runlight 0.1.0 → 0.1.1

data/lib/runlight/accounts/accounts.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require "monitor"
+
 module Runlight
   module Accounts
     # Accounts: who may sign in, their password hashes, two-factor, invites, and the signed cookie that keeps them
@@ -32,14 +34,50 @@ module Runlight
       # A password checked against nothing, so a wrong email takes as long as a wrong password. Made when first needed.
       @decoy = nil
 
+      # Password checks run at once, in this process, and the most that may wait for one.
+      CHECKING = 4
+      WAITING = 64
+      SLOTS = Mutex.new
+      FREED = ConditionVariable.new
+      private_constant :SLOTS, :FREED
+      @running = 0
+      @waiting = 0
+
       class << self
         attr_accessor :decoy
+
+        # Runs a password check when one of the few slots is free, so a flood of sign-ins cannot take every core.
+        # Past the queue's length it refuses at once, with an AccountError coded "busy".
+        def slot
+          SLOTS.synchronize do
+            if @running >= CHECKING
+              raise AccountError.new("Runlight is busy checking other sign-ins. Try again in a moment.", "busy") if @waiting >= WAITING
+
+              @waiting += 1
+              begin
+                FREED.wait(SLOTS) while @running >= CHECKING
+              ensure
+                @waiting -= 1
+              end
+            end
+            @running += 1
+          end
+          begin
+            yield
+          ensure
+            SLOTS.synchronize do
+              @running -= 1
+              FREED.signal
+            end
+          end
+        end
       end
 
       def initialize(store, secret)
         @store = store
         @secret = secret
         @ready = false
+        @init_lock = Monitor.new
       end
 
       # A stored role read back; anything unknown reads as a viewer, the least it could be.
@@ -47,6 +85,11 @@ module Runlight
         ROLES.include?(value) ? value : "viewer"
       end
 
+      # Whether a role may invite people. The owner and admins invite as admin, member, or viewer.
+      def self.may_invite?(role)
+        role == "owner" || role == "admin"
+      end
+
       # Starts turning on two-factor: a new secret, kept aside until a code from it is confirmed.
       def start_two_factor(id)
         init
@@ -181,6 +224,8 @@ module Runlight
           raise AccountError.new("Ownership is handed over by the owner", "owner_hand_over") if role == "owner"
 
           @store.db.run("UPDATE rl_users SET role = ? WHERE id = ?", [role, id])
+          # Someone who may no longer invite takes back the invites they sent, so nobody joins on their word.
+          @store.db.run("DELETE FROM rl_invites WHERE invited_by = ?", [user["email"]]) unless self.class.may_invite?(role)
           user["role"] = role
           user
         end
@@ -212,6 +257,7 @@ module Runlight
           raise AccountError.new("The owner cannot be removed", "owner_protected") if user["role"] == "owner"
 
           @store.db.run("DELETE FROM rl_users WHERE id = ?", [id])
+          @store.db.run("DELETE FROM rl_invites WHERE invited_by = ?", [user["email"]])
           @store.set_setting("login-link-used:#{id}", nil)
         end
         nil
@@ -280,27 +326,44 @@ module Runlight
         before.positive?
       end
 
-      # Turns an invite into an account with the password its person chose. The link then stops working.
+      # Turns an invite into an account with the password its person chose. The link then stops working. It takes a
+      # turn, so it cannot cross a removal of whoever sent it, and the sender must still be someone who may invite.
       def accept_invite(code, password, now)
-        invite = invite_by_code(code, now)
-        raise AccountError.new("This invite has expired or was already used. Ask for a new one.", "invite_gone") if invite.nil?
-        unless by_email(invite["email"]).nil?
-          raise AccountError.new("#{invite["email"]} already has an account", "account_exists", { "email" => invite["email"] })
+        # The tables first: making them takes the same lock as a turn.
+        init
+        user = turn do
+          invite = invite_by_code(code, now)
+          next nil if invite.nil?
+
+          sender = by_email(invite["invitedBy"])
+          if sender.nil? || !self.class.may_invite?(sender["role"])
+            # Left without raising, since an error inside a turn on SQLite would roll this back.
+            @store.db.run("DELETE FROM rl_invites WHERE id = ?", [invite["id"]])
+            next nil
+          end
+          unless by_email(invite["email"]).nil?
+            raise AccountError.new("#{invite["email"]} already has an account", "account_exists", { "email" => invite["email"] })
+          end
+
+          made = set_password(invite["email"], password, now, invite["role"])
+          @store.db.run("DELETE FROM rl_invites WHERE id = ?", [invite["id"]])
+          made
         end
+        raise AccountError.new("This invite has expired or was already used. Ask for a new one.", "invite_gone") if user.nil?
 
-        user = set_password(invite["email"], password, now, invite["role"])
-        @store.db.run("DELETE FROM rl_invites WHERE id = ?", [invite["id"]])
         user
       end
 
-      # The account for an email and password, or nil. Takes the same time either way.
+      # The account for an email and password, or nil. Takes the same time either way. Only a few checks run at
+      # once; with too many waiting it raises an AccountError coded "busy".
       def sign_in(email, password)
         user = by_email(email)
         if user.nil?
-          Crypto.check_password(password, self.class.decoy ||= Crypto.hash_password(Crypto.hex(Crypto.random_bytes(16))))
+          hash = self.class.decoy ||= Crypto.hash_password(Crypto.hex(Crypto.random_bytes(16)))
+          self.class.slot { Crypto.check_password(password, hash) }
           return nil
         end
-        Crypto.check_password(password, user["hash"]) ? user : nil
+        self.class.slot { Crypto.check_password(password, user["hash"]) } ? user : nil
       end
 
       # A cookie value naming the user and when it expires, signed with the
@@ -348,15 +411,21 @@ module Runlight
 
       private
 
-      # Changes to who has an account take turns: on Postgres and MySQL across processes, through the database's
-      # lock, so two owners demoting each other at once cannot leave none, and a double-clicked invite makes one.
+      # Changes to who has an account take turns across threads and processes (the database's lock, or on SQLite a
+      # transaction that takes the write lock first), so two owners demoting each other at once cannot leave none,
+      # a double-clicked invite makes one, and a code or a sign-in link works once.
       def turn(&fn)
-        @store.db.exclusive { fn.call }
+        db = @store.db
+        db.respond_to?(:turn) ? db.turn { fn.call } : db.exclusive { fn.call }
       end
 
       def init
         return if @ready
 
+        @init_lock.synchronize { init_now unless @ready }
+      end
+
+      def init_now
         # Several processes starting at once create the tables one at a time.
         @store.db.exclusive do
           db = @store.db

data/lib/runlight/accounts/throttle.rb

@@ -3,15 +3,24 @@
 module Runlight
   module Accounts
     # Counts failed sign-ins under a key and refuses more than a few in a while.
-    # Keys are hashed with a key made on first use, so the counts never hold an
-    # address or an email as it was given.
+    # Keys are hashed with a key made for each UTC day, so the counts never hold
+    # an address or an email as it was given.
     #
     # TypeScript keeps the counts in its process. Here they live in the database's
     # settings, as "throttle:<name>:<id>" holding {count, until}, and the hashing
-    # key as "throttle-key", so every process of an install shares the same counts.
+    # key as "throttle-key:<UTC day>", so every process of an install shares the
+    # same counts. Some keys are addresses, and nothing derived from one lasts
+    # longer than a day: an expired count is deleted when it is read and by the
+    # scheduled check (sweep), and a day's hashing key goes once the day is over
+    # (yesterday's is kept only long enough to carry a count across midnight).
     class Throttle
-      KEY = "throttle-key"
-      private_constant :KEY
+      KEY = "throttle-key:"
+      # The one hashing key from before keys were made per day.
+      LEGACY_KEY = "throttle-key"
+      DAY_MS = 86_400_000
+      # How long after midnight yesterday's key carries a count over: the longest window a throttle counts in.
+      CARRY_MS = 15 * 60_000
+      private_constant :KEY, :LEGACY_KEY, :DAY_MS, :CARRY_MS
 
       def initialize(store, name, limit = 10, window_ms = 15 * 60_000)
         @store = store
@@ -20,8 +29,35 @@ module Runlight
         @window_ms = window_ms
       end
 
+      # Deletes every count that has run out and the hashing keys of days gone, for the scheduled check.
+      def self.sweep(store, now)
+        store.settings_starting_with("throttle:").each do |row|
+          entry = Json.try_decode(row["value"])
+          until_ms = entry.is_a?(Hash) ? Js.number(entry["until"].nil? ? 0 : entry["until"]) : 0
+          store.set_setting(row["key"], nil) unless until_ms.is_a?(Numeric) && until_ms.finite? && until_ms > now
+        end
+        drop_old_keys(store, now)
+      end
+
+      # The UTC day a time falls on, as YYYY-MM-DD.
+      def self.day(now)
+        Time.at(now.to_i / 1000).utc.strftime("%Y-%m-%d")
+      end
+
+      # Keeps today's hashing key, and yesterday's only just after midnight; the one from before days goes too.
+      def self.drop_old_keys(store, now)
+        keep = [day(now)]
+        keep << day(now - DAY_MS) if now.to_i % DAY_MS < CARRY_MS
+        store.set_setting(LEGACY_KEY, nil) unless store.setting(LEGACY_KEY).nil?
+        store.settings_starting_with(KEY).each do |row|
+          store.set_setting(row["key"], nil) unless keep.include?(row["key"][KEY.length..])
+        end
+      end
+
       def blocked(key, now)
-        blocked_id?(id(key), now)
+        today, yesterday = ids(key, now)
+        entry = entry(today, now) || (yesterday && entry(yesterday, now))
+        blocked_entry?(entry)
       end
 
       # Counts a try before the slow check it guards, so a burst that arrives
@@ -29,43 +65,75 @@ module Runlight
       # False, counting nothing, when the key is already at its limit. A try
       # that turns out right is taken back with forgive().
       def take(key, now)
-        id = id(key)
-        return false if blocked_id?(id, now)
-
-        count(id, now)
-        true
+        ids = ids(key, now)
+        # Checked and counted in one turn, so tries at once from other threads and processes wait for it.
+        turn do
+          entry = carry(ids, now)
+          next false if blocked_entry?(entry)
+
+          count(ids[0], entry, now)
+          true
+        end
       end
 
       # Takes back one counted try, for one that turned out right.
-      def forgive(key)
-        id = id(key)
-        entry = entry(id)
-        return unless entry && entry["count"].positive?
-
-        entry["count"] -= 1
-        save(id, entry)
+      def forgive(key, now)
+        ids = ids(key, now)
+        turn do
+          entry = carry(ids, now)
+          next unless entry && entry["count"].positive?
+
+          entry["count"] -= 1
+          save(ids[0], entry)
+        end
+        nil
       end
 
       def record_failure(key, now)
-        count(id(key), now)
+        ids = ids(key, now)
+        turn { count(ids[0], carry(ids, now), now) }
+        nil
       end
 
-      def clear(key)
-        @store.set_setting("#{prefix}#{id(key)}", nil)
+      def clear(key, now)
+        ids(key, now).compact.each { |id| @store.set_setting("#{prefix}#{id}", nil) }
+        nil
       end
 
       private
 
-      def salt
-        saved = @store.setting(KEY)
+      # The day's hashing key, made the first time it is needed (unless make is false, for yesterday's).
+      def salt(now, make = true)
+        name = "#{KEY}#{self.class.day(now)}"
+        saved = @store.setting(name)
         return saved if saved && saved != ""
+        return nil unless make
 
-        made = Hashing.random_id(16)
-        @store.set_setting(KEY, made)
-        made
+        # Made in a turn, so two processes starting at once do not each keep a different one.
+        turn do
+          saved = @store.setting(name)
+          next saved if saved && saved != ""
+
+          made = Hashing.random_id(16)
+          @store.set_setting(name, made)
+          self.class.drop_old_keys(@store, now)
+          made
+        end
+      end
+
+      # One change to the counts at a time, across threads and processes, as the accounts take turns.
+      def turn(&block)
+        db = @store.db
+        db.respond_to?(:turn) ? db.turn { block.call } : db.exclusive { block.call }
       end
 
-      def id(key)
+      # The key's id under today's hashing key, and under yesterday's while that is still kept (else nil).
+      def ids(key, now)
+        yesterday = salt(now - DAY_MS, false)
+        [keyed(salt(now), key), yesterday.nil? ? nil : keyed(yesterday, key)]
+      end
+
+      def keyed(salt, key)
         Crypto.base64url(Crypto.hmac("SHA-256", salt, key))[0, 22]
       end
 
@@ -73,10 +141,31 @@ module Runlight
         "throttle:#{@name}:"
       end
 
-      def entry(id)
+      # A count that has not run out, or nil. One that has is deleted as it is read.
+      def entry(id, now)
         saved = @store.setting("#{prefix}#{id}")
-        entry = saved.nil? ? nil : Json.try_decode(saved)
-        entry.is_a?(Hash) ? { "count" => int(entry["count"]), "until" => int(entry["until"]) } : nil
+        return nil if saved.nil?
+
+        entry = Json.try_decode(saved)
+        entry = entry.is_a?(Hash) ? { "count" => int(entry["count"]), "until" => int(entry["until"]) } : nil
+        return entry if entry && entry["until"] > now
+
+        @store.set_setting("#{prefix}#{id}", nil)
+        nil
+      end
+
+      # Today's count, or yesterday's moved under today's id, so a window that crosses midnight goes on.
+      def carry(ids, now)
+        today, yesterday = ids
+        found = entry(today, now)
+        return found if found || yesterday.nil?
+
+        found = entry(yesterday, now)
+        return nil if found.nil?
+
+        @store.set_setting("#{prefix}#{yesterday}", nil)
+        save(today, found)
+        found
       end
 
       # A saved number, whole, and 0 for anything that is not a number.
@@ -89,16 +178,12 @@ module Runlight
         @store.set_setting("#{prefix}#{id}", Json.encode(entry))
       end
 
-      def blocked_id?(id, now)
-        entry = entry(id)
-        return false if entry.nil? || entry["until"] <= now
-
-        entry["count"] >= @limit
+      def blocked_entry?(entry)
+        !entry.nil? && entry["count"] >= @limit
       end
 
-      def count(id, now)
-        entry = entry(id)
-        if entry.nil? || entry["until"] <= now
+      def count(id, entry, now)
+        if entry.nil?
           save(id, { "count" => 1, "until" => now + @window_ms })
           prune(now)
           return

data/lib/runlight/accounts/web.rb

@@ -44,16 +44,22 @@ module Runlight
         @home_path = "#{@base}/"
         @asks_for_token = @first.is_a?(Hash) && @first.key?("token")
         @existing = false
-        # Wrong passwords are counted twice. Per account and address, ten tries;
+        # Wrong passwords are counted three times. Per account and address, ten tries;
         # per account from anywhere, fifty, so a caller who invents a new address
         # for every try still cannot guess on and on. Addresses come from
-        # forwarding headers a client can write, so they never stand alone.
+        # forwarding headers a client can write, so they never stand alone. And per
+        # address across every account, thirty, so one caller trying made-up emails
+        # cannot keep the server hashing; a request with no known address skips that one,
+        # since it would hold up everyone at once.
         # Each try counts before the password is checked, and a right one is taken back.
         @per_address = Throttle.new(@store, "address", 10)
         @per_account = Throttle.new(@store, "account", 50)
+        @per_ip = Throttle.new(@store, "ip", 30)
         # Six-digit codes: five wrong tries an account every fifteen minutes, and five to confirm the first one.
         # Password re-checks in Account: ten.
         @code_tries = Throttle.new(@store, "code", 5)
+        # A decoy ticket's tries count apart, the same way, so someone guessing passwords cannot use up the owner's five.
+        @decoy_tries = Throttle.new(@store, "decoy", 5)
         @confirm_tries = Throttle.new(@store, "confirm", 5)
         @rechecks = Throttle.new(@store, "recheck", 10)
       end
@@ -70,21 +76,26 @@ module Runlight
       # Only a path on this install, so a sign-in can never send someone elsewhere.
       # Browsers drop tabs and newlines from a URL and read a backslash as a slash,
       # so "/\t/evil.example" would leave; anything with those is refused outright,
-      # and what is left must resolve to this origin.
+      # and what is left must resolve to this origin. A path that resolves to one
+      # starting "//", as "/..//evil.example" does, would leave from the Location
+      # header, so that goes home too.
       def safe_next(value)
         return @home_path if value.nil? || value == "" || !value.start_with?("/") || value.match?(/[\x00-\x1f\x7f\\]/)
 
         url = Http::Url.parse(value, "http://runlight.invalid")
-        !url.nil? && url.origin == "http://runlight.invalid" ? "#{url.pathname}#{url.search}#{url.hash}" : @home_path
+        return @home_path if url.nil? || url.origin != "http://runlight.invalid"
+
+        path = "#{url.pathname}#{url.search}#{url.hash}"
+        path.start_with?("//") || path.start_with?("/\\") ? @home_path : path
       end
 
       def signed_in(request)
         value = read_cookie(request, Accounts::SESSION_COOKIE)
         return nil if value == ""
 
+        # A cookie that is not valid percent-encoding is nobody's session, never an error.
         decoded = Js.decode_uri_component(value)
-        # decodeURIComponent throws a URIError here in TypeScript.
-        raise ArgumentError, "URI malformed" if decoded.nil?
+        return nil if decoded.nil?
 
         @accounts.from_session(decoded, now)
       end
@@ -143,6 +154,12 @@ module Runlight
         @now.call
       end
 
+      # The store's tables, settings among them, which the throttles keep their counts in (TypeScript keeps them
+      # in memory), so a fresh install's first sign-in or two-factor change finds them there.
+      def ready
+        @rl.init if @rl.respond_to?(:init)
+      end
+
       def home_origin
         @home&.call
       end
@@ -378,6 +395,7 @@ module Runlight
         end
 
         if path == "/login/code" && method == "POST"
+          ready
           form = Http::SearchParams.new(request.text)
           next_path = safe_next(form.get("next"))
           pending = @accounts.from_pending(form.get("pending") || "", now)
@@ -386,7 +404,7 @@ module Runlight
           user = pending["user"]
           real = pending["real"]
           # Counted before the check, so a burst cannot get past five.
-          unless @code_tries.take(user["id"], now)
+          unless (real ? @code_tries : @decoy_tries).take(user["id"], now)
             return html(Pages.code_page(base, { "pending" => form.get("pending") || "", "next" => next_path, "error" => "Too many tries. Wait fifteen minutes and try again." }), 429)
           end
           if !real || !@accounts.check_second_factor(user["id"], form.get("code") || "", now)
@@ -394,7 +412,7 @@ module Runlight
                                                 "error" => "That code is not right. Check the time on your phone, or use a recovery code." }), 401)
           end
 
-          @code_tries.clear(user["id"])
+          @code_tries.clear(user["id"], now)
           return signed_in_to(request, user, next_path)
         end
 
@@ -424,6 +442,8 @@ module Runlight
               @existing = true
               return redirect(@home_path, { "set-cookie" => session_cookie(request, @accounts.session_for(user, now), Accounts::SESSION_MS / 1000) })
             rescue RangeError => e
+              return html(Pages.invite_gone_page(base), 410) if e.is_a?(AccountError) && e.code == "invite_gone"
+
               return again.call(e.message)
             end
           end
@@ -432,6 +452,7 @@ module Runlight
       end
 
       def login(request, context)
+        ready
         base = @base
         form = Http::SearchParams.new(request.text)
         email = form.get("email") || ""
@@ -442,6 +463,7 @@ module Runlight
         pair = "#{account}\n#{ip == "" ? "unknown" : ip}"
         login_page = ->(opts) { Pages.login_page(base, opts.merge("next" => next_path, "forgot" => @forgot) { |_k, mine, _theirs| mine }) }
         too_many = -> { html(login_page.call({ "error" => "Too many tries. Wait fifteen minutes and try again.", "email" => email }), 429) }
+        return too_many.call if ip != "" && !@per_ip.take(ip, now)
         return too_many.call unless @per_address.take(pair, now)
 
         # A browser that signed in to the account before is never held up by others' failures.
@@ -474,12 +496,18 @@ module Runlight
 
           return html(login_page.call({ "error" => "That email and password do not match an account.", "email" => email }), 401)
         end
-        @per_address.clear(pair)
-        @per_account.forgive(account) if !over && !trusted
+        @per_address.clear(pair, now)
+        @per_ip.forgive(ip, now) if ip != ""
+        @per_account.forgive(account, now) if !over && !trusted
         # With two-factor on, the password only earns the second step.
         return html(Pages.code_page(base, { "pending" => @accounts.pending_for(user, now), "next" => next_path })) if user["twoFactor"]
 
         signed_in_to(request, user, next_path)
+      rescue AccountError => e
+        # Too many password checks already waiting, so this one was never run: try again in a moment.
+        raise unless e.code == "busy"
+
+        html(login_page.call({ "error" => e.message, "email" => email }), 503, { "retry-after" => "5" })
       end
 
       # Your own account, and for the owner and admins, everyone else's.
@@ -487,6 +515,7 @@ module Runlight
         user = signed_in(request)
         return coded("Sign in first", "sign_in", 401) if user.nil?
 
+        ready
         now = self.now
         method = request.method
         # Writes must be JSON, which a form on another page cannot send, even those with no body.
@@ -495,9 +524,16 @@ module Runlight
 
         recheck = lambda do |input, name, wrong|
           return coded("Too many tries. Wait fifteen minutes and try again.", "too_many_tries", 429) unless @rechecks.take(user["id"], now)
-          return coded(wrong[0], wrong[1], 400) if @accounts.sign_in(user["email"], field(input, name)).nil?
+          begin
+            right = @accounts.sign_in(user["email"], field(input, name))
+          rescue AccountError => e
+            raise unless e.code == "busy"
+
+            return coded("Runlight is busy checking other sign-ins. Try again in a moment.", "busy", 503)
+          end
+          return coded(wrong[0], wrong[1], 400) if right.nil?
 
-          @rechecks.forgive(user["id"])
+          @rechecks.forgive(user["id"], now)
           nil
         end
         fresh = ->(updated) { { "set-cookie" => session_cookie(request, @accounts.session_for(updated, now), Accounts::SESSION_MS / 1000) } }
@@ -532,7 +568,7 @@ module Runlight
             codes = @accounts.confirm_two_factor(user["id"], field(input, "code").gsub(/[#{Js::SPACE}]/o, ""), now)
             return coded("That code is not right. Check the time on your phone and try the next one.", "code_wrong", 400) if codes.nil?
 
-            @confirm_tries.clear(user["id"])
+            @confirm_tries.clear(user["id"], now)
             # Turning it on signs out every other browser; this one gets a new session.
             updated = @accounts.by_id(user["id"])
             return reply({ "recovery" => codes }, 200, fresh.call(updated))
@@ -541,7 +577,7 @@ module Runlight
           return refused unless refused.nil?
 
           if action == "/start"
-            @confirm_tries.clear(user["id"])
+            @confirm_tries.clear(user["id"], now)
             secret = @accounts.start_two_factor(user["id"])
             return reply({ "secret" => secret, "uri" => Crypto.otpauth_uri(secret, user["email"], Http::Url.new(request.url).host) })
           end

data/lib/runlight/assistant.rb

@@ -85,8 +85,18 @@ module Runlight
       message.is_a?(String) ? message : ""
     end
 
+    # Refuses a service at a link-local or cloud metadata address. One on this computer (Ollama, LM Studio) or a
+    # private network is allowed, as the person setting it up means it to be.
+    def refuse_metadata(url)
+      host = Http::Url.new(url).hostname
+      return unless Safefetch.metadata_host?(host)
+
+      raise AssistantError.new("#{host} is a link-local or cloud metadata address, which Runlight never connects to", "address_refused", { "host" => host })
+    end
+
     def post(fetcher, url, headers, body, deadline, now, cancelled)
       in_time(deadline, now, cancelled)
+      refuse_metadata(url)
       left = deadline - now.call
       begin
         answer = fetcher.fetch(url, {
@@ -293,6 +303,7 @@ module Runlight
                 elsif key != "" then { "authorization" => "Bearer #{key}" }
                 else {}
                 end
+      refuse_metadata(base)
       begin
         answer = fetcher.fetch("#{base}/models#{provider["protocol"] == "anthropic" ? "?limit=100" : ""}", { "headers" => headers, "timeoutMs" => 20_000 })
       rescue StandardError

data/lib/runlight/connect.rb

@@ -136,9 +136,8 @@ module Runlight
     def finish_connect(runlight, params)
       state = params.get("state") || ""
       key = "connect:#{state}"
-      stored = state.match?(/\A[a-f0-9]{32}\z/) ? runlight.store.setting(key) : nil
-      # Each attempt works once.
-      runlight.store.set_setting(key, nil) if !stored.nil? && stored != ""
+      # Each attempt works once, even when it comes back twice at once.
+      stored = state.match?(/\A[a-f0-9]{32}\z/) ? runlight.store.take_setting(key) : nil
       pending = !stored.nil? && stored != "" ? pending_from(stored, runlight.now) : nil
       if pending.nil?
         raise ConnectError.new("That connection took too long or was already used. Start again.", "expired")

data/lib/runlight/core.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require "monitor"
+
 module Runlight
   # Runlight in an app: the sites it counts, the tracker endpoint's work, short links, email reports, and the
   # scheduled upkeep. A port of the TypeScript SDK's runlight.ts; `Runlight.new(options)` makes one.
@@ -132,6 +134,8 @@ module Runlight
       @remote_seen = {}
       @overrides = {}
       @ready = false
+      # init runs once however many threads ask at once; reentrant, as init may ask for itself.
+      @init_lock = Monitor.new
       @checking = false
       # When planner statistics were last gathered.
       @optimized_at = 0
@@ -211,6 +215,10 @@ module Runlight
       config = settings.merge("from" => from)
       config["fromName"] = from_name unless from_name == ""
       Mail::Transports.check_config(config)
+      if config["service"] == "smtp" && Js.truthy?(config["host"]) && Safefetch.metadata_host?(config["host"].to_s)
+        raise Mail::MailError.new("#{config["host"]} is a link-local or cloud metadata address, which Runlight never connects to", "address_refused",
+                                  { "host" => config["host"] })
+      end
       @store.set_setting("mail", Mail::Secret.seal(Json.encode(config), @secret))
     end
 
@@ -275,6 +283,15 @@ module Runlight
     def init
       return if @ready
 
+      @init_lock.synchronize { init_now unless @ready }
+    end
+
+    # Whether init has run, so middleware can leave the app's own requests alone until it has.
+    def ready?
+      @ready
+    end
+
+    private def init_now
       @store.migrate
       # A database that never had its statistics gathered gets them now, before any report is read, rather
       # than at the first scheduled check, which an app may never run.
@@ -601,6 +618,10 @@ module Runlight
         if parsed.nil? || (parsed.protocol != "https:" && parsed.protocol != "http:")
           raise SettingsError.new("Enter the service's address, starting with https://", "assistant_address_bad")
         end
+        if Safefetch.metadata_host?(parsed.hostname)
+          raise SettingsError.new("#{parsed.hostname} is a link-local or cloud metadata address, which Runlight never connects to", "address_refused",
+                                  { "host" => parsed.hostname })
+        end
       end
       raise SettingsError.new("Enter the service's address", "assistant_address") if base_url == "" && provider["baseUrl"] == ""
 
@@ -1335,6 +1356,8 @@ module Runlight
       @salts = {}
       sites.map { |site| site["timezone"] }.uniq.each { |timezone| current_salts(now, timezone) }
       drop_old_salts(now)
+      # Sign-in counts that have run out, some keyed by an address, and the hashing keys of days gone.
+      Accounts::Throttle.sweep(@store, now)
       # Every site's retention covers any one site's that is still waiting.
       @pruning = []
       begin