runlight 0.1.0 → 0.1.3

data/assets/pick-return.js

@@ -0,0 +1 @@
+(function(){var a=window,r=document,i=location.hash.slice(1);history.replaceState(null,"",location.pathname);var t={};i.split("&").forEach(function(e){var n=e.indexOf("=");try{n>0&&(t[e.slice(0,n)]=decodeURIComponent(e.slice(n+1)))}catch(s){}});var o=null;try{o=localStorage.getItem("runlight-pick")}catch(e){}var c=/^[a-f0-9]{32}$/.test(t.n||"")&&t.n===o&&typeof t.s=="string"&&!!a.BroadcastChannel;if(c){try{localStorage.removeItem("runlight-pick")}catch(e){}var l=new BroadcastChannel("runlight-pick");l.postMessage({runlight:"pick",nonce:t.n,selector:t.s,href:t.h||"",text:t.t||""}),l.close(),setTimeout(function(){a.close()},900)}r.getElementById(c?"done":"gone").hidden=!1})();

data/assets/picker.js

@@ -1 +1 @@
-(function(){var l=window,a=document,g=l.opener;if(g){var d="__RUNLIGHT_PICK_TARGET__";if(/^https?:\/\//.test(d)){var x=JSON.parse("__RUNLIGHT_PICK_HOSTS__");if(!(x.length&&x.indexOf(location.hostname.toLowerCase().replace(/^www\./,""))<0)){var m={en:["Click what you want to count","Use this","Pick again","Cancel","Matches {n} on this page","Sent to Runlight. You can close this tab."],fr:["Cliquez sur ce que vous voulez compter","Utiliser","Choisir \xE0 nouveau","Annuler","{n} sur cette page","Envoy\xE9 \xE0 Runlight. Vous pouvez fermer cet onglet."],es:["Haz clic en lo que quieres contar","Usar esto","Elegir otra vez","Cancelar","{n} en esta p\xE1gina","Enviado a Runlight. Puedes cerrar esta pesta\xF1a."],de:["Klicke auf das, was gez\xE4hlt werden soll","Verwenden","Neu w\xE4hlen","Abbrechen","{n} auf dieser Seite","An Runlight gesendet. Du kannst diesen Tab schlie\xDFen."],pt:["Clique no que quer contar","Usar","Escolher de novo","Cancelar","{n} nesta p\xE1gina","Enviado ao Runlight. Pode fechar esta aba."]},T=(/[?&]runlight_lang=([a-z]{2})/.exec(location.search)||[])[1],s=m[T]||m.en,b=function(t){return/^[a-zA-Z][\w-]{1,40}$/.test(t)&&!/\d{3,}|^(css|sc|jsx|svelte|astro)-|__\w{5,}/.test(t)},w=function(t){return l.CSS&&CSS.escape?CSS.escape(t):t.replace(/[^\w-]/g,"\\$&")},C=function(t){try{return a.querySelectorAll(t).length===1}catch(e){return!1}},A=function(t){for(var e=[],n=t;n&&n.nodeType===1&&n!==a.documentElement;n=n.parentElement){if(n.id&&b(n.id)){e.unshift("#"+w(n.id));break}var r=n.tagName.toLowerCase(),v=n.getAttribute("data-runlight")||n.getAttribute("data-testid");if(v)r+="["+(n.hasAttribute("data-runlight")?"data-runlight":"data-testid")+'="'+v.replace(/"/g,'\\"')+'"]';else{var q=Array.prototype.filter.call(n.classList,b).slice(0,2);q.length&&(r+="."+q.map(w).join("."))}e.unshift(r);var E=e.join(" > ");if(C(E)||e.length>=4)return E;var _=n.parentElement;if(_){var k=Array.prototype.filter.call(_.children,function(z){return z.tagName===n.tagName});if(k.length>1&&(e[0]+=":nth-of-type("+(k.indexOf(n)+1)+")"),C(e.join(" > ")))return e.join(" > ")}}return e.join(" > ")},o=a.createElement("div");o.style.cssText="position:fixed;inset:0;z-index:2147483647;pointer-events:none";var u=o.attachShadow?o.attachShadow({mode:"open"}):o;u.innerHTML="<style>.box{position:fixed;border:2px solid #2563eb;background:rgba(37,99,235,.1);border-radius:4px;pointer-events:none;transition:all .06s}.bar{position:fixed;left:50%;bottom:20px;transform:translateX(-50%);display:flex;align-items:center;gap:10px;max-width:min(720px,calc(100vw - 32px));padding:10px 12px 10px 16px;border-radius:12px;background:#111;color:#fff;font:14px/1.4 system-ui,sans-serif;box-shadow:0 8px 30px rgba(0,0,0,.3);pointer-events:auto}.msg{flex:1;min-width:0;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}code{font:12px ui-monospace,monospace;color:#93c5fd}button{height:32px;padding:0 12px;border:0;border-radius:8px;font:inherit;cursor:pointer;background:#333;color:#fff}button.go{background:#fff;color:#111}</style><div class='box' hidden></div><div class='bar'><span class='msg'></span><span class='acts'></span></div>",a.documentElement.appendChild(o);var f=u.querySelector(".box"),c=u.querySelector(".msg"),p=u.querySelector(".acts"),i=null,h=function(t,e,n){var r=a.createElement("button");r.textContent=t,e&&(r.className=e),r.addEventListener("click",n),p.appendChild(r)},y=function(t){if(!t)return f.hidden=!0;var e=t.getBoundingClientRect();f.hidden=!1,f.style.cssText+=";left:"+(e.left-2)+"px;top:"+(e.top-2)+"px;width:"+(e.width+4)+"px;height:"+(e.height+4)+"px"},S=function(){i=null,c.innerHTML="<span></span> \xB7 <code></code>",c.querySelector("span").textContent=s[0],c.querySelector("code").textContent=d.replace(/^https?:\/\//,""),p.textContent="",h(s[3],"",function(){l.close()})},L=function(t){var e=A(t),n=t.closest("a[href]"),r=0;try{r=a.querySelectorAll(e).length}catch(v){}i={selector:e,href:n?n.href:"",text:(t.textContent||"").trim().slice(0,80)},c.innerHTML="<code></code> \xB7 "+s[4].replace("{n}",r),c.querySelector("code").textContent=e,p.textContent="",h(s[2],"",S),h(s[1],"go",function(){g.postMessage({runlight:"pick",selector:i.selector,href:i.href,text:i.text},d),c.textContent=s[5],p.textContent="",setTimeout(function(){l.close()},900)})};a.addEventListener("mouseover",function(t){i||y(t.target)},!0),["click","mousedown","mouseup","pointerdown","submit"].forEach(function(t){a.addEventListener(t,function(e){e.composedPath&&e.composedPath()[0]&&o.contains&&e.composedPath().indexOf(o)>=0||(e.preventDefault(),e.stopPropagation(),t==="click"&&!i&&(y(e.target),L(e.target)))},!0)}),S()}}}})();
+(function(){var p=window,o=document,d="__RUNLIGHT_PICK_TARGET__";if(/^https?:\/\//.test(d)){var g="__RUNLIGHT_PICK_RETURN__",x="__RUNLIGHT_PICK_NONCE__",m=g.indexOf(d+"/")===0&&/^[a-f0-9]{32}$/.test(x),b=p.opener;if(!(!m&&!b)){var C=JSON.parse("__RUNLIGHT_PICK_HOSTS__");if(!(C.length&&C.indexOf(location.hostname.toLowerCase().replace(/^www\./,""))<0)){var w={en:["Click what you want to count","Use this","Pick again","Cancel","Matches {n} on this page","Sent to Runlight. You can close this tab."],fr:["Cliquez sur ce que vous voulez compter","Utiliser","Choisir \xE0 nouveau","Annuler","{n} sur cette page","Envoy\xE9 \xE0 Runlight. Vous pouvez fermer cet onglet."],es:["Haz clic en lo que quieres contar","Usar esto","Elegir otra vez","Cancelar","{n} en esta p\xE1gina","Enviado a Runlight. Puedes cerrar esta pesta\xF1a."],de:["Klicke auf das, was gez\xE4hlt werden soll","Verwenden","Neu w\xE4hlen","Abbrechen","{n} auf dieser Seite","An Runlight gesendet. Du kannst diesen Tab schlie\xDFen."],pt:["Clique no que quer contar","Usar","Escolher de novo","Cancelar","{n} nesta p\xE1gina","Enviado ao Runlight. Pode fechar esta aba."]},N=(/[?&]runlight_lang=([a-z]{2})/.exec(location.search)||[])[1],c=w[N]||w.en,_=function(t){return/^[a-zA-Z][\w-]{1,40}$/.test(t)&&!/\d{3,}|^(css|sc|jsx|svelte|astro)-|__\w{5,}/.test(t)},y=function(t){return p.CSS&&CSS.escape?CSS.escape(t):t.replace(/[^\w-]/g,"\\$&")},S=function(t){try{return o.querySelectorAll(t).length===1}catch(e){return!1}},A=function(t){for(var e=[],n=t;n&&n.nodeType===1&&n!==o.documentElement;n=n.parentElement){if(n.id&&_(n.id)){e.unshift("#"+y(n.id));break}var r=n.tagName.toLowerCase(),i=n.getAttribute("data-runlight")||n.getAttribute("data-testid");if(i)r+="["+(n.hasAttribute("data-runlight")?"data-runlight":"data-testid")+'="'+i.replace(/"/g,'\\"')+'"]';else{var q=Array.prototype.filter.call(n.classList,_).slice(0,2);q.length&&(r+="."+q.map(y).join("."))}e.unshift(r);var R=e.join(" > ");if(S(R)||e.length>=4)return R;var T=n.parentElement;if(T){var L=Array.prototype.filter.call(T.children,function(I){return I.tagName===n.tagName});if(L.length>1&&(e[0]+=":nth-of-type("+(L.indexOf(n)+1)+")"),S(e.join(" > ")))return e.join(" > ")}}return e.join(" > ")},s=o.createElement("div");s.style.cssText="position:fixed;inset:0;z-index:2147483647;pointer-events:none";var u=s.attachShadow?s.attachShadow({mode:"open"}):s;u.innerHTML="<style>.box{position:fixed;border:2px solid #2563eb;background:rgba(37,99,235,.1);border-radius:4px;pointer-events:none;transition:all .06s}.bar{position:fixed;left:50%;bottom:20px;transform:translateX(-50%);display:flex;align-items:center;gap:10px;max-width:min(720px,calc(100vw - 32px));padding:10px 12px 10px 16px;border-radius:12px;background:#111;color:#fff;font:14px/1.4 system-ui,sans-serif;box-shadow:0 8px 30px rgba(0,0,0,.3);pointer-events:auto}.msg{flex:1;min-width:0;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}code{font:12px ui-monospace,monospace;color:#93c5fd}button{height:32px;padding:0 12px;border:0;border-radius:8px;font:inherit;cursor:pointer;background:#333;color:#fff}button.go{background:#fff;color:#111}</style><div class='box' hidden></div><div class='bar'><span class='msg'></span><span class='acts'></span></div>",o.documentElement.appendChild(s);var h=u.querySelector(".box"),l=u.querySelector(".msg"),f=u.querySelector(".acts"),a=null,v=function(t,e,n){var r=o.createElement("button");r.textContent=t,e&&(r.className=e),r.addEventListener("click",n),f.appendChild(r)},E=function(t){if(!t)return h.hidden=!0;var e=t.getBoundingClientRect();h.hidden=!1,h.style.cssText+=";left:"+(e.left-2)+"px;top:"+(e.top-2)+"px;width:"+(e.width+4)+"px;height:"+(e.height+4)+"px"},k=function(){a=null,l.innerHTML="<span></span> \xB7 <code></code>",l.querySelector("span").textContent=c[0],l.querySelector("code").textContent=d.replace(/^https?:\/\//,""),f.textContent="",v(c[3],"",function(){p.close()})},U=function(t){var e=A(t),n=t.closest("a[href]"),r=0;try{r=o.querySelectorAll(e).length}catch(i){}a={selector:e,href:n?n.href:"",text:(t.textContent||"").trim().slice(0,80)},l.innerHTML="<code></code> \xB7 "+c[4].replace("{n}",r),l.querySelector("code").textContent=e,f.textContent="",v(c[2],"",k),v(c[1],"go",function(){if(l.textContent=c[5],f.textContent="",m){var i=o.createElement("a");i.rel="noreferrer",i.href=g+"#n="+x+"&s="+encodeURIComponent(a.selector)+"&h="+encodeURIComponent(a.href)+"&t="+encodeURIComponent(a.text),u.appendChild(i),i.click();return}b.postMessage({runlight:"pick",selector:a.selector,href:a.href,text:a.text},d),setTimeout(function(){p.close()},900)})};o.addEventListener("mouseover",function(t){a||E(t.target)},!0),["click","mousedown","mouseup","pointerdown","submit"].forEach(function(t){o.addEventListener(t,function(e){e.composedPath&&e.composedPath()[0]&&s.contains&&e.composedPath().indexOf(s)>=0||(e.preventDefault(),e.stopPropagation(),t==="click"&&!a&&(E(e.target),U(e.target)))},!0)}),k()}}}})();

data/assets/tracker.js

@@ -1 +1 @@
-(function(){var a=window,n=document,u=navigator,p=n.currentScript;if(p){var o=function(e){return p.getAttribute("data-"+e)},R=p.src.replace(/s\.js(\?.*)?$/,"e"),b=o("site"),U=o("hash")!==null,I=o("manual")!==null,$=function(e){return new RegExp("^"+e.replace(/[.+?^${}()|[\]\\]/g,"\\$&").replace(/\*/g,".*")+"$")},C=(o("exclude")||"").split(",").filter(Boolean).map(function(e){return $(e.trim())}),A=!1,H=a.runlight&&a.runlight.q||[],m="__RUNLIGHT_RULES__",T=typeof m=="object"&&(m[b]||m[location.hostname.replace(/^www\./,"")]||m["*"])||[];if(/[?&]runlight=pick\b/.test(location.search)&&a.opener){var M=n.createElement("script");M.src=p.src.replace(/s\.js(\?.*)?$/,"pick.js")+location.search,n.head.appendChild(M),a.runlight=function(){};return}var N=!1;try{var O=/[?&]runlight=(ignore|track)\b/.exec(location.search);O&&(O[1]==="ignore"?localStorage.setItem("runlight_ignore","1"):localStorage.removeItem("runlight_ignore")),N=localStorage.getItem("runlight_ignore")==="1"}catch(e){}if(u.webdriver||N||o("dnt")!==null&&(u.doNotTrack==="1"||a.doNotTrack==="1")){a.runlight=function(){};return}var k=function(e,t){if(!A){var r={k:e,u:w};b&&(r.s=b);for(var i in t)r[i]=t[i];var s=JSON.stringify(r);u.sendBeacon&&u.sendBeacon(R,s)||a.fetch&&fetch(R,{method:"POST",body:s,keepalive:!0}).catch(function(){})}},G=function(){var e=new Uint8Array(8);return(a.crypto||{}).getRandomValues?crypto.getRandomValues(e):e.forEach(function(t,r){e[r]=Math.random()*256}),Array.prototype.map.call(e,function(t){return(t+256).toString(36).slice(-2)}).join("").slice(0,12)},z=o("404")!==null,w="",v="",f=0,d=0,y=0,J=function(){return n.visibilityState==="visible"&&n.hasFocus()},B=function(){d&&(f+=Date.now()-d),d=0},c=function(){!d&&J()&&(d=Date.now())},E=function(){B(),v&&f>=1e3&&(k("engagement",{i:v,e:f,d:y}),f=0)},F=function(){var e=n.documentElement,t=Math.max(e.scrollHeight,n.body?n.body.scrollHeight:0),r=(a.scrollY||e.scrollTop)+a.innerHeight,i=t>0?Math.min(100,Math.round(r/t*100)):100;i>y&&(y=i)},P=function(){var e=location;return e.protocol+"//"+e.host+e.pathname+e.search+(U?e.hash:"")},h=function(e){var t=typeof e=="string"?new URL(e,location.href).href:P();if(t!==w){var r=w||n.referrer;E(),w=t;var i=new URL(t).pathname;A=C.some(function(s){return s.test(i)}),v=G(),f=0,y=0,F(),c(),k("pageview",{i:v,r,t:n.title,w:screen.width,h:screen.height,l:u.language}),z&&l("404",{path:location.pathname}),z=!1}},l=function(e,t){typeof e!="string"||!e||k("event",{i:v,n:e,p:t&&typeof t=="object"?t:void 0})},D=function(e){var t=history[e];history[e]=function(){var r=t.apply(this,arguments);return h(),r}};I||(D("pushState"),D("replaceState"),a.addEventListener("popstate",h),U&&a.addEventListener("hashchange",h)),n.addEventListener("visibilitychange",function(){n.visibilityState==="hidden"?E():c()}),a.addEventListener("pagehide",E),a.addEventListener("blur",B),a.addEventListener("focus",c),a.addEventListener("scroll",function(){F(),c()},{passive:!0}),n.addEventListener("pointerdown",c,!0),n.addEventListener("keydown",c,!0);var Y=/\.(pdf|zip|gz|tgz|dmg|pkg|exe|msi|apk|docx?|xlsx?|pptx?|csv|txt|rtf|epub|mp3|wav|mp4|mov|avi|mkv|psd|ai|svg|key|numbers|pages)$/i;n.addEventListener("click",function(e){var t=e.target;if(!(!t||!t.closest)){for(var r=t.closest("a[href]"),i=0;i<T.length;i++)try{var s=T[i],S=s[1];(s[0]==="s"?t.closest(S):r&&$(S).test(S.charAt(0)==="/"?r.pathname:r.href))&&l(s[2])}catch(q){}var g=t.closest("[data-runlight]");if(g){for(var V={},x=0;x<g.attributes.length;x++){var _=g.attributes[x];_.name.indexOf("data-runlight-")===0&&(V[_.name.slice(14)]=_.value)}l(g.getAttribute("data-runlight"),V)}if(!(!r||g)){var j=r.href;/^https?:/.test(j)&&(o("downloads")!=="false"&&Y.test(r.pathname)?l("File download",{url:j}):o("outbound")!=="false"&&r.host!==location.host&&l("Outbound link",{url:j}))}}},!0),a.runlight=l,l.pageview=h,I||h();for(var L=0;L<H.length;L++)l.apply(null,H[L])}})();
+(function(){var a=window,n=document,u=navigator,p=n.currentScript;if(p){var o=function(e){return p.getAttribute("data-"+e)},R=p.src.replace(/s\.js(\?.*)?$/,"e"),b=o("site"),U=o("hash")!==null,I=o("manual")!==null,$=function(e){return new RegExp("^"+e.replace(/[.+?^${}()|[\]\\]/g,"\\$&").replace(/\*/g,".*")+"$")},C=(o("exclude")||"").split(",").filter(Boolean).map(function(e){return $(e.trim())}),A=!1,H=a.runlight&&a.runlight.q||[],m="__RUNLIGHT_RULES__",T=typeof m=="object"&&(m[b]||m[location.hostname.replace(/^www\./,"")]||m["*"])||[];if(/[?&]runlight=pick\b/.test(location.search)&&/[?&]runlight_ticket=/.test(location.search)){var M=n.createElement("script");M.src=p.src.replace(/s\.js(\?.*)?$/,"pick.js")+location.search,n.head.appendChild(M),a.runlight=function(){};return}var N=!1;try{var O=/[?&]runlight=(ignore|track)\b/.exec(location.search);O&&(O[1]==="ignore"?localStorage.setItem("runlight_ignore","1"):localStorage.removeItem("runlight_ignore")),N=localStorage.getItem("runlight_ignore")==="1"}catch(e){}if(u.webdriver||N||o("dnt")!==null&&(u.doNotTrack==="1"||a.doNotTrack==="1")){a.runlight=function(){};return}var k=function(e,t){if(!A){var r={k:e,u:w};b&&(r.s=b);for(var i in t)r[i]=t[i];var s=JSON.stringify(r);u.sendBeacon&&u.sendBeacon(R,s)||a.fetch&&fetch(R,{method:"POST",body:s,keepalive:!0}).catch(function(){})}},G=function(){var e=new Uint8Array(8);return(a.crypto||{}).getRandomValues?crypto.getRandomValues(e):e.forEach(function(t,r){e[r]=Math.random()*256}),Array.prototype.map.call(e,function(t){return(t+256).toString(36).slice(-2)}).join("").slice(0,12)},z=o("404")!==null,w="",v="",f=0,d=0,y=0,J=function(){return n.visibilityState==="visible"&&n.hasFocus()},B=function(){d&&(f+=Date.now()-d),d=0},c=function(){!d&&J()&&(d=Date.now())},E=function(){B(),v&&f>=1e3&&(k("engagement",{i:v,e:f,d:y}),f=0)},F=function(){var e=n.documentElement,t=Math.max(e.scrollHeight,n.body?n.body.scrollHeight:0),r=(a.scrollY||e.scrollTop)+a.innerHeight,i=t>0?Math.min(100,Math.round(r/t*100)):100;i>y&&(y=i)},P=function(){var e=location;return e.protocol+"//"+e.host+e.pathname+e.search+(U?e.hash:"")},h=function(e){var t=typeof e=="string"?new URL(e,location.href).href:P();if(t!==w){var r=w||n.referrer;E(),w=t;var i=new URL(t).pathname;A=C.some(function(s){return s.test(i)}),v=G(),f=0,y=0,F(),c(),k("pageview",{i:v,r,t:n.title,w:screen.width,h:screen.height,l:u.language}),z&&l("404",{path:location.pathname}),z=!1}},l=function(e,t){typeof e!="string"||!e||k("event",{i:v,n:e,p:t&&typeof t=="object"?t:void 0})},D=function(e){var t=history[e];history[e]=function(){var r=t.apply(this,arguments);return h(),r}};I||(D("pushState"),D("replaceState"),a.addEventListener("popstate",h),U&&a.addEventListener("hashchange",h)),n.addEventListener("visibilitychange",function(){n.visibilityState==="hidden"?E():c()}),a.addEventListener("pagehide",E),a.addEventListener("blur",B),a.addEventListener("focus",c),a.addEventListener("scroll",function(){F(),c()},{passive:!0}),n.addEventListener("pointerdown",c,!0),n.addEventListener("keydown",c,!0);var Y=/\.(pdf|zip|gz|tgz|dmg|pkg|exe|msi|apk|docx?|xlsx?|pptx?|csv|txt|rtf|epub|mp3|wav|mp4|mov|avi|mkv|psd|ai|svg|key|numbers|pages)$/i;n.addEventListener("click",function(e){var t=e.target;if(!(!t||!t.closest)){for(var r=t.closest("a[href]"),i=0;i<T.length;i++)try{var s=T[i],S=s[1];(s[0]==="s"?t.closest(S):r&&$(S).test(S.charAt(0)==="/"?r.pathname:r.href))&&l(s[2])}catch(q){}var g=t.closest("[data-runlight]");if(g){for(var V={},x=0;x<g.attributes.length;x++){var _=g.attributes[x];_.name.indexOf("data-runlight-")===0&&(V[_.name.slice(14)]=_.value)}l(g.getAttribute("data-runlight"),V)}if(!(!r||g)){var j=r.href;/^https?:/.test(j)&&(o("downloads")!=="false"&&Y.test(r.pathname)?l("File download",{url:j}):o("outbound")!=="false"&&r.host!==location.host&&l("Outbound link",{url:j}))}}},!0),a.runlight=l,l.pageview=h,I||h();for(var L=0;L<H.length;L++)l.apply(null,H[L])}})();

data/lib/runlight/accounts/accounts.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require "monitor"
+
 module Runlight
   module Accounts
     # Accounts: who may sign in, their password hashes, two-factor, invites, and the signed cookie that keeps them
@@ -32,14 +34,50 @@ module Runlight
       # A password checked against nothing, so a wrong email takes as long as a wrong password. Made when first needed.
       @decoy = nil
 
+      # Password checks run at once, in this process, and the most that may wait for one.
+      CHECKING = 4
+      WAITING = 64
+      SLOTS = Mutex.new
+      FREED = ConditionVariable.new
+      private_constant :SLOTS, :FREED
+      @running = 0
+      @waiting = 0
+
       class << self
         attr_accessor :decoy
+
+        # Runs a password check when one of the few slots is free, so a flood of sign-ins cannot take every core.
+        # Past the queue's length it refuses at once, with an AccountError coded "busy".
+        def slot
+          SLOTS.synchronize do
+            if @running >= CHECKING
+              raise AccountError.new("Runlight is busy checking other sign-ins. Try again in a moment.", "busy") if @waiting >= WAITING
+
+              @waiting += 1
+              begin
+                FREED.wait(SLOTS) while @running >= CHECKING
+              ensure
+                @waiting -= 1
+              end
+            end
+            @running += 1
+          end
+          begin
+            yield
+          ensure
+            SLOTS.synchronize do
+              @running -= 1
+              FREED.signal
+            end
+          end
+        end
       end
 
       def initialize(store, secret)
         @store = store
         @secret = secret
         @ready = false
+        @init_lock = Monitor.new
       end
 
       # A stored role read back; anything unknown reads as a viewer, the least it could be.
@@ -47,6 +85,11 @@ module Runlight
         ROLES.include?(value) ? value : "viewer"
       end
 
+      # Whether a role may invite people. The owner and admins invite as admin, member, or viewer.
+      def self.may_invite?(role)
+        role == "owner" || role == "admin"
+      end
+
       # Starts turning on two-factor: a new secret, kept aside until a code from it is confirmed.
       def start_two_factor(id)
         init
@@ -95,7 +138,8 @@ module Runlight
       # Checks a six-digit code, or a recovery code, for an account with two-factor on.
       # A code works once: one already used, or older, is refused, and a recovery code is crossed off.
       # One check at a time, so two sign-ins at once cannot both use the same code: TypeScript queues them per
-      # account in its process, and here the database's lock is taken, which holds across processes too.
+      # account in its process, and here the database's lock is taken, which holds across processes too. The
+      # update that uses a code is also conditional, so the database has the last word either way.
       def check_second_factor(id, code, now)
         init
         turn { check_second_factor_now(id, code, now) }
@@ -181,6 +225,8 @@ module Runlight
           raise AccountError.new("Ownership is handed over by the owner", "owner_hand_over") if role == "owner"
 
           @store.db.run("UPDATE rl_users SET role = ? WHERE id = ?", [role, id])
+          # Someone who may no longer invite takes back the invites they sent, so nobody joins on their word.
+          @store.db.run("DELETE FROM rl_invites WHERE invited_by = ?", [user["email"]]) unless self.class.may_invite?(role)
           user["role"] = role
           user
         end
@@ -212,6 +258,7 @@ module Runlight
           raise AccountError.new("The owner cannot be removed", "owner_protected") if user["role"] == "owner"
 
           @store.db.run("DELETE FROM rl_users WHERE id = ?", [id])
+          @store.db.run("DELETE FROM rl_invites WHERE invited_by = ?", [user["email"]])
           @store.set_setting("login-link-used:#{id}", nil)
         end
         nil
@@ -280,27 +327,44 @@ module Runlight
         before.positive?
       end
 
-      # Turns an invite into an account with the password its person chose. The link then stops working.
+      # Turns an invite into an account with the password its person chose. The link then stops working. It takes a
+      # turn, so it cannot cross a removal of whoever sent it, and the sender must still be someone who may invite.
       def accept_invite(code, password, now)
-        invite = invite_by_code(code, now)
-        raise AccountError.new("This invite has expired or was already used. Ask for a new one.", "invite_gone") if invite.nil?
-        unless by_email(invite["email"]).nil?
-          raise AccountError.new("#{invite["email"]} already has an account", "account_exists", { "email" => invite["email"] })
+        # The tables first: making them takes the same lock as a turn.
+        init
+        user = turn do
+          invite = invite_by_code(code, now)
+          next nil if invite.nil?
+
+          sender = by_email(invite["invitedBy"])
+          if sender.nil? || !self.class.may_invite?(sender["role"])
+            # Left without raising, since an error inside a turn on SQLite would roll this back.
+            @store.db.run("DELETE FROM rl_invites WHERE id = ?", [invite["id"]])
+            next nil
+          end
+          unless by_email(invite["email"]).nil?
+            raise AccountError.new("#{invite["email"]} already has an account", "account_exists", { "email" => invite["email"] })
+          end
+
+          made = set_password(invite["email"], password, now, invite["role"])
+          @store.db.run("DELETE FROM rl_invites WHERE id = ?", [invite["id"]])
+          made
         end
+        raise AccountError.new("This invite has expired or was already used. Ask for a new one.", "invite_gone") if user.nil?
 
-        user = set_password(invite["email"], password, now, invite["role"])
-        @store.db.run("DELETE FROM rl_invites WHERE id = ?", [invite["id"]])
         user
       end
 
-      # The account for an email and password, or nil. Takes the same time either way.
+      # The account for an email and password, or nil. Takes the same time either way. Only a few checks run at
+      # once; with too many waiting it raises an AccountError coded "busy".
       def sign_in(email, password)
         user = by_email(email)
         if user.nil?
-          Crypto.check_password(password, self.class.decoy ||= Crypto.hash_password(Crypto.hex(Crypto.random_bytes(16))))
+          hash = self.class.decoy ||= Crypto.hash_password(Crypto.hex(Crypto.random_bytes(16)))
+          self.class.slot { Crypto.check_password(password, hash) }
           return nil
         end
-        Crypto.check_password(password, user["hash"]) ? user : nil
+        self.class.slot { Crypto.check_password(password, user["hash"]) } ? user : nil
       end
 
       # A cookie value naming the user and when it expires, signed with the
@@ -348,15 +412,21 @@ module Runlight
 
       private
 
-      # Changes to who has an account take turns: on Postgres and MySQL across processes, through the database's
-      # lock, so two owners demoting each other at once cannot leave none, and a double-clicked invite makes one.
+      # Changes to who has an account take turns across threads and processes (the database's lock, or on SQLite a
+      # transaction that takes the write lock first), so two owners demoting each other at once cannot leave none,
+      # a double-clicked invite makes one, and a code or a sign-in link works once.
       def turn(&fn)
-        @store.db.exclusive { fn.call }
+        db = @store.db
+        db.respond_to?(:turn) ? db.turn { fn.call } : db.exclusive { fn.call }
       end
 
       def init
         return if @ready
 
+        @init_lock.synchronize { init_now unless @ready }
+      end
+
+      def init_now
         # Several processes starting at once create the tables one at a time.
         @store.db.exclusive do
           db = @store.db
@@ -424,16 +494,17 @@ module Runlight
           step = !secret.nil? && secret != "" ? Crypto.match_step(secret, digits, now, after) : nil
           return false if step.nil?
 
-          @store.db.run("UPDATE rl_users SET totp_step = ? WHERE id = ?", [step, id])
-          return true
+          # Only if no check since has used this step or a later one, whatever took the turn before this one.
+          return @store.db.affected("UPDATE rl_users SET totp_step = ? WHERE id = ? AND (totp_step IS NULL OR totp_step < ?)", [step, id, step]) == 1
         end
-        hashes = Js.truthy?(row["totp_recovery"]) ? Json.decode(row["totp_recovery"].to_s) : []
+        read = Js.truthy?(row["totp_recovery"]) ? row["totp_recovery"].to_s : nil
+        hashes = read.nil? ? [] : Json.decode(read)
         at = hashes.index(Crypto.recovery_hash(given))
         return false if at.nil?
 
         hashes.delete_at(at)
-        @store.db.run("UPDATE rl_users SET totp_recovery = ? WHERE id = ?", [Json.encode(hashes), id])
-        true
+        # Only if the codes are still the ones read, so a code crossed off at the same moment elsewhere is not used twice.
+        @store.db.affected("UPDATE rl_users SET totp_recovery = ? WHERE id = ? AND totp_recovery = ?", [Json.encode(hashes), id, read]) == 1
       end
 
       def ticket(kind, user, expires)

data/lib/runlight/accounts/throttle.rb

@@ -3,15 +3,24 @@
 module Runlight
   module Accounts
     # Counts failed sign-ins under a key and refuses more than a few in a while.
-    # Keys are hashed with a key made on first use, so the counts never hold an
-    # address or an email as it was given.
+    # Keys are hashed with a key made for each UTC day, so the counts never hold
+    # an address or an email as it was given.
     #
     # TypeScript keeps the counts in its process. Here they live in the database's
     # settings, as "throttle:<name>:<id>" holding {count, until}, and the hashing
-    # key as "throttle-key", so every process of an install shares the same counts.
+    # key as "throttle-key:<UTC day>", so every process of an install shares the
+    # same counts. Some keys are addresses, and nothing derived from one lasts
+    # longer than a day: an expired count is deleted when it is read and by the
+    # scheduled check (sweep), and a day's hashing key goes once the day is over
+    # (yesterday's is kept only long enough to carry a count across midnight).
     class Throttle
-      KEY = "throttle-key"
-      private_constant :KEY
+      KEY = "throttle-key:"
+      # The one hashing key from before keys were made per day.
+      LEGACY_KEY = "throttle-key"
+      DAY_MS = 86_400_000
+      # How long after midnight yesterday's key carries a count over: the longest window a throttle counts in.
+      CARRY_MS = 15 * 60_000
+      private_constant :KEY, :LEGACY_KEY, :DAY_MS, :CARRY_MS
 
       def initialize(store, name, limit = 10, window_ms = 15 * 60_000)
         @store = store
@@ -20,8 +29,35 @@ module Runlight
         @window_ms = window_ms
       end
 
+      # Deletes every count that has run out and the hashing keys of days gone, for the scheduled check.
+      def self.sweep(store, now)
+        store.settings_starting_with("throttle:").each do |row|
+          entry = Json.try_decode(row["value"])
+          until_ms = entry.is_a?(Hash) ? Js.number(entry["until"].nil? ? 0 : entry["until"]) : 0
+          store.set_setting(row["key"], nil) unless until_ms.is_a?(Numeric) && until_ms.finite? && until_ms > now
+        end
+        drop_old_keys(store, now)
+      end
+
+      # The UTC day a time falls on, as YYYY-MM-DD.
+      def self.day(now)
+        Time.at(now.to_i / 1000).utc.strftime("%Y-%m-%d")
+      end
+
+      # Keeps today's hashing key, and yesterday's only just after midnight; the one from before days goes too.
+      def self.drop_old_keys(store, now)
+        keep = [day(now)]
+        keep << day(now - DAY_MS) if now.to_i % DAY_MS < CARRY_MS
+        store.set_setting(LEGACY_KEY, nil) unless store.setting(LEGACY_KEY).nil?
+        store.settings_starting_with(KEY).each do |row|
+          store.set_setting(row["key"], nil) unless keep.include?(row["key"][KEY.length..])
+        end
+      end
+
       def blocked(key, now)
-        blocked_id?(id(key), now)
+        today, yesterday = ids(key, now)
+        entry = entry(today, now) || (yesterday && entry(yesterday, now))
+        blocked_entry?(entry)
       end
 
       # Counts a try before the slow check it guards, so a burst that arrives
@@ -29,43 +65,75 @@ module Runlight
       # False, counting nothing, when the key is already at its limit. A try
       # that turns out right is taken back with forgive().
       def take(key, now)
-        id = id(key)
-        return false if blocked_id?(id, now)
-
-        count(id, now)
-        true
+        ids = ids(key, now)
+        # Checked and counted in one turn, so tries at once from other threads and processes wait for it.
+        turn do
+          entry = carry(ids, now)
+          next false if blocked_entry?(entry)
+
+          count(ids[0], entry, now)
+          true
+        end
       end
 
       # Takes back one counted try, for one that turned out right.
-      def forgive(key)
-        id = id(key)
-        entry = entry(id)
-        return unless entry && entry["count"].positive?
-
-        entry["count"] -= 1
-        save(id, entry)
+      def forgive(key, now)
+        ids = ids(key, now)
+        turn do
+          entry = carry(ids, now)
+          next unless entry && entry["count"].positive?
+
+          entry["count"] -= 1
+          save(ids[0], entry)
+        end
+        nil
       end
 
       def record_failure(key, now)
-        count(id(key), now)
+        ids = ids(key, now)
+        turn { count(ids[0], carry(ids, now), now) }
+        nil
       end
 
-      def clear(key)
-        @store.set_setting("#{prefix}#{id(key)}", nil)
+      def clear(key, now)
+        ids(key, now).compact.each { |id| @store.set_setting("#{prefix}#{id}", nil) }
+        nil
       end
 
       private
 
-      def salt
-        saved = @store.setting(KEY)
+      # The day's hashing key, made the first time it is needed (unless make is false, for yesterday's).
+      def salt(now, make = true)
+        name = "#{KEY}#{self.class.day(now)}"
+        saved = @store.setting(name)
         return saved if saved && saved != ""
+        return nil unless make
 
-        made = Hashing.random_id(16)
-        @store.set_setting(KEY, made)
-        made
+        # Made in a turn, so two processes starting at once do not each keep a different one.
+        turn do
+          saved = @store.setting(name)
+          next saved if saved && saved != ""
+
+          made = Hashing.random_id(16)
+          @store.set_setting(name, made)
+          self.class.drop_old_keys(@store, now)
+          made
+        end
+      end
+
+      # One change to the counts at a time, across threads and processes, as the accounts take turns.
+      def turn(&block)
+        db = @store.db
+        db.respond_to?(:turn) ? db.turn { block.call } : db.exclusive { block.call }
       end
 
-      def id(key)
+      # The key's id under today's hashing key, and under yesterday's while that is still kept (else nil).
+      def ids(key, now)
+        yesterday = salt(now - DAY_MS, false)
+        [keyed(salt(now), key), yesterday.nil? ? nil : keyed(yesterday, key)]
+      end
+
+      def keyed(salt, key)
         Crypto.base64url(Crypto.hmac("SHA-256", salt, key))[0, 22]
       end
 
@@ -73,10 +141,31 @@ module Runlight
         "throttle:#{@name}:"
       end
 
-      def entry(id)
+      # A count that has not run out, or nil. One that has is deleted as it is read.
+      def entry(id, now)
         saved = @store.setting("#{prefix}#{id}")
-        entry = saved.nil? ? nil : Json.try_decode(saved)
-        entry.is_a?(Hash) ? { "count" => int(entry["count"]), "until" => int(entry["until"]) } : nil
+        return nil if saved.nil?
+
+        entry = Json.try_decode(saved)
+        entry = entry.is_a?(Hash) ? { "count" => int(entry["count"]), "until" => int(entry["until"]) } : nil
+        return entry if entry && entry["until"] > now
+
+        @store.set_setting("#{prefix}#{id}", nil)
+        nil
+      end
+
+      # Today's count, or yesterday's moved under today's id, so a window that crosses midnight goes on.
+      def carry(ids, now)
+        today, yesterday = ids
+        found = entry(today, now)
+        return found if found || yesterday.nil?
+
+        found = entry(yesterday, now)
+        return nil if found.nil?
+
+        @store.set_setting("#{prefix}#{yesterday}", nil)
+        save(today, found)
+        found
       end
 
       # A saved number, whole, and 0 for anything that is not a number.
@@ -89,16 +178,12 @@ module Runlight
         @store.set_setting("#{prefix}#{id}", Json.encode(entry))
       end
 
-      def blocked_id?(id, now)
-        entry = entry(id)
-        return false if entry.nil? || entry["until"] <= now
-
-        entry["count"] >= @limit
+      def blocked_entry?(entry)
+        !entry.nil? && entry["count"] >= @limit
       end
 
-      def count(id, now)
-        entry = entry(id)
-        if entry.nil? || entry["until"] <= now
+      def count(id, entry, now)
+        if entry.nil?
           save(id, { "count" => 1, "until" => now + @window_ms })
           prune(now)
           return