runlight 0.1.0 → 0.1.3

data/lib/runlight/accounts/web.rb

@@ -44,16 +44,22 @@ module Runlight
         @home_path = "#{@base}/"
         @asks_for_token = @first.is_a?(Hash) && @first.key?("token")
         @existing = false
-        # Wrong passwords are counted twice. Per account and address, ten tries;
+        # Wrong passwords are counted three times. Per account and address, ten tries;
         # per account from anywhere, fifty, so a caller who invents a new address
         # for every try still cannot guess on and on. Addresses come from
-        # forwarding headers a client can write, so they never stand alone.
+        # forwarding headers a client can write, so they never stand alone. And per
+        # address across every account, thirty, so one caller trying made-up emails
+        # cannot keep the server hashing; a request with no known address skips that one,
+        # since it would hold up everyone at once.
         # Each try counts before the password is checked, and a right one is taken back.
         @per_address = Throttle.new(@store, "address", 10)
         @per_account = Throttle.new(@store, "account", 50)
+        @per_ip = Throttle.new(@store, "ip", 30)
         # Six-digit codes: five wrong tries an account every fifteen minutes, and five to confirm the first one.
         # Password re-checks in Account: ten.
         @code_tries = Throttle.new(@store, "code", 5)
+        # A decoy ticket's tries count apart, the same way, so someone guessing passwords cannot use up the owner's five.
+        @decoy_tries = Throttle.new(@store, "decoy", 5)
         @confirm_tries = Throttle.new(@store, "confirm", 5)
         @rechecks = Throttle.new(@store, "recheck", 10)
       end
@@ -70,21 +76,26 @@ module Runlight
       # Only a path on this install, so a sign-in can never send someone elsewhere.
       # Browsers drop tabs and newlines from a URL and read a backslash as a slash,
       # so "/\t/evil.example" would leave; anything with those is refused outright,
-      # and what is left must resolve to this origin.
+      # and what is left must resolve to this origin. A path that resolves to one
+      # starting "//", as "/..//evil.example" does, would leave from the Location
+      # header, so that goes home too.
       def safe_next(value)
         return @home_path if value.nil? || value == "" || !value.start_with?("/") || value.match?(/[\x00-\x1f\x7f\\]/)
 
         url = Http::Url.parse(value, "http://runlight.invalid")
-        !url.nil? && url.origin == "http://runlight.invalid" ? "#{url.pathname}#{url.search}#{url.hash}" : @home_path
+        return @home_path if url.nil? || url.origin != "http://runlight.invalid"
+
+        path = "#{url.pathname}#{url.search}#{url.hash}"
+        path.start_with?("//") || path.start_with?("/\\") ? @home_path : path
       end
 
       def signed_in(request)
         value = read_cookie(request, Accounts::SESSION_COOKIE)
         return nil if value == ""
 
+        # A cookie that is not valid percent-encoding is nobody's session, never an error.
         decoded = Js.decode_uri_component(value)
-        # decodeURIComponent throws a URIError here in TypeScript.
-        raise ArgumentError, "URI malformed" if decoded.nil?
+        return nil if decoded.nil?
 
         @accounts.from_session(decoded, now)
       end
@@ -143,6 +154,12 @@ module Runlight
         @now.call
       end
 
+      # The store's tables, settings among them, which the throttles keep their counts in (TypeScript keeps them
+      # in memory), so a fresh install's first sign-in or two-factor change finds them there.
+      def ready
+        @rl.init if @rl.respond_to?(:init)
+      end
+
       def home_origin
         @home&.call
       end
@@ -378,6 +395,7 @@ module Runlight
         end
 
         if path == "/login/code" && method == "POST"
+          ready
           form = Http::SearchParams.new(request.text)
           next_path = safe_next(form.get("next"))
           pending = @accounts.from_pending(form.get("pending") || "", now)
@@ -386,7 +404,7 @@ module Runlight
           user = pending["user"]
           real = pending["real"]
           # Counted before the check, so a burst cannot get past five.
-          unless @code_tries.take(user["id"], now)
+          unless (real ? @code_tries : @decoy_tries).take(user["id"], now)
             return html(Pages.code_page(base, { "pending" => form.get("pending") || "", "next" => next_path, "error" => "Too many tries. Wait fifteen minutes and try again." }), 429)
           end
           if !real || !@accounts.check_second_factor(user["id"], form.get("code") || "", now)
@@ -394,7 +412,7 @@ module Runlight
                                                 "error" => "That code is not right. Check the time on your phone, or use a recovery code." }), 401)
           end
 
-          @code_tries.clear(user["id"])
+          @code_tries.clear(user["id"], now)
           return signed_in_to(request, user, next_path)
         end
 
@@ -424,6 +442,8 @@ module Runlight
               @existing = true
               return redirect(@home_path, { "set-cookie" => session_cookie(request, @accounts.session_for(user, now), Accounts::SESSION_MS / 1000) })
             rescue RangeError => e
+              return html(Pages.invite_gone_page(base), 410) if e.is_a?(AccountError) && e.code == "invite_gone"
+
               return again.call(e.message)
             end
           end
@@ -432,6 +452,7 @@ module Runlight
       end
 
       def login(request, context)
+        ready
         base = @base
         form = Http::SearchParams.new(request.text)
         email = form.get("email") || ""
@@ -442,6 +463,7 @@ module Runlight
         pair = "#{account}\n#{ip == "" ? "unknown" : ip}"
         login_page = ->(opts) { Pages.login_page(base, opts.merge("next" => next_path, "forgot" => @forgot) { |_k, mine, _theirs| mine }) }
         too_many = -> { html(login_page.call({ "error" => "Too many tries. Wait fifteen minutes and try again.", "email" => email }), 429) }
+        return too_many.call if ip != "" && !@per_ip.take(ip, now)
         return too_many.call unless @per_address.take(pair, now)
 
         # A browser that signed in to the account before is never held up by others' failures.
@@ -474,12 +496,18 @@ module Runlight
 
           return html(login_page.call({ "error" => "That email and password do not match an account.", "email" => email }), 401)
         end
-        @per_address.clear(pair)
-        @per_account.forgive(account) if !over && !trusted
+        @per_address.clear(pair, now)
+        @per_ip.forgive(ip, now) if ip != ""
+        @per_account.forgive(account, now) if !over && !trusted
         # With two-factor on, the password only earns the second step.
         return html(Pages.code_page(base, { "pending" => @accounts.pending_for(user, now), "next" => next_path })) if user["twoFactor"]
 
         signed_in_to(request, user, next_path)
+      rescue AccountError => e
+        # Too many password checks already waiting, so this one was never run: try again in a moment.
+        raise unless e.code == "busy"
+
+        html(login_page.call({ "error" => e.message, "email" => email }), 503, { "retry-after" => "5" })
       end
 
       # Your own account, and for the owner and admins, everyone else's.
@@ -487,6 +515,7 @@ module Runlight
         user = signed_in(request)
         return coded("Sign in first", "sign_in", 401) if user.nil?
 
+        ready
         now = self.now
         method = request.method
         # Writes must be JSON, which a form on another page cannot send, even those with no body.
@@ -495,9 +524,16 @@ module Runlight
 
         recheck = lambda do |input, name, wrong|
           return coded("Too many tries. Wait fifteen minutes and try again.", "too_many_tries", 429) unless @rechecks.take(user["id"], now)
-          return coded(wrong[0], wrong[1], 400) if @accounts.sign_in(user["email"], field(input, name)).nil?
+          begin
+            right = @accounts.sign_in(user["email"], field(input, name))
+          rescue AccountError => e
+            raise unless e.code == "busy"
+
+            return coded("Runlight is busy checking other sign-ins. Try again in a moment.", "busy", 503)
+          end
+          return coded(wrong[0], wrong[1], 400) if right.nil?
 
-          @rechecks.forgive(user["id"])
+          @rechecks.forgive(user["id"], now)
           nil
         end
         fresh = ->(updated) { { "set-cookie" => session_cookie(request, @accounts.session_for(updated, now), Accounts::SESSION_MS / 1000) } }
@@ -532,7 +568,7 @@ module Runlight
             codes = @accounts.confirm_two_factor(user["id"], field(input, "code").gsub(/[#{Js::SPACE}]/o, ""), now)
             return coded("That code is not right. Check the time on your phone and try the next one.", "code_wrong", 400) if codes.nil?
 
-            @confirm_tries.clear(user["id"])
+            @confirm_tries.clear(user["id"], now)
             # Turning it on signs out every other browser; this one gets a new session.
             updated = @accounts.by_id(user["id"])
             return reply({ "recovery" => codes }, 200, fresh.call(updated))
@@ -541,7 +577,7 @@ module Runlight
           return refused unless refused.nil?
 
           if action == "/start"
-            @confirm_tries.clear(user["id"])
+            @confirm_tries.clear(user["id"], now)
             secret = @accounts.start_two_factor(user["id"])
             return reply({ "secret" => secret, "uri" => Crypto.otpauth_uri(secret, user["email"], Http::Url.new(request.url).host) })
           end

data/lib/runlight/assistant.rb

@@ -85,24 +85,52 @@ module Runlight
       message.is_a?(String) ? message : ""
     end
 
+    # A service at a link-local or cloud metadata address, refused there or at a redirect. One on this computer
+    # (Ollama, LM Studio) or a private network is allowed, as the person setting it up means it to be.
+    def refused(error)
+      AssistantError.new(error.message, "address_refused", { "host" => error.host })
+    end
+
+    # A service that sent the request to another origin, which would have carried the key, and the question with it.
+    def redirected(error)
+      AssistantError.new(error.message, "redirect_refused", { "host" => error.host, "to" => error.to })
+    end
+
+    # The most of a model's answer, or its list of models, read; past it the answer counts as unreadable. One byte
+    # more is asked of the fetcher, which hands back what it read, so that an answer past the limit is seen as such.
+    MAX_ANSWER_BYTES = 4 * 1024 * 1024
+
+    # The answer's JSON, or nil when it is not JSON or runs past MAX_ANSWER_BYTES.
+    def read_answer(answer)
+      parsed, data = Js.parse_json(Body.read_text_capped(answer, MAX_ANSWER_BYTES))
+      parsed ? data : nil
+    rescue Http::BodyTooLong
+      nil
+    end
+
     def post(fetcher, url, headers, body, deadline, now, cancelled)
       in_time(deadline, now, cancelled)
       left = deadline - now.call
       begin
-        answer = fetcher.fetch(url, {
+        answer = Safefetch.service_fetch(url, {
           "method" => "POST",
           "headers" => { "content-type" => "application/json" }.merge(headers),
           "body" => Json.encode(body),
           "timeoutMs" => [90_000, left].min,
-        })
+          "maxBytes" => MAX_ANSWER_BYTES + 1,
+          "truncate" => true,
+        }, fetcher)
+      rescue MetadataAddressError => e
+        raise refused(e)
+      rescue RedirectRefusedError => e
+        raise redirected(e)
       rescue StandardError => e
         host = Http::Url.new(url).host
         raise AssistantError.new("Could not reach #{host}: it took too long to answer", "assistant_timeout", { "host" => host }) if e.is_a?(Http::FetchError) && e.timed_out?
 
         raise AssistantError.new("Could not reach #{host}: the connection failed", "unreachable", { "host" => host })
       end
-      parsed, data = Js.parse_json(answer.text)
-      data = nil unless parsed
+      data = read_answer(answer)
       unless answer.ok?
         message = service_message(data)
         host = Http::Url.new(url).host
@@ -294,13 +322,17 @@ module Runlight
                 else {}
                 end
       begin
-        answer = fetcher.fetch("#{base}/models#{provider["protocol"] == "anthropic" ? "?limit=100" : ""}", { "headers" => headers, "timeoutMs" => 20_000 })
+        answer = Safefetch.service_fetch("#{base}/models#{provider["protocol"] == "anthropic" ? "?limit=100" : ""}", { "headers" => headers, "timeoutMs" => 20_000, "maxBytes" => MAX_ANSWER_BYTES + 1, "truncate" => true },
+                                         fetcher)
+      rescue MetadataAddressError => e
+        raise refused(e)
+      rescue RedirectRefusedError => e
+        raise redirected(e)
       rescue StandardError
         host = Http::Url.new(base).host
         raise AssistantError.new("Could not reach #{host}", "unreachable", { "host" => host })
       end
-      parsed, data = Js.parse_json(answer.text)
-      data = nil unless parsed
+      data = read_answer(answer)
       unless answer.ok?
         message = service_message(data)
         host = Http::Url.new(base).host
@@ -378,6 +410,6 @@ module Runlight
     end
 
     private_class_method :provider, :system_prompt, :in_time, :service_message, :post, :tool_text, :clock, :first_message, :unreadable, :blank?,
-                         :locale_compare, :collation_key
+                         :locale_compare, :collation_key, :refused
   end
 end

data/lib/runlight/connect.rb

@@ -136,9 +136,8 @@ module Runlight
     def finish_connect(runlight, params)
       state = params.get("state") || ""
       key = "connect:#{state}"
-      stored = state.match?(/\A[a-f0-9]{32}\z/) ? runlight.store.setting(key) : nil
-      # Each attempt works once.
-      runlight.store.set_setting(key, nil) if !stored.nil? && stored != ""
+      # Each attempt works once, even when it comes back twice at once.
+      stored = state.match?(/\A[a-f0-9]{32}\z/) ? runlight.store.take_setting(key) : nil
       pending = !stored.nil? && stored != "" ? pending_from(stored, runlight.now) : nil
       if pending.nil?
         raise ConnectError.new("That connection took too long or was already used. Start again.", "expired")

data/lib/runlight/core.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require "monitor"
+
 module Runlight
   # Runlight in an app: the sites it counts, the tracker endpoint's work, short links, email reports, and the
   # scheduled upkeep. A port of the TypeScript SDK's runlight.ts; `Runlight.new(options)` makes one.
@@ -22,8 +24,16 @@ module Runlight
   #   in front of. Left unset, it warns once when a request comes straight from a public address with none of
   #   those headers.
   # - linkPath: where short links on the app's own domain live, as `{linkPath}/{slug}`. Default "/go".
-  # - mail: the mail service for email reports, in code (a Transports config plus `from` and `fromName`).
-  #   When set, the dashboard shows it and cannot change it. Otherwise it is set up in Settings.
+  # - mail: how email reports, invites, and sign-in links are sent. Either a mail service in code (a Transports
+  #   config plus `from` and `fromName`), which the dashboard shows and cannot change, or a mailer of the app's
+  #   own, such as a CMS's: `{ send: ->(message) { ... }, from:, from_name:, via: }`. The app's mailer is a
+  #   default: a service saved in the dashboard takes its place, and removing that service goes back to it.
+  #   `via` names it there, such as "WordPress (WP Mail SMTP)". The message has to, from, fromName (when there
+  #   is one), subject, html, text, and headers; `send` raises to say it failed. Without either, the service is
+  #   set up in Settings.
+  # - mailServices: the ids of the mail services Settings offers and saves, such as every service but "smtp" in
+  #   an app that cannot keep connections of its own open. Default every service. A service saved earlier that
+  #   is not in the list counts as none, so the app's mailer, if there is one, sends instead.
   # - secret: encrypts the keys kept in the database: the mail service's, the AI Assistant's, and the tokens
   #   for connected installs. Default the RUNLIGHT_SECRET environment variable, then RUNLIGHT_TOKEN.
   # - rateLimit: tracker requests allowed per visitor address per minute. Default 120, which a real visitor
@@ -59,7 +69,9 @@ module Runlight
     # On a database that caps statements per request (Cloudflare D1), fewer days a check, about 30 statements.
     METERED_ROLLUP_BATCH = 4
     ROLLUP_DELAY_MS = 2 * 3_600_000
-    private_constant :ROLLUP_VERSION, :ROLLUP_BATCH, :REMOTE_MAX_BYTES, :METERED_ROLLUP_BATCH, :ROLLUP_DELAY_MS
+    # The longest a tracker hit waits for the tables while another process creates or upgrades them.
+    TRACKER_WAIT_MS = 10_000
+    private_constant :ROLLUP_VERSION, :ROLLUP_BATCH, :REMOTE_MAX_BYTES, :METERED_ROLLUP_BATCH, :ROLLUP_DELAY_MS, :TRACKER_WAIT_MS
 
     BUSY = /timeout exceeded when trying to connect|connection timeout|no MySQL connection was free|SQLITE_BUSY|database is locked/i
     private_constant :BUSY
@@ -76,7 +88,12 @@ module Runlight
                 # Whether a connected install may be on this machine, at http://localhost or http://127.0.0.1.
                 :local_installs,
                 # Every outgoing request goes through it.
-                :fetcher
+                :fetcher,
+                # The app's own mailer, used while no service is saved in the dashboard: { "send", "from",
+                # "fromName" (when there is one), "via" }. Nil when there is none.
+                :app_mailer,
+                # The mail services Settings offers and saves: every one, unless `mailServices` names fewer.
+                :mail_services
 
     # Where routes() serves the dashboard and API, which a link domain leaves alone, as a list without
     # repeats. Middleware often runs apart from the routes, where none were made, so the default "/runlight"
@@ -119,7 +136,30 @@ module Runlight
       @fetcher = options["fetcher"] || Http::NetFetcher.new
       @links = Links.new(self)
       @link_path = "/#{(options["linkPath"].nil? ? "/go" : options["linkPath"]).to_s.gsub(%r{\A/+|/+\z}, "")}"
-      @mail_in_code = options["mail"]
+      mail = options["mail"]
+      if mail.is_a?(Hash) && mail["send"].respond_to?(:call)
+        unless Js.string(mail["from"].nil? ? "" : mail["from"]).match?(EMAIL)
+          raise ArgumentError, "Runlight: the app's mailer needs a from address, like reports@example.com"
+        end
+
+        @app_mailer = { "send" => mail["send"], "from" => mail["from"].to_s }
+        @app_mailer["fromName"] = mail["fromName"].to_s unless mail["fromName"].nil? || mail["fromName"].to_s == ""
+        @app_mailer["via"] = Js.string(mail["via"].nil? ? "" : mail["via"])
+        @app_mailer.freeze
+        @mail_in_code = nil
+      else
+        @app_mailer = nil
+        @mail_in_code = mail
+      end
+      offered = options["mailServices"]&.then { |ids| Array(ids).map(&:to_s) }
+      offered&.each do |id|
+        unless Mail::Transports::SERVICES.any? { |s| s["id"] == id }
+          raise ArgumentError, "Runlight: mail_services names \"#{id}\", which is not a mail service"
+        end
+      end
+      @mail_services = if offered.nil? then Mail::Transports::SERVICES
+                       else Mail::Transports::SERVICES.select { |s| offered.include?(s["id"]) }.freeze
+                       end
       @local_installs = options["localInstalls"] ? true : false
       @secret = if options.key?("secret") && !options["secret"].nil?
                   options["secret"].to_s
@@ -132,6 +172,11 @@ module Runlight
       @remote_seen = {}
       @overrides = {}
       @ready = false
+      # init runs once however many threads ask at once; reentrant, as init may ask for itself.
+      @init_lock = Monitor.new
+      # The thread running init for tracker hits, which wait for it a moment at most.
+      @init_thread = nil
+      @init_thread_lock = Mutex.new
       @checking = false
       # When planner statistics were last gathered.
       @optimized_at = 0
@@ -153,18 +198,27 @@ module Runlight
       @clock.call.to_i
     end
 
-    # The mail service: from code, or as saved in the dashboard. Nil when there is none.
+    # The mail Runlight sends with: a service from code, or as saved in the
+    # dashboard, or else the app's own mailer, as service "app" with its
+    # `via`. Nil when there is none.
     def mail_settings
       return @mail_in_code.merge("source" => "code") unless @mail_in_code.nil?
 
       init
       sealed = @store.setting("mail")
-      return nil if sealed.nil? || sealed == ""
+      opened = sealed.nil? || sealed == "" ? nil : Mail::Secret.unseal(sealed, @secret)
+      saved = opened.nil? || opened == "" ? nil : Json.decode(opened)
+      # A service no longer offered counts as none, so it is never sent through.
+      if saved && (@mail_services.equal?(Mail::Transports::SERVICES) || @mail_services.any? { |s| s["id"] == saved["service"] })
+        return saved.merge("source" => "dashboard")
+      end
 
-      opened = Mail::Secret.unseal(sealed, @secret)
-      return nil if opened.nil? || opened == ""
+      app = @app_mailer
+      return nil if app.nil?
 
-      Json.decode(opened).merge("source" => "dashboard")
+      settings = { "service" => "app", "from" => app["from"] }
+      settings["fromName"] = app["fromName"] if app.key?("fromName")
+      settings.merge("via" => app["via"], "source" => "app")
     end
 
     # Saves the mail service from the dashboard. A secret field left blank
@@ -176,9 +230,13 @@ module Runlight
         @store.set_setting("mail", nil)
         return
       end
-      before = mail_settings || {}
+      current = mail_settings
+      before = current && current["source"] == "dashboard" ? current : {}
       service = Mail::Transports::SERVICES.find { |s| s["id"] == input["service"] }
       raise Mail::MailError.new("Pick a mail service", "mail_service", {}) if service.nil?
+      unless @mail_services.include?(service)
+        raise Mail::MailError.new("#{service["name"]} is not offered here. Pick another mail service", "mail_service", { "service" => service["id"] })
+      end
 
       settings = { "service" => service["id"] }
       service["fields"].each do |f|
@@ -211,17 +269,33 @@ module Runlight
       config = settings.merge("from" => from)
       config["fromName"] = from_name unless from_name == ""
       Mail::Transports.check_config(config)
+      if config["service"] == "smtp" && Js.truthy?(config["host"]) && Safefetch.metadata_host?(config["host"].to_s)
+        raise Mail::MailError.new("#{config["host"]} is a link-local or cloud metadata address, which Runlight never connects to", "address_refused",
+                                  { "host" => config["host"] })
+      end
       @store.set_setting("mail", Mail::Secret.seal(Json.encode(config), @secret))
     end
 
-    # Sends one email through the mail service: { "to", "subject", "html", "text", "headers" (optional) }.
+    # Sends one email through the mail service, or the app's own mailer when no service is saved: { "to",
+    # "subject", "html", "text", "headers" (optional) }.
     def send_mail(message)
       settings = mail_settings
       raise Mail::MailError.new("Set up a mail service first", "mail_unset", {}) if settings.nil?
 
       full = message.merge("from" => settings["from"])
       full["fromName"] = settings["fromName"] unless settings["fromName"].nil?
-      Mail::Transports.deliver(settings, full, @fetcher, now)
+      return Mail::Transports.deliver(settings, full, @fetcher, now) unless settings["source"] == "app"
+
+      begin
+        @app_mailer["send"].call(full.merge("headers" => message["headers"] || {}))
+      rescue Mail::MailError
+        raise
+      rescue StandardError => e
+        detail = e.message
+        via = settings["via"]
+        raise Mail::MailError.new("#{via} could not send it#{": #{detail}" unless detail == ""}", "mail_app_failed",
+                                  { "via" => via, "detail" => detail })
+      end
     end
 
     # Sends every report that is due: last week's on Monday from 8am, last
@@ -275,6 +349,30 @@ module Runlight
     def init
       return if @ready
 
+      @init_lock.synchronize { init_now unless @ready }
+    end
+
+    # Whether init finished within `ms`; false while it is still waiting, such as on another process creating
+    # the tables, and it goes on in a thread of its own for later requests. Its errors are raised.
+    private def ready_within(ms)
+      return true if @ready
+
+      runner = @init_thread_lock.synchronize do
+        # One that failed is started again, as init is by the next request after a failure.
+        @init_thread = nil unless @init_thread&.alive? || @init_thread&.status == false
+        @init_thread ||= Thread.new { init }.tap { |t| t.report_on_exception = false }
+      end
+      return false if runner.join(ms / 1000.0).nil?
+
+      true
+    end
+
+    # Whether init has run, so middleware can leave the app's own requests alone until it has.
+    def ready?
+      @ready
+    end
+
+    private def init_now
       @store.migrate
       # A database that never had its statistics gathered gets them now, before any report is read, rather
       # than at the first scheduled check, which an app may never run.
@@ -434,9 +532,11 @@ module Runlight
       nil
     end
 
-    # Changes a site's name or timezone from the dashboard. Stored apart from
+    # Changes a site's name, timezone, or retention from the dashboard. Stored apart from
     # the settings in code, which keep being written on every start. A managed
     # site has no settings in code, so its changes, hostnames too, go to its row.
+    # Every field is checked before anything changes, since a new timezone clears the
+    # built days and a shorter retention deletes visits, and pruning starts only once saved.
     # A key left out of `patch` is left alone, as TS's undefined is.
     def update_site(id, patch)
       patch = Options.normalize(patch)
@@ -451,6 +551,7 @@ module Runlight
 
         nxt["name"] = name
       end
+      timezone = nil
       if given?(patch, "timezone")
         timezone = Js.string(patch["timezone"])
         unless Dates.timezone?(timezone)
@@ -458,16 +559,20 @@ module Runlight
         end
 
         nxt["timezone"] = timezone
-        zone_changed(id, timezone) if timezone != site(id)&.[]("timezone")
       end
+      if @managed_sites && given?(patch, "hostnames") && !@remotes.key?(id)
+        nxt["hostnames"] = hostnames_for(patch["hostnames"], id)
+      end
+      check_retention(id, patch["retentionMonths"]) if given?(patch, "retentionMonths")
+      zone_changed(id, timezone) if !timezone.nil? && timezone != site(id)&.[]("timezone")
       if @managed_sites
-        nxt["hostnames"] = hostnames_for(patch["hostnames"], id) if given?(patch, "hostnames") && !@remotes.key?(id)
         @store.upsert_site(nxt, now)
         @configured = @configured.map { |site| site["id"] == id ? nxt : site }
-        return site(id)
+      else
+        @store.set_site_overrides(id, nxt)
+        @overrides[id] = nxt
       end
-      @store.set_site_overrides(id, nxt)
-      @overrides[id] = nxt
+      set_retention(id, patch["retentionMonths"]) if given?(patch, "retentionMonths")
       site(id)
     end
 
@@ -480,13 +585,7 @@ module Runlight
     # Sets how many months of visits a site keeps. Deleting a long history takes a while, so it runs in
     # pieces in idle(), after the answer, with tracking going on between them, as TS runs it after answering.
     def set_retention(site, months)
-      raise SettingsError.new("Unknown site", "unknown_site") if site(site).nil? || @remotes.key?(site)
-
-      unless months.nil? || (months.is_a?(Numeric) && RETENTION_MONTHS.include?(months))
-        list = RETENTION_MONTHS.join(", ")
-        raise SettingsError.new("Keep visits for #{list} months, or forever", "retention_bad", { "months" => list })
-      end
-
+      check_retention(site, months)
       @store.set_setting("retention:#{site}", months.nil? ? nil : Json.number(months))
       @pruning << site
       nil
@@ -601,6 +700,10 @@ module Runlight
         if parsed.nil? || (parsed.protocol != "https:" && parsed.protocol != "http:")
           raise SettingsError.new("Enter the service's address, starting with https://", "assistant_address_bad")
         end
+        if Safefetch.metadata_host?(parsed.hostname)
+          raise SettingsError.new("#{parsed.hostname} is a link-local or cloud metadata address, which Runlight never connects to", "address_refused",
+                                  { "host" => parsed.hostname })
+        end
       end
       raise SettingsError.new("Enter the service's address", "assistant_address") if base_url == "" && provider["baseUrl"] == ""
 
@@ -710,6 +813,10 @@ module Runlight
       return if !Ua.ai_agent(ua).nil? || Ua.bot?(ua)
       return if !@limit.nil? && !@limit.allow(client_ip(request, context))
 
+      # While another process creates or upgrades the tables (an index on a big table takes a while), a hit
+      # waits a moment at most and is then dropped, rather than holding its request until that is done.
+      return unless ready_within(TRACKER_WAIT_MS)
+
       # A database too busy to take the hit right now (every pooled connection held by long reports, or
       # another process writing the SQLite file) gets it a little later, at the time it arrived.
       at = now
@@ -737,7 +844,8 @@ module Runlight
     def link_handler
       lambda do |request, context = {}|
         path = Http::Url.new(request.url).pathname
-        slug = path.start_with?("#{@link_path}/") ? decode(path[(@link_path.length + 1)..]) : ""
+        # A slug with broken escapes is one no link has.
+        slug = path.start_with?("#{@link_path}/") ? Js.decode_uri_component(path[(@link_path.length + 1)..]) || "" : ""
         found = slug != "" && !slug.include?("/") ? redirect(request, slug, "", context) : nil
         found || not_found
       end
@@ -764,7 +872,7 @@ module Runlight
       (@route_bases.empty? ? ["/runlight"] : @route_bases).each do |base|
         return nil if base != "/" && (url.pathname == base || url.pathname.start_with?("#{base}/"))
       end
-      slug = decode(url.pathname[1..].to_s)
+      slug = Js.decode_uri_component(url.pathname[1..].to_s) || ""
       found = slug != "" && !slug.include?("/") ? redirect(request, slug, host, context) : nil
       found || not_found
     end
@@ -933,11 +1041,6 @@ module Runlight
       Http::Response.new("Not found", status: 404, headers: { "content-type" => "text/plain; charset=utf-8" })
     end
 
-    # decodeURIComponent, raising where it throws a URIError.
-    def decode(text)
-      Js.decode_uri_component(text) || raise(ArgumentError, "URI malformed")
-    end
-
     # True for a database that could not take a statement just now and may a moment later.
     def busy?(error)
       error.message.match?(BUSY)
@@ -955,6 +1058,15 @@ module Runlight
     end
 
     # Checks a list of hostnames for a managed site: at least one, each a domain, none taken.
+    def check_retention(site, months)
+      raise SettingsError.new("Unknown site", "unknown_site") if site(site).nil? || @remotes.key?(site)
+
+      unless months.nil? || (months.is_a?(Numeric) && RETENTION_MONTHS.include?(months))
+        list = RETENTION_MONTHS.join(", ")
+        raise SettingsError.new("Keep visits for #{list} months, or forever", "retention_bad", { "months" => list })
+      end
+    end
+
     def hostnames_for(input, except = nil)
       items = input.is_a?(Array) ? input : Js.string(input.nil? ? "" : input).split(/[#{Js::SPACE},]+/)
       hostnames = []
@@ -1260,7 +1372,7 @@ module Runlight
         "mobile" => request.headers.get("sec-ch-ua-mobile"),
         "platform" => request.headers.get("sec-ch-ua-platform"),
       }, client["screenWidth"])
-      location = Geo.locate(request.headers, ip, @geo)
+      location = Geo.locate(request.headers, ip, @geo, Js.truthy?(@trust_proxy))
       row = {
         "id" => session["id"],
         "site" => site["id"],
@@ -1335,6 +1447,8 @@ module Runlight
       @salts = {}
       sites.map { |site| site["timezone"] }.uniq.each { |timezone| current_salts(now, timezone) }
       drop_old_salts(now)
+      # Sign-in counts that have run out, some keyed by an address, and the hashing keys of days gone.
+      Accounts::Throttle.sweep(@store, now)
       # Every site's retention covers any one site's that is still waiting.
       @pruning = []
       begin