runlight 0.1.0 → 0.1.1

data/lib/runlight/routes.rb

@@ -18,7 +18,10 @@ module Runlight
   # - cronSecret: also accepted as a bearer token on POST /api/check. Defaults to CRON_SECRET.
   # - observeKey: lets another site report AI agent fetches to POST /api/observe. Defaults to RUNLIGHT_OBSERVE_KEY.
   # - signOut, signIn: links the dashboard shows. The standalone server sets them.
-  # - accounts: true for sign-in accounts, or a Runlight::Accounts::Web of your own.
+  # - accounts: true for sign-in accounts, or a Runlight::Accounts::Web of your own. Sessions are signed with the
+  #   Core's secret (RUNLIGHT_SECRET, else RUNLIGHT_TOKEN). With the token left nil and no secret, only
+  #   development makes one up (a restart signs everyone out); anywhere else that raises ArgumentError, since
+  #   each process of an app would make its own and sign the others' sessions out.
   # - geoCredit: credits DB-IP in the dashboard's footer.
   # - origin: the address people open the app at, such as https://example.com.
   # - ownHosts: a callable returning more names the dashboard is reached at.
@@ -73,9 +76,7 @@ module Runlight
     EMAIL = /\A[^#{Js::SPACE}@<>"]+@[^#{Js::SPACE}@<>"]+\.[^#{Js::SPACE}@<>"]+\z/
     # A dashboard's origin, which a picker ticket names.
     ORIGIN = %r{\Ahttps?://[^/?\##{Js::SPACE}]+\z}
-    # An address a report's links may point back to.
-    HOME = %r{\Ahttps?://[^#{Js::SPACE}]+\z}
-    private_constant :EMAIL, :ORIGIN, :HOME
+    private_constant :EMAIL, :ORIGIN
 
     # The files in assets/, read once per process.
     @assets = {}
@@ -118,11 +119,17 @@ module Runlight
 
       # Accounts: the standalone server passes its own, and an app turns them on with true. Sessions need a secret
       # that outlives the process; in development without one, a made-up one does, so a restart signs everyone out.
-      # An app left open on purpose (token: nil) is treated like development here.
+      # An app left open on purpose (token: nil) is treated like development for the first account, but outside
+      # development it still needs a real secret: TypeScript runs as one process, where a made-up one only lasts
+      # until a restart, but a Ruby app usually runs several, and each would sign the others' sessions out.
       token = @token
       open_setup = token.nil? || (token == "" && development?)
-      account_secret = runlight.secret || (open_setup ? Hashing.random_id(32) : nil)
       accounts = options["accounts"]
+      if accounts == true && token.nil? && runlight.secret.to_s.empty? && !development?
+        raise ArgumentError, "Runlight: accounts need a secret every process shares; set RUNLIGHT_SECRET (or pass secret:) to a long random string"
+      end
+
+      account_secret = runlight.secret || (open_setup ? Hashing.random_id(32) : nil)
       @web = if accounts.is_a?(Accounts::Web)
                accounts
              elsif accounts == true && !account_secret.nil? && account_secret != ""
@@ -504,7 +511,7 @@ module Runlight
     extend Helpers
     include Helpers
 
-    PUBLIC_HELPERS = %i[coded json json? host_name cookie_value read_cookie bearer normalise_base dashboard manage_path].freeze
+    PUBLIC_HELPERS = %i[coded json json? host_name cookie_value read_cookie bearer normalise_base dashboard manage_path oauth_document?].freeze
     private_constant :PUBLIC_HELPERS
     private(*Helpers.instance_methods(false))
     private_class_method(*(Helpers.instance_methods(false) - PUBLIC_HELPERS))
@@ -536,7 +543,8 @@ module Runlight
       end
     end
 
-    # The routes as a Rack app. The answer to a HEAD has no body.
+    # The routes as a Rack app. The answer to a HEAD has no body. Once the answer is sent, the work left for
+    # later (a retention change's deletions) runs in the Core's idle, as RackApp runs it.
     def call(env)
       begin
         request = Http::Request.from_rack(env)
@@ -545,7 +553,12 @@ module Runlight
                 [Json.encode({ "error" => "That request is too large" })]]
       end
       status, headers, body = handle(request).to_rack
-      [status, headers, request.method == "HEAD" ? [] : body]
+      idle = lambda do
+        @rl.idle
+      rescue StandardError => e
+        warn("Runlight: #{e.message}")
+      end
+      [status, headers, RackApp::Body.new(request.method == "HEAD" ? [] : body, idle)]
     end
 
     private
@@ -764,6 +777,44 @@ module Runlight
       Http::Response.new(answer.text, status: answer.status, headers: back)
     end
 
+    # The checks a link domain passes before a site gets it, from Settings or from an import: the name as it
+    # is kept, or the refusal to send.
+    def check_link_domain(request, url, site, value)
+      domain = Js.lower(Js.trim(value))
+      domain = domain.sub(%r{\Ahttps?://}, "")
+      domain = domain.sub(%r{/.*\z}, "")
+      domain = domain.sub(/\.+\z/, "")
+      domain = domain.sub(/\Awww\./, "")
+      return coded("That is not a domain name", "domain_invalid", 400) unless domain.match?(DOMAIN_NAME)
+
+      if private_name?(domain) || Safefetch.resolves_privately?(domain)
+        return coded("#{domain} is not a public domain name. Use one that browsers anywhere can reach.", "domain_not_public", 400, { "domain" => domain })
+      end
+
+      # A link domain answers every path on it, so it must never be where the dashboard or a counted site lives.
+      # The request's own Host is the caller's to choose, so the configured address and the names people
+      # signed in from count too. A hub cannot know every name this app answers on, so it adds none until
+      # the app knows its own address.
+      return origin_needed if @managed.key?(request) && @origin.nil?
+
+      here = [request.headers.get("host"), request.headers.get("x-forwarded-host"), url.host].select { |h| Js.truthy?(h) }
+      own = [*(@origin.nil? ? [] : [Http::Url.new(@origin).host]), *here]
+      @options["ownHosts"]&.call&.each { |host| own << host.to_s }
+      taken = own.map { |h| host_name(h) }
+      sites.each do |s|
+        taken.concat(s["hostnames"])
+        taken.concat(@rl.remote(s["id"])&.[]("hostnames") || [])
+      end
+      if taken.include?(domain)
+        return coded("#{domain} is where this dashboard or one of your sites lives. Use a separate domain or subdomain for short links, such as go.#{domain}.", "domain_in_use", 400, { "domain" => domain })
+      end
+
+      owner = store.link_domains.find { |d| d["domain"] == domain }
+      return coded("#{domain} already belongs to another site", "domain_taken", 409, { "domain" => domain }) if !owner.nil? && owner["site"] != site
+
+      domain
+    end
+
     def links_api(request, path, url)
       @rl.init
       site = query_site(url)
@@ -778,41 +829,9 @@ module Runlight
             body = read_json(request)
             return body if body.is_a?(Http::Response)
 
-            domain = Js.lower(Js.trim(text(body, "domain")))
-            domain = domain.sub(%r{\Ahttps?://}, "")
-            domain = domain.sub(%r{/.*\z}, "")
-            domain = domain.sub(/\.+\z/, "")
-            domain = domain.sub(/\Awww\./, "")
-            return coded("That is not a domain name", "domain_invalid", 400) unless domain.match?(DOMAIN_NAME)
+            domain = check_link_domain(request, url, site["id"], text(body, "domain"))
+            return domain if domain.is_a?(Http::Response)
 
-            if private_name?(domain) || Safefetch.resolves_privately?(domain)
-              return coded("#{domain} is not a public domain name. Use one that browsers anywhere can reach.", "domain_not_public", 400, { "domain" => domain })
-            end
-
-            # A link domain answers every path on it, so it must never be where the dashboard or a counted site lives.
-            # The request's own Host is the caller's to choose, so the configured address and the names people
-            # signed in from count too. A hub cannot know every name this app answers on, so it adds none until
-            # the app knows its own address.
-            return origin_needed if @managed.key?(request) && @origin.nil?
-
-            here = [request.headers.get("host"), request.headers.get("x-forwarded-host"), url.host].select { |h| Js.truthy?(h) }
-            own = [*(@origin.nil? ? [] : [Http::Url.new(@origin).host]), *here]
-            @options["ownHosts"]&.call&.each { |host| own << host.to_s }
-            taken = own.map { |h| host_name(h) }
-            sites.each do |s|
-              taken.concat(s["hostnames"])
-              taken.concat(@rl.remote(s["id"])&.[]("hostnames") || [])
-            end
-            if taken.include?(domain)
-              return coded("#{domain} is where this dashboard or one of your sites lives. Use a separate domain or subdomain for short links, such as go.#{domain}.", "domain_in_use", 400, { "domain" => domain })
-            end
-
-            store.link_domains.each do |d|
-              next unless d["domain"] == domain
-              return coded("#{domain} already belongs to another site", "domain_taken", 409, { "domain" => domain }) if d["site"] != site["id"]
-
-              break
-            end
             store.add_link_domain(domain, site["id"], @rl.now)
             @rl.forget_link_domains
             return json({ "domain" => domain }, 201)
@@ -903,6 +922,11 @@ module Runlight
               credentials(Js.get(body, "credentials")),
               cursor.is_a?(String) ? cursor : nil,
               done.is_a?(Float) && done.nan? ? 0 : done,
+              # An imported link's domain passes the same checks as one added in Settings, or the link comes over without it.
+              lambda do |domain|
+                checked = check_link_domain(request, url, site["id"], domain)
+                checked.is_a?(Http::Response) ? nil : checked
+              end,
             )
             return json(step)
           rescue Importers::ImportError => e
@@ -1208,13 +1232,13 @@ module Runlight
             end
             return coded("A site can send to at most 50 addresses", "report_limit", 400) if existing.length >= 50
 
-            # Links in the email point back to the configured address, or else to this dashboard as the
-            # browser sees it. A report made from a hub needs the configured address, where its unsubscribe
-            # link answers, since the Host its request names is the hub's to choose.
+            # Links in the email point back to the configured address, or else to this dashboard at the address
+            # the request came to. An address in the body is never used, so whoever adds a report cannot point
+            # its links somewhere else. A report made from a hub needs the configured address, where its
+            # unsubscribe link answers, since the Host its request names is the hub's to choose.
             return origin_needed if @managed.key?(request) && @origin.nil?
 
-            given = @origin.nil? ? text(body, "origin") : ""
-            home = Js.scrub(given).match?(HOME) ? given.sub(%r{/+\z}, "") : "#{@origin || url.origin}#{@base}"
+            home = "#{@origin || url.origin}#{@base}"
             # A period already due counts as sent, so a report added mid-week first goes out on the next Monday, as the form says.
             now = @rl.now
             due = Reports.last_period(frequency, now, site["timezone"])
@@ -1520,7 +1544,15 @@ module Runlight
         parsed = origin?(origin) && Js.length(origin) <= 200 ? Http::Url.parse(origin) : nil
         return coded("Send the admin page's origin, such as https://example.com", "embed_origin", 400) if parsed.nil? || parsed.origin != origin
 
-        host = host_name(parsed.host)
+        # Only https and the default port, so a plain http page or another service on the same name cannot frame
+        # the dashboard; a page on this computer, for development, may use http and any port. The name must be
+        # one of the site's own, which are kept without www, so www. is the only difference allowed.
+        local = ["localhost", "127.0.0.1", "[::1]"].include?(parsed.hostname)
+        if !local && (parsed.protocol != "https:" || parsed.port != "")
+          return coded("Send the admin page's origin, such as https://example.com", "embed_origin", 400)
+        end
+
+        host = parsed.hostname.sub(/\Awww\./, "")
         domains = ((rl.remote(site["id"]) || {})["hostnames"] || site["hostnames"] || []).map { |h| host_name(h) }
         unless domains.include?(host)
           return coded("#{host} is not one of this site's domains. Add it to the site's domains in Runlight's settings.", "embed_host", 400, { "host" => host })
@@ -1621,7 +1653,7 @@ module Runlight
         return site if site.is_a?(Http::Response)
 
         begin
-          return json(Importers::Visits.import_csv_visits(rl, site["id"], plain(Js.get(body, "rows"))))
+          return json(Importers::Visits.import_csv_visits(rl, site["id"], plain(Js.get(body, "rows")), Js.get(body, "secret")))
         rescue Importers::ImportError => e
           return refused(e, "import_failed")
         end
@@ -2153,7 +2185,19 @@ module Runlight
       return coded("Unknown site", "unknown_site", 404) if site.nil? || (!only.nil? && site["id"] != only)
 
       remote = rl.remote(site["id"])
-      return pass_through(remote, path, url, request) unless remote.nil?
+      # A share link or an embedded dashboard sees how many are here now and what they read, but not the feed of
+      # each visit, with its time and city, since anyone with the link could watch one person's way through the site.
+      unfeed = ->(live) { shared.nil? ? live : live.merge("recent" => []) }
+      unless remote.nil?
+        answer = pass_through(remote, path, url, request)
+        return answer if path != "/api/realtime" || shared.nil? || !answer.ok?
+
+        parsed, live = Js.parse_json(answer.text)
+        return json(unfeed.call(live)) if parsed && live.is_a?(Hash)
+
+        host = Http::Url.new(remote["url"].to_s).host
+        return coded("Could not reach #{host}", "unreachable", 502, { "host" => host })
+      end
 
       if path == "/api/icon"
         host = site["hostnames"][0]
@@ -2170,7 +2214,7 @@ module Runlight
         })
       end
 
-      return json(store.realtime(site["id"], rl.now)) if path == "/api/realtime"
+      return json(unfeed.call(store.realtime(site["id"], rl.now))) if path == "/api/realtime"
 
       read = read_query(url, site)
       return read if read.is_a?(Http::Response)
@@ -2284,10 +2328,12 @@ module Runlight
 
         keys = store.event_prop_keys(query, event)
         asked = params.get("key")
-        # A property name goes into a JSON path on SQLite, so quotes and backslashes are refused.
-        return coded("Bad property name", "property_bad", 400) if !asked.nil? && !asked.match?(/\A[^"\\]{1,64}\z/)
+        # A property name goes into a JSON path on SQLite, so quotes and backslashes are refused, and without
+        # one asked for, the most used name that has none is shown.
+        safe = ->(name) { name.match?(/\A[^"\\]{1,64}\z/) }
+        return coded("Bad property name", "property_bad", 400) if !asked.nil? && !safe.call(asked)
 
-        key = asked || keys.first&.[]("key")
+        key = asked || keys.find { |k| safe.call(k["key"].to_s) }&.[]("key")
         count = limit(params.get("limit"), 100)
         rows = !key.nil? && key != "" ? store.event_prop_values(query, event, key, whole(count)) : []
         return json({ "site" => site["id"], "range" => range_out, "event" => event, "keys" => keys, "key" => key, "rows" => rows })

data/lib/runlight/safefetch.rb

@@ -96,6 +96,41 @@ module Runlight
       true
     end
 
+    # Names clouds give their metadata services.
+    METADATA_NAMES = %w[metadata metadata.google.internal metadata.goog instance-data instance-data.ec2.internal].freeze
+
+    # Whether an address is link-local (169.254.0.0/16, fe80::/10) or a cloud's metadata service (fd00:ec2::254,
+    # Alibaba's 100.100.100.200), in any of its IPv6 spellings. A model's API or a mail server is never there,
+    # though it may well be on this computer or a private network, so those stay allowed where this is checked.
+    def metadata_address?(ip)
+      four = v4(ip)
+      g = four.nil? ? v6(ip) : nil
+      # IPv4 inside IPv6, mapped (::ffff:0:0/96), compatible (::/96), or NAT64 (64:ff9b::/96), is read as IPv4.
+      if four.nil? && !g.nil? && ((g[0, 5].all?(&:zero?) && (g[5] == 0xffff || g[5].zero?)) || (g[0] == 0x64 && g[1] == 0xff9b && g[2, 4].all?(&:zero?)))
+        four = [g[6] >> 8, g[6] & 255, g[7] >> 8, g[7] & 255]
+      end
+      return (four[0] == 169 && four[1] == 254) || four == [100, 100, 100, 200] unless four.nil?
+      return false if g.nil?
+      return true if (g[0] & 0xffc0) == 0xfe80
+
+      g[0] == 0xfd00 && g[1] == 0xec2 && g[2, 5].all?(&:zero?) && g[7] == 0x254
+    end
+
+    # Whether a host, by its name, its address, or any address its name resolves to now, is link-local or a
+    # metadata service. A name that does not resolve here is let through, since the connection then goes
+    # nowhere such a check could have stopped.
+    def metadata_host?(host)
+      name = Js.lower(Js.trim(host)).sub(/\A\[/, "").sub(/\]\z/, "").sub(/\.+\z/, "")
+      return true if METADATA_NAMES.include?(name) || metadata_address?(name)
+      return false if !v4(name).nil? || !v6(name).nil?
+
+      begin
+        Safefetch.resolver.call(name).any? { |address| metadata_address?(address.to_s) }
+      rescue StandardError
+        false
+      end
+    end
+
     # Every address a name resolves to, v4 and v6, as getaddrinfo() gives them (the hosts file included).
     # Empty when it does not resolve.
     def lookup(name)

data/lib/runlight/version.rb

@@ -4,7 +4,7 @@ require "json"
 
 module Runlight
   # The gem's own version, which the release keeps equal to the npm package's.
-  GEM_VERSION = "0.1.0"
+  GEM_VERSION = "0.1.1"
 
   # The SDK's version and the HTTP API's, read from assets/build.json, which
   # scripts/ruby-assets.mts writes from the TypeScript SDK, so the two always

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: runlight
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.1.1
 platform: ruby
 authors:
 - Jon C. Phillips
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2026-10-10 00:00:00.000000000 Z
+date: 2026-10-11 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activerecord