDs.
@@ -90,6 +108,8 @@ If the owner of the inbox is not registered, the server MUST return a `404 Not F
 
 If the actor that generated the signature is different from the inbox owner, the server MUST return a `403 Forbidden` status code.
 
+Clients MUST verify received portable activities. Non-portable activities MAY be accepted without verification.
+
 ## Media API
 
 ### Upload media
@@ -136,8 +156,10 @@ Precautions need also be taken when objects with compatible IDs are delivered to
 
 ## Implementations
 
-- [fep-ae97-client](https://codeberg.org/silverpill/fep-ae97-client) (client)
 - Mitra (server)
+- [Mitra Mini](https://codeberg.org/silverpill/minimitra) (desktop / headless client)
+- [fep-ae97-client](https://codeberg.org/silverpill/fep-ae97-client) (command line client)
+- [fep-ae97-web-client](https://codeberg.org/silverpill/fep-ae97-web-client) (web client)
 
 ## References