runlight 0.1.1 → 0.1.3

data/assets/pick-return.js

@@ -0,0 +1 @@
+(function(){var a=window,r=document,i=location.hash.slice(1);history.replaceState(null,"",location.pathname);var t={};i.split("&").forEach(function(e){var n=e.indexOf("=");try{n>0&&(t[e.slice(0,n)]=decodeURIComponent(e.slice(n+1)))}catch(s){}});var o=null;try{o=localStorage.getItem("runlight-pick")}catch(e){}var c=/^[a-f0-9]{32}$/.test(t.n||"")&&t.n===o&&typeof t.s=="string"&&!!a.BroadcastChannel;if(c){try{localStorage.removeItem("runlight-pick")}catch(e){}var l=new BroadcastChannel("runlight-pick");l.postMessage({runlight:"pick",nonce:t.n,selector:t.s,href:t.h||"",text:t.t||""}),l.close(),setTimeout(function(){a.close()},900)}r.getElementById(c?"done":"gone").hidden=!1})();

data/assets/picker.js

@@ -1 +1 @@
-(function(){var l=window,a=document,g=l.opener;if(g){var d="__RUNLIGHT_PICK_TARGET__";if(/^https?:\/\//.test(d)){var x=JSON.parse("__RUNLIGHT_PICK_HOSTS__");if(!(x.length&&x.indexOf(location.hostname.toLowerCase().replace(/^www\./,""))<0)){var m={en:["Click what you want to count","Use this","Pick again","Cancel","Matches {n} on this page","Sent to Runlight. You can close this tab."],fr:["Cliquez sur ce que vous voulez compter","Utiliser","Choisir \xE0 nouveau","Annuler","{n} sur cette page","Envoy\xE9 \xE0 Runlight. Vous pouvez fermer cet onglet."],es:["Haz clic en lo que quieres contar","Usar esto","Elegir otra vez","Cancelar","{n} en esta p\xE1gina","Enviado a Runlight. Puedes cerrar esta pesta\xF1a."],de:["Klicke auf das, was gez\xE4hlt werden soll","Verwenden","Neu w\xE4hlen","Abbrechen","{n} auf dieser Seite","An Runlight gesendet. Du kannst diesen Tab schlie\xDFen."],pt:["Clique no que quer contar","Usar","Escolher de novo","Cancelar","{n} nesta p\xE1gina","Enviado ao Runlight. Pode fechar esta aba."]},T=(/[?&]runlight_lang=([a-z]{2})/.exec(location.search)||[])[1],s=m[T]||m.en,b=function(t){return/^[a-zA-Z][\w-]{1,40}$/.test(t)&&!/\d{3,}|^(css|sc|jsx|svelte|astro)-|__\w{5,}/.test(t)},w=function(t){return l.CSS&&CSS.escape?CSS.escape(t):t.replace(/[^\w-]/g,"\\$&")},C=function(t){try{return a.querySelectorAll(t).length===1}catch(e){return!1}},A=function(t){for(var e=[],n=t;n&&n.nodeType===1&&n!==a.documentElement;n=n.parentElement){if(n.id&&b(n.id)){e.unshift("#"+w(n.id));break}var r=n.tagName.toLowerCase(),v=n.getAttribute("data-runlight")||n.getAttribute("data-testid");if(v)r+="["+(n.hasAttribute("data-runlight")?"data-runlight":"data-testid")+'="'+v.replace(/"/g,'\\"')+'"]';else{var q=Array.prototype.filter.call(n.classList,b).slice(0,2);q.length&&(r+="."+q.map(w).join("."))}e.unshift(r);var E=e.join(" > ");if(C(E)||e.length>=4)return E;var _=n.parentElement;if(_){var k=Array.prototype.filter.call(_.children,function(z){return z.tagName===n.tagName});if(k.length>1&&(e[0]+=":nth-of-type("+(k.indexOf(n)+1)+")"),C(e.join(" > ")))return e.join(" > ")}}return e.join(" > ")},o=a.createElement("div");o.style.cssText="position:fixed;inset:0;z-index:2147483647;pointer-events:none";var u=o.attachShadow?o.attachShadow({mode:"open"}):o;u.innerHTML="<style>.box{position:fixed;border:2px solid #2563eb;background:rgba(37,99,235,.1);border-radius:4px;pointer-events:none;transition:all .06s}.bar{position:fixed;left:50%;bottom:20px;transform:translateX(-50%);display:flex;align-items:center;gap:10px;max-width:min(720px,calc(100vw - 32px));padding:10px 12px 10px 16px;border-radius:12px;background:#111;color:#fff;font:14px/1.4 system-ui,sans-serif;box-shadow:0 8px 30px rgba(0,0,0,.3);pointer-events:auto}.msg{flex:1;min-width:0;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}code{font:12px ui-monospace,monospace;color:#93c5fd}button{height:32px;padding:0 12px;border:0;border-radius:8px;font:inherit;cursor:pointer;background:#333;color:#fff}button.go{background:#fff;color:#111}</style><div class='box' hidden></div><div class='bar'><span class='msg'></span><span class='acts'></span></div>",a.documentElement.appendChild(o);var f=u.querySelector(".box"),c=u.querySelector(".msg"),p=u.querySelector(".acts"),i=null,h=function(t,e,n){var r=a.createElement("button");r.textContent=t,e&&(r.className=e),r.addEventListener("click",n),p.appendChild(r)},y=function(t){if(!t)return f.hidden=!0;var e=t.getBoundingClientRect();f.hidden=!1,f.style.cssText+=";left:"+(e.left-2)+"px;top:"+(e.top-2)+"px;width:"+(e.width+4)+"px;height:"+(e.height+4)+"px"},S=function(){i=null,c.innerHTML="<span></span> \xB7 <code></code>",c.querySelector("span").textContent=s[0],c.querySelector("code").textContent=d.replace(/^https?:\/\//,""),p.textContent="",h(s[3],"",function(){l.close()})},L=function(t){var e=A(t),n=t.closest("a[href]"),r=0;try{r=a.querySelectorAll(e).length}catch(v){}i={selector:e,href:n?n.href:"",text:(t.textContent||"").trim().slice(0,80)},c.innerHTML="<code></code> \xB7 "+s[4].replace("{n}",r),c.querySelector("code").textContent=e,p.textContent="",h(s[2],"",S),h(s[1],"go",function(){g.postMessage({runlight:"pick",selector:i.selector,href:i.href,text:i.text},d),c.textContent=s[5],p.textContent="",setTimeout(function(){l.close()},900)})};a.addEventListener("mouseover",function(t){i||y(t.target)},!0),["click","mousedown","mouseup","pointerdown","submit"].forEach(function(t){a.addEventListener(t,function(e){e.composedPath&&e.composedPath()[0]&&o.contains&&e.composedPath().indexOf(o)>=0||(e.preventDefault(),e.stopPropagation(),t==="click"&&!i&&(y(e.target),L(e.target)))},!0)}),S()}}}})();
+(function(){var p=window,o=document,d="__RUNLIGHT_PICK_TARGET__";if(/^https?:\/\//.test(d)){var g="__RUNLIGHT_PICK_RETURN__",x="__RUNLIGHT_PICK_NONCE__",m=g.indexOf(d+"/")===0&&/^[a-f0-9]{32}$/.test(x),b=p.opener;if(!(!m&&!b)){var C=JSON.parse("__RUNLIGHT_PICK_HOSTS__");if(!(C.length&&C.indexOf(location.hostname.toLowerCase().replace(/^www\./,""))<0)){var w={en:["Click what you want to count","Use this","Pick again","Cancel","Matches {n} on this page","Sent to Runlight. You can close this tab."],fr:["Cliquez sur ce que vous voulez compter","Utiliser","Choisir \xE0 nouveau","Annuler","{n} sur cette page","Envoy\xE9 \xE0 Runlight. Vous pouvez fermer cet onglet."],es:["Haz clic en lo que quieres contar","Usar esto","Elegir otra vez","Cancelar","{n} en esta p\xE1gina","Enviado a Runlight. Puedes cerrar esta pesta\xF1a."],de:["Klicke auf das, was gez\xE4hlt werden soll","Verwenden","Neu w\xE4hlen","Abbrechen","{n} auf dieser Seite","An Runlight gesendet. Du kannst diesen Tab schlie\xDFen."],pt:["Clique no que quer contar","Usar","Escolher de novo","Cancelar","{n} nesta p\xE1gina","Enviado ao Runlight. Pode fechar esta aba."]},N=(/[?&]runlight_lang=([a-z]{2})/.exec(location.search)||[])[1],c=w[N]||w.en,_=function(t){return/^[a-zA-Z][\w-]{1,40}$/.test(t)&&!/\d{3,}|^(css|sc|jsx|svelte|astro)-|__\w{5,}/.test(t)},y=function(t){return p.CSS&&CSS.escape?CSS.escape(t):t.replace(/[^\w-]/g,"\\$&")},S=function(t){try{return o.querySelectorAll(t).length===1}catch(e){return!1}},A=function(t){for(var e=[],n=t;n&&n.nodeType===1&&n!==o.documentElement;n=n.parentElement){if(n.id&&_(n.id)){e.unshift("#"+y(n.id));break}var r=n.tagName.toLowerCase(),i=n.getAttribute("data-runlight")||n.getAttribute("data-testid");if(i)r+="["+(n.hasAttribute("data-runlight")?"data-runlight":"data-testid")+'="'+i.replace(/"/g,'\\"')+'"]';else{var q=Array.prototype.filter.call(n.classList,_).slice(0,2);q.length&&(r+="."+q.map(y).join("."))}e.unshift(r);var R=e.join(" > ");if(S(R)||e.length>=4)return R;var T=n.parentElement;if(T){var L=Array.prototype.filter.call(T.children,function(I){return I.tagName===n.tagName});if(L.length>1&&(e[0]+=":nth-of-type("+(L.indexOf(n)+1)+")"),S(e.join(" > ")))return e.join(" > ")}}return e.join(" > ")},s=o.createElement("div");s.style.cssText="position:fixed;inset:0;z-index:2147483647;pointer-events:none";var u=s.attachShadow?s.attachShadow({mode:"open"}):s;u.innerHTML="<style>.box{position:fixed;border:2px solid #2563eb;background:rgba(37,99,235,.1);border-radius:4px;pointer-events:none;transition:all .06s}.bar{position:fixed;left:50%;bottom:20px;transform:translateX(-50%);display:flex;align-items:center;gap:10px;max-width:min(720px,calc(100vw - 32px));padding:10px 12px 10px 16px;border-radius:12px;background:#111;color:#fff;font:14px/1.4 system-ui,sans-serif;box-shadow:0 8px 30px rgba(0,0,0,.3);pointer-events:auto}.msg{flex:1;min-width:0;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}code{font:12px ui-monospace,monospace;color:#93c5fd}button{height:32px;padding:0 12px;border:0;border-radius:8px;font:inherit;cursor:pointer;background:#333;color:#fff}button.go{background:#fff;color:#111}</style><div class='box' hidden></div><div class='bar'><span class='msg'></span><span class='acts'></span></div>",o.documentElement.appendChild(s);var h=u.querySelector(".box"),l=u.querySelector(".msg"),f=u.querySelector(".acts"),a=null,v=function(t,e,n){var r=o.createElement("button");r.textContent=t,e&&(r.className=e),r.addEventListener("click",n),f.appendChild(r)},E=function(t){if(!t)return h.hidden=!0;var e=t.getBoundingClientRect();h.hidden=!1,h.style.cssText+=";left:"+(e.left-2)+"px;top:"+(e.top-2)+"px;width:"+(e.width+4)+"px;height:"+(e.height+4)+"px"},k=function(){a=null,l.innerHTML="<span></span> \xB7 <code></code>",l.querySelector("span").textContent=c[0],l.querySelector("code").textContent=d.replace(/^https?:\/\//,""),f.textContent="",v(c[3],"",function(){p.close()})},U=function(t){var e=A(t),n=t.closest("a[href]"),r=0;try{r=o.querySelectorAll(e).length}catch(i){}a={selector:e,href:n?n.href:"",text:(t.textContent||"").trim().slice(0,80)},l.innerHTML="<code></code> \xB7 "+c[4].replace("{n}",r),l.querySelector("code").textContent=e,f.textContent="",v(c[2],"",k),v(c[1],"go",function(){if(l.textContent=c[5],f.textContent="",m){var i=o.createElement("a");i.rel="noreferrer",i.href=g+"#n="+x+"&s="+encodeURIComponent(a.selector)+"&h="+encodeURIComponent(a.href)+"&t="+encodeURIComponent(a.text),u.appendChild(i),i.click();return}b.postMessage({runlight:"pick",selector:a.selector,href:a.href,text:a.text},d),setTimeout(function(){p.close()},900)})};o.addEventListener("mouseover",function(t){a||E(t.target)},!0),["click","mousedown","mouseup","pointerdown","submit"].forEach(function(t){o.addEventListener(t,function(e){e.composedPath&&e.composedPath()[0]&&s.contains&&e.composedPath().indexOf(s)>=0||(e.preventDefault(),e.stopPropagation(),t==="click"&&!a&&(E(e.target),U(e.target)))},!0)}),k()}}}})();

data/assets/tracker.js

@@ -1 +1 @@
-(function(){var a=window,n=document,u=navigator,p=n.currentScript;if(p){var o=function(e){return p.getAttribute("data-"+e)},R=p.src.replace(/s\.js(\?.*)?$/,"e"),b=o("site"),U=o("hash")!==null,I=o("manual")!==null,$=function(e){return new RegExp("^"+e.replace(/[.+?^${}()|[\]\\]/g,"\\$&").replace(/\*/g,".*")+"$")},C=(o("exclude")||"").split(",").filter(Boolean).map(function(e){return $(e.trim())}),A=!1,H=a.runlight&&a.runlight.q||[],m="__RUNLIGHT_RULES__",T=typeof m=="object"&&(m[b]||m[location.hostname.replace(/^www\./,"")]||m["*"])||[];if(/[?&]runlight=pick\b/.test(location.search)&&a.opener){var M=n.createElement("script");M.src=p.src.replace(/s\.js(\?.*)?$/,"pick.js")+location.search,n.head.appendChild(M),a.runlight=function(){};return}var N=!1;try{var O=/[?&]runlight=(ignore|track)\b/.exec(location.search);O&&(O[1]==="ignore"?localStorage.setItem("runlight_ignore","1"):localStorage.removeItem("runlight_ignore")),N=localStorage.getItem("runlight_ignore")==="1"}catch(e){}if(u.webdriver||N||o("dnt")!==null&&(u.doNotTrack==="1"||a.doNotTrack==="1")){a.runlight=function(){};return}var k=function(e,t){if(!A){var r={k:e,u:w};b&&(r.s=b);for(var i in t)r[i]=t[i];var s=JSON.stringify(r);u.sendBeacon&&u.sendBeacon(R,s)||a.fetch&&fetch(R,{method:"POST",body:s,keepalive:!0}).catch(function(){})}},G=function(){var e=new Uint8Array(8);return(a.crypto||{}).getRandomValues?crypto.getRandomValues(e):e.forEach(function(t,r){e[r]=Math.random()*256}),Array.prototype.map.call(e,function(t){return(t+256).toString(36).slice(-2)}).join("").slice(0,12)},z=o("404")!==null,w="",v="",f=0,d=0,y=0,J=function(){return n.visibilityState==="visible"&&n.hasFocus()},B=function(){d&&(f+=Date.now()-d),d=0},c=function(){!d&&J()&&(d=Date.now())},E=function(){B(),v&&f>=1e3&&(k("engagement",{i:v,e:f,d:y}),f=0)},F=function(){var e=n.documentElement,t=Math.max(e.scrollHeight,n.body?n.body.scrollHeight:0),r=(a.scrollY||e.scrollTop)+a.innerHeight,i=t>0?Math.min(100,Math.round(r/t*100)):100;i>y&&(y=i)},P=function(){var e=location;return e.protocol+"//"+e.host+e.pathname+e.search+(U?e.hash:"")},h=function(e){var t=typeof e=="string"?new URL(e,location.href).href:P();if(t!==w){var r=w||n.referrer;E(),w=t;var i=new URL(t).pathname;A=C.some(function(s){return s.test(i)}),v=G(),f=0,y=0,F(),c(),k("pageview",{i:v,r,t:n.title,w:screen.width,h:screen.height,l:u.language}),z&&l("404",{path:location.pathname}),z=!1}},l=function(e,t){typeof e!="string"||!e||k("event",{i:v,n:e,p:t&&typeof t=="object"?t:void 0})},D=function(e){var t=history[e];history[e]=function(){var r=t.apply(this,arguments);return h(),r}};I||(D("pushState"),D("replaceState"),a.addEventListener("popstate",h),U&&a.addEventListener("hashchange",h)),n.addEventListener("visibilitychange",function(){n.visibilityState==="hidden"?E():c()}),a.addEventListener("pagehide",E),a.addEventListener("blur",B),a.addEventListener("focus",c),a.addEventListener("scroll",function(){F(),c()},{passive:!0}),n.addEventListener("pointerdown",c,!0),n.addEventListener("keydown",c,!0);var Y=/\.(pdf|zip|gz|tgz|dmg|pkg|exe|msi|apk|docx?|xlsx?|pptx?|csv|txt|rtf|epub|mp3|wav|mp4|mov|avi|mkv|psd|ai|svg|key|numbers|pages)$/i;n.addEventListener("click",function(e){var t=e.target;if(!(!t||!t.closest)){for(var r=t.closest("a[href]"),i=0;i<T.length;i++)try{var s=T[i],S=s[1];(s[0]==="s"?t.closest(S):r&&$(S).test(S.charAt(0)==="/"?r.pathname:r.href))&&l(s[2])}catch(q){}var g=t.closest("[data-runlight]");if(g){for(var V={},x=0;x<g.attributes.length;x++){var _=g.attributes[x];_.name.indexOf("data-runlight-")===0&&(V[_.name.slice(14)]=_.value)}l(g.getAttribute("data-runlight"),V)}if(!(!r||g)){var j=r.href;/^https?:/.test(j)&&(o("downloads")!=="false"&&Y.test(r.pathname)?l("File download",{url:j}):o("outbound")!=="false"&&r.host!==location.host&&l("Outbound link",{url:j}))}}},!0),a.runlight=l,l.pageview=h,I||h();for(var L=0;L<H.length;L++)l.apply(null,H[L])}})();
+(function(){var a=window,n=document,u=navigator,p=n.currentScript;if(p){var o=function(e){return p.getAttribute("data-"+e)},R=p.src.replace(/s\.js(\?.*)?$/,"e"),b=o("site"),U=o("hash")!==null,I=o("manual")!==null,$=function(e){return new RegExp("^"+e.replace(/[.+?^${}()|[\]\\]/g,"\\$&").replace(/\*/g,".*")+"$")},C=(o("exclude")||"").split(",").filter(Boolean).map(function(e){return $(e.trim())}),A=!1,H=a.runlight&&a.runlight.q||[],m="__RUNLIGHT_RULES__",T=typeof m=="object"&&(m[b]||m[location.hostname.replace(/^www\./,"")]||m["*"])||[];if(/[?&]runlight=pick\b/.test(location.search)&&/[?&]runlight_ticket=/.test(location.search)){var M=n.createElement("script");M.src=p.src.replace(/s\.js(\?.*)?$/,"pick.js")+location.search,n.head.appendChild(M),a.runlight=function(){};return}var N=!1;try{var O=/[?&]runlight=(ignore|track)\b/.exec(location.search);O&&(O[1]==="ignore"?localStorage.setItem("runlight_ignore","1"):localStorage.removeItem("runlight_ignore")),N=localStorage.getItem("runlight_ignore")==="1"}catch(e){}if(u.webdriver||N||o("dnt")!==null&&(u.doNotTrack==="1"||a.doNotTrack==="1")){a.runlight=function(){};return}var k=function(e,t){if(!A){var r={k:e,u:w};b&&(r.s=b);for(var i in t)r[i]=t[i];var s=JSON.stringify(r);u.sendBeacon&&u.sendBeacon(R,s)||a.fetch&&fetch(R,{method:"POST",body:s,keepalive:!0}).catch(function(){})}},G=function(){var e=new Uint8Array(8);return(a.crypto||{}).getRandomValues?crypto.getRandomValues(e):e.forEach(function(t,r){e[r]=Math.random()*256}),Array.prototype.map.call(e,function(t){return(t+256).toString(36).slice(-2)}).join("").slice(0,12)},z=o("404")!==null,w="",v="",f=0,d=0,y=0,J=function(){return n.visibilityState==="visible"&&n.hasFocus()},B=function(){d&&(f+=Date.now()-d),d=0},c=function(){!d&&J()&&(d=Date.now())},E=function(){B(),v&&f>=1e3&&(k("engagement",{i:v,e:f,d:y}),f=0)},F=function(){var e=n.documentElement,t=Math.max(e.scrollHeight,n.body?n.body.scrollHeight:0),r=(a.scrollY||e.scrollTop)+a.innerHeight,i=t>0?Math.min(100,Math.round(r/t*100)):100;i>y&&(y=i)},P=function(){var e=location;return e.protocol+"//"+e.host+e.pathname+e.search+(U?e.hash:"")},h=function(e){var t=typeof e=="string"?new URL(e,location.href).href:P();if(t!==w){var r=w||n.referrer;E(),w=t;var i=new URL(t).pathname;A=C.some(function(s){return s.test(i)}),v=G(),f=0,y=0,F(),c(),k("pageview",{i:v,r,t:n.title,w:screen.width,h:screen.height,l:u.language}),z&&l("404",{path:location.pathname}),z=!1}},l=function(e,t){typeof e!="string"||!e||k("event",{i:v,n:e,p:t&&typeof t=="object"?t:void 0})},D=function(e){var t=history[e];history[e]=function(){var r=t.apply(this,arguments);return h(),r}};I||(D("pushState"),D("replaceState"),a.addEventListener("popstate",h),U&&a.addEventListener("hashchange",h)),n.addEventListener("visibilitychange",function(){n.visibilityState==="hidden"?E():c()}),a.addEventListener("pagehide",E),a.addEventListener("blur",B),a.addEventListener("focus",c),a.addEventListener("scroll",function(){F(),c()},{passive:!0}),n.addEventListener("pointerdown",c,!0),n.addEventListener("keydown",c,!0);var Y=/\.(pdf|zip|gz|tgz|dmg|pkg|exe|msi|apk|docx?|xlsx?|pptx?|csv|txt|rtf|epub|mp3|wav|mp4|mov|avi|mkv|psd|ai|svg|key|numbers|pages)$/i;n.addEventListener("click",function(e){var t=e.target;if(!(!t||!t.closest)){for(var r=t.closest("a[href]"),i=0;i<T.length;i++)try{var s=T[i],S=s[1];(s[0]==="s"?t.closest(S):r&&$(S).test(S.charAt(0)==="/"?r.pathname:r.href))&&l(s[2])}catch(q){}var g=t.closest("[data-runlight]");if(g){for(var V={},x=0;x<g.attributes.length;x++){var _=g.attributes[x];_.name.indexOf("data-runlight-")===0&&(V[_.name.slice(14)]=_.value)}l(g.getAttribute("data-runlight"),V)}if(!(!r||g)){var j=r.href;/^https?:/.test(j)&&(o("downloads")!=="false"&&Y.test(r.pathname)?l("File download",{url:j}):o("outbound")!=="false"&&r.host!==location.host&&l("Outbound link",{url:j}))}}},!0),a.runlight=l,l.pageview=h,I||h();for(var L=0;L<H.length;L++)l.apply(null,H[L])}})();

data/lib/runlight/accounts/accounts.rb

@@ -138,7 +138,8 @@ module Runlight
       # Checks a six-digit code, or a recovery code, for an account with two-factor on.
       # A code works once: one already used, or older, is refused, and a recovery code is crossed off.
       # One check at a time, so two sign-ins at once cannot both use the same code: TypeScript queues them per
-      # account in its process, and here the database's lock is taken, which holds across processes too.
+      # account in its process, and here the database's lock is taken, which holds across processes too. The
+      # update that uses a code is also conditional, so the database has the last word either way.
       def check_second_factor(id, code, now)
         init
         turn { check_second_factor_now(id, code, now) }
@@ -493,16 +494,17 @@ module Runlight
           step = !secret.nil? && secret != "" ? Crypto.match_step(secret, digits, now, after) : nil
           return false if step.nil?
 
-          @store.db.run("UPDATE rl_users SET totp_step = ? WHERE id = ?", [step, id])
-          return true
+          # Only if no check since has used this step or a later one, whatever took the turn before this one.
+          return @store.db.affected("UPDATE rl_users SET totp_step = ? WHERE id = ? AND (totp_step IS NULL OR totp_step < ?)", [step, id, step]) == 1
         end
-        hashes = Js.truthy?(row["totp_recovery"]) ? Json.decode(row["totp_recovery"].to_s) : []
+        read = Js.truthy?(row["totp_recovery"]) ? row["totp_recovery"].to_s : nil
+        hashes = read.nil? ? [] : Json.decode(read)
         at = hashes.index(Crypto.recovery_hash(given))
         return false if at.nil?
 
         hashes.delete_at(at)
-        @store.db.run("UPDATE rl_users SET totp_recovery = ? WHERE id = ?", [Json.encode(hashes), id])
-        true
+        # Only if the codes are still the ones read, so a code crossed off at the same moment elsewhere is not used twice.
+        @store.db.affected("UPDATE rl_users SET totp_recovery = ? WHERE id = ? AND totp_recovery = ?", [Json.encode(hashes), id, read]) == 1
       end
 
       def ticket(kind, user, expires)

data/lib/runlight/assistant.rb

@@ -85,34 +85,52 @@ module Runlight
       message.is_a?(String) ? message : ""
     end
 
-    # Refuses a service at a link-local or cloud metadata address. One on this computer (Ollama, LM Studio) or a
-    # private network is allowed, as the person setting it up means it to be.
-    def refuse_metadata(url)
-      host = Http::Url.new(url).hostname
-      return unless Safefetch.metadata_host?(host)
+    # A service at a link-local or cloud metadata address, refused there or at a redirect. One on this computer
+    # (Ollama, LM Studio) or a private network is allowed, as the person setting it up means it to be.
+    def refused(error)
+      AssistantError.new(error.message, "address_refused", { "host" => error.host })
+    end
+
+    # A service that sent the request to another origin, which would have carried the key, and the question with it.
+    def redirected(error)
+      AssistantError.new(error.message, "redirect_refused", { "host" => error.host, "to" => error.to })
+    end
+
+    # The most of a model's answer, or its list of models, read; past it the answer counts as unreadable. One byte
+    # more is asked of the fetcher, which hands back what it read, so that an answer past the limit is seen as such.
+    MAX_ANSWER_BYTES = 4 * 1024 * 1024
 
-      raise AssistantError.new("#{host} is a link-local or cloud metadata address, which Runlight never connects to", "address_refused", { "host" => host })
+    # The answer's JSON, or nil when it is not JSON or runs past MAX_ANSWER_BYTES.
+    def read_answer(answer)
+      parsed, data = Js.parse_json(Body.read_text_capped(answer, MAX_ANSWER_BYTES))
+      parsed ? data : nil
+    rescue Http::BodyTooLong
+      nil
     end
 
     def post(fetcher, url, headers, body, deadline, now, cancelled)
       in_time(deadline, now, cancelled)
-      refuse_metadata(url)
       left = deadline - now.call
       begin
-        answer = fetcher.fetch(url, {
+        answer = Safefetch.service_fetch(url, {
           "method" => "POST",
           "headers" => { "content-type" => "application/json" }.merge(headers),
           "body" => Json.encode(body),
           "timeoutMs" => [90_000, left].min,
-        })
+          "maxBytes" => MAX_ANSWER_BYTES + 1,
+          "truncate" => true,
+        }, fetcher)
+      rescue MetadataAddressError => e
+        raise refused(e)
+      rescue RedirectRefusedError => e
+        raise redirected(e)
       rescue StandardError => e
         host = Http::Url.new(url).host
         raise AssistantError.new("Could not reach #{host}: it took too long to answer", "assistant_timeout", { "host" => host }) if e.is_a?(Http::FetchError) && e.timed_out?
 
         raise AssistantError.new("Could not reach #{host}: the connection failed", "unreachable", { "host" => host })
       end
-      parsed, data = Js.parse_json(answer.text)
-      data = nil unless parsed
+      data = read_answer(answer)
       unless answer.ok?
         message = service_message(data)
         host = Http::Url.new(url).host
@@ -303,15 +321,18 @@ module Runlight
                 elsif key != "" then { "authorization" => "Bearer #{key}" }
                 else {}
                 end
-      refuse_metadata(base)
       begin
-        answer = fetcher.fetch("#{base}/models#{provider["protocol"] == "anthropic" ? "?limit=100" : ""}", { "headers" => headers, "timeoutMs" => 20_000 })
+        answer = Safefetch.service_fetch("#{base}/models#{provider["protocol"] == "anthropic" ? "?limit=100" : ""}", { "headers" => headers, "timeoutMs" => 20_000, "maxBytes" => MAX_ANSWER_BYTES + 1, "truncate" => true },
+                                         fetcher)
+      rescue MetadataAddressError => e
+        raise refused(e)
+      rescue RedirectRefusedError => e
+        raise redirected(e)
       rescue StandardError
         host = Http::Url.new(base).host
         raise AssistantError.new("Could not reach #{host}", "unreachable", { "host" => host })
       end
-      parsed, data = Js.parse_json(answer.text)
-      data = nil unless parsed
+      data = read_answer(answer)
       unless answer.ok?
         message = service_message(data)
         host = Http::Url.new(base).host
@@ -389,6 +410,6 @@ module Runlight
     end
 
     private_class_method :provider, :system_prompt, :in_time, :service_message, :post, :tool_text, :clock, :first_message, :unreadable, :blank?,
-                         :locale_compare, :collation_key
+                         :locale_compare, :collation_key, :refused
   end
 end

data/lib/runlight/core.rb

@@ -24,8 +24,16 @@ module Runlight
   #   in front of. Left unset, it warns once when a request comes straight from a public address with none of
   #   those headers.
   # - linkPath: where short links on the app's own domain live, as `{linkPath}/{slug}`. Default "/go".
-  # - mail: the mail service for email reports, in code (a Transports config plus `from` and `fromName`).
-  #   When set, the dashboard shows it and cannot change it. Otherwise it is set up in Settings.
+  # - mail: how email reports, invites, and sign-in links are sent. Either a mail service in code (a Transports
+  #   config plus `from` and `fromName`), which the dashboard shows and cannot change, or a mailer of the app's
+  #   own, such as a CMS's: `{ send: ->(message) { ... }, from:, from_name:, via: }`. The app's mailer is a
+  #   default: a service saved in the dashboard takes its place, and removing that service goes back to it.
+  #   `via` names it there, such as "WordPress (WP Mail SMTP)". The message has to, from, fromName (when there
+  #   is one), subject, html, text, and headers; `send` raises to say it failed. Without either, the service is
+  #   set up in Settings.
+  # - mailServices: the ids of the mail services Settings offers and saves, such as every service but "smtp" in
+  #   an app that cannot keep connections of its own open. Default every service. A service saved earlier that
+  #   is not in the list counts as none, so the app's mailer, if there is one, sends instead.
   # - secret: encrypts the keys kept in the database: the mail service's, the AI Assistant's, and the tokens
   #   for connected installs. Default the RUNLIGHT_SECRET environment variable, then RUNLIGHT_TOKEN.
   # - rateLimit: tracker requests allowed per visitor address per minute. Default 120, which a real visitor
@@ -61,7 +69,9 @@ module Runlight
     # On a database that caps statements per request (Cloudflare D1), fewer days a check, about 30 statements.
     METERED_ROLLUP_BATCH = 4
     ROLLUP_DELAY_MS = 2 * 3_600_000
-    private_constant :ROLLUP_VERSION, :ROLLUP_BATCH, :REMOTE_MAX_BYTES, :METERED_ROLLUP_BATCH, :ROLLUP_DELAY_MS
+    # The longest a tracker hit waits for the tables while another process creates or upgrades them.
+    TRACKER_WAIT_MS = 10_000
+    private_constant :ROLLUP_VERSION, :ROLLUP_BATCH, :REMOTE_MAX_BYTES, :METERED_ROLLUP_BATCH, :ROLLUP_DELAY_MS, :TRACKER_WAIT_MS
 
     BUSY = /timeout exceeded when trying to connect|connection timeout|no MySQL connection was free|SQLITE_BUSY|database is locked/i
     private_constant :BUSY
@@ -78,7 +88,12 @@ module Runlight
                 # Whether a connected install may be on this machine, at http://localhost or http://127.0.0.1.
                 :local_installs,
                 # Every outgoing request goes through it.
-                :fetcher
+                :fetcher,
+                # The app's own mailer, used while no service is saved in the dashboard: { "send", "from",
+                # "fromName" (when there is one), "via" }. Nil when there is none.
+                :app_mailer,
+                # The mail services Settings offers and saves: every one, unless `mailServices` names fewer.
+                :mail_services
 
     # Where routes() serves the dashboard and API, which a link domain leaves alone, as a list without
     # repeats. Middleware often runs apart from the routes, where none were made, so the default "/runlight"
@@ -121,7 +136,30 @@ module Runlight
       @fetcher = options["fetcher"] || Http::NetFetcher.new
       @links = Links.new(self)
       @link_path = "/#{(options["linkPath"].nil? ? "/go" : options["linkPath"]).to_s.gsub(%r{\A/+|/+\z}, "")}"
-      @mail_in_code = options["mail"]
+      mail = options["mail"]
+      if mail.is_a?(Hash) && mail["send"].respond_to?(:call)
+        unless Js.string(mail["from"].nil? ? "" : mail["from"]).match?(EMAIL)
+          raise ArgumentError, "Runlight: the app's mailer needs a from address, like reports@example.com"
+        end
+
+        @app_mailer = { "send" => mail["send"], "from" => mail["from"].to_s }
+        @app_mailer["fromName"] = mail["fromName"].to_s unless mail["fromName"].nil? || mail["fromName"].to_s == ""
+        @app_mailer["via"] = Js.string(mail["via"].nil? ? "" : mail["via"])
+        @app_mailer.freeze
+        @mail_in_code = nil
+      else
+        @app_mailer = nil
+        @mail_in_code = mail
+      end
+      offered = options["mailServices"]&.then { |ids| Array(ids).map(&:to_s) }
+      offered&.each do |id|
+        unless Mail::Transports::SERVICES.any? { |s| s["id"] == id }
+          raise ArgumentError, "Runlight: mail_services names \"#{id}\", which is not a mail service"
+        end
+      end
+      @mail_services = if offered.nil? then Mail::Transports::SERVICES
+                       else Mail::Transports::SERVICES.select { |s| offered.include?(s["id"]) }.freeze
+                       end
       @local_installs = options["localInstalls"] ? true : false
       @secret = if options.key?("secret") && !options["secret"].nil?
                   options["secret"].to_s
@@ -136,6 +174,9 @@ module Runlight
       @ready = false
       # init runs once however many threads ask at once; reentrant, as init may ask for itself.
       @init_lock = Monitor.new
+      # The thread running init for tracker hits, which wait for it a moment at most.
+      @init_thread = nil
+      @init_thread_lock = Mutex.new
       @checking = false
       # When planner statistics were last gathered.
       @optimized_at = 0
@@ -157,18 +198,27 @@ module Runlight
       @clock.call.to_i
     end
 
-    # The mail service: from code, or as saved in the dashboard. Nil when there is none.
+    # The mail Runlight sends with: a service from code, or as saved in the
+    # dashboard, or else the app's own mailer, as service "app" with its
+    # `via`. Nil when there is none.
     def mail_settings
       return @mail_in_code.merge("source" => "code") unless @mail_in_code.nil?
 
       init
       sealed = @store.setting("mail")
-      return nil if sealed.nil? || sealed == ""
+      opened = sealed.nil? || sealed == "" ? nil : Mail::Secret.unseal(sealed, @secret)
+      saved = opened.nil? || opened == "" ? nil : Json.decode(opened)
+      # A service no longer offered counts as none, so it is never sent through.
+      if saved && (@mail_services.equal?(Mail::Transports::SERVICES) || @mail_services.any? { |s| s["id"] == saved["service"] })
+        return saved.merge("source" => "dashboard")
+      end
 
-      opened = Mail::Secret.unseal(sealed, @secret)
-      return nil if opened.nil? || opened == ""
+      app = @app_mailer
+      return nil if app.nil?
 
-      Json.decode(opened).merge("source" => "dashboard")
+      settings = { "service" => "app", "from" => app["from"] }
+      settings["fromName"] = app["fromName"] if app.key?("fromName")
+      settings.merge("via" => app["via"], "source" => "app")
     end
 
     # Saves the mail service from the dashboard. A secret field left blank
@@ -180,9 +230,13 @@ module Runlight
         @store.set_setting("mail", nil)
         return
       end
-      before = mail_settings || {}
+      current = mail_settings
+      before = current && current["source"] == "dashboard" ? current : {}
       service = Mail::Transports::SERVICES.find { |s| s["id"] == input["service"] }
       raise Mail::MailError.new("Pick a mail service", "mail_service", {}) if service.nil?
+      unless @mail_services.include?(service)
+        raise Mail::MailError.new("#{service["name"]} is not offered here. Pick another mail service", "mail_service", { "service" => service["id"] })
+      end
 
       settings = { "service" => service["id"] }
       service["fields"].each do |f|
@@ -222,14 +276,26 @@ module Runlight
       @store.set_setting("mail", Mail::Secret.seal(Json.encode(config), @secret))
     end
 
-    # Sends one email through the mail service: { "to", "subject", "html", "text", "headers" (optional) }.
+    # Sends one email through the mail service, or the app's own mailer when no service is saved: { "to",
+    # "subject", "html", "text", "headers" (optional) }.
     def send_mail(message)
       settings = mail_settings
       raise Mail::MailError.new("Set up a mail service first", "mail_unset", {}) if settings.nil?
 
       full = message.merge("from" => settings["from"])
       full["fromName"] = settings["fromName"] unless settings["fromName"].nil?
-      Mail::Transports.deliver(settings, full, @fetcher, now)
+      return Mail::Transports.deliver(settings, full, @fetcher, now) unless settings["source"] == "app"
+
+      begin
+        @app_mailer["send"].call(full.merge("headers" => message["headers"] || {}))
+      rescue Mail::MailError
+        raise
+      rescue StandardError => e
+        detail = e.message
+        via = settings["via"]
+        raise Mail::MailError.new("#{via} could not send it#{": #{detail}" unless detail == ""}", "mail_app_failed",
+                                  { "via" => via, "detail" => detail })
+      end
     end
 
     # Sends every report that is due: last week's on Monday from 8am, last
@@ -286,6 +352,21 @@ module Runlight
       @init_lock.synchronize { init_now unless @ready }
     end
 
+    # Whether init finished within `ms`; false while it is still waiting, such as on another process creating
+    # the tables, and it goes on in a thread of its own for later requests. Its errors are raised.
+    private def ready_within(ms)
+      return true if @ready
+
+      runner = @init_thread_lock.synchronize do
+        # One that failed is started again, as init is by the next request after a failure.
+        @init_thread = nil unless @init_thread&.alive? || @init_thread&.status == false
+        @init_thread ||= Thread.new { init }.tap { |t| t.report_on_exception = false }
+      end
+      return false if runner.join(ms / 1000.0).nil?
+
+      true
+    end
+
     # Whether init has run, so middleware can leave the app's own requests alone until it has.
     def ready?
       @ready
@@ -451,9 +532,11 @@ module Runlight
       nil
     end
 
-    # Changes a site's name or timezone from the dashboard. Stored apart from
+    # Changes a site's name, timezone, or retention from the dashboard. Stored apart from
     # the settings in code, which keep being written on every start. A managed
     # site has no settings in code, so its changes, hostnames too, go to its row.
+    # Every field is checked before anything changes, since a new timezone clears the
+    # built days and a shorter retention deletes visits, and pruning starts only once saved.
     # A key left out of `patch` is left alone, as TS's undefined is.
     def update_site(id, patch)
       patch = Options.normalize(patch)
@@ -468,6 +551,7 @@ module Runlight
 
         nxt["name"] = name
       end
+      timezone = nil
       if given?(patch, "timezone")
         timezone = Js.string(patch["timezone"])
         unless Dates.timezone?(timezone)
@@ -475,16 +559,20 @@ module Runlight
         end
 
         nxt["timezone"] = timezone
-        zone_changed(id, timezone) if timezone != site(id)&.[]("timezone")
       end
+      if @managed_sites && given?(patch, "hostnames") && !@remotes.key?(id)
+        nxt["hostnames"] = hostnames_for(patch["hostnames"], id)
+      end
+      check_retention(id, patch["retentionMonths"]) if given?(patch, "retentionMonths")
+      zone_changed(id, timezone) if !timezone.nil? && timezone != site(id)&.[]("timezone")
       if @managed_sites
-        nxt["hostnames"] = hostnames_for(patch["hostnames"], id) if given?(patch, "hostnames") && !@remotes.key?(id)
         @store.upsert_site(nxt, now)
         @configured = @configured.map { |site| site["id"] == id ? nxt : site }
-        return site(id)
+      else
+        @store.set_site_overrides(id, nxt)
+        @overrides[id] = nxt
       end
-      @store.set_site_overrides(id, nxt)
-      @overrides[id] = nxt
+      set_retention(id, patch["retentionMonths"]) if given?(patch, "retentionMonths")
       site(id)
     end
 
@@ -497,13 +585,7 @@ module Runlight
     # Sets how many months of visits a site keeps. Deleting a long history takes a while, so it runs in
     # pieces in idle(), after the answer, with tracking going on between them, as TS runs it after answering.
     def set_retention(site, months)
-      raise SettingsError.new("Unknown site", "unknown_site") if site(site).nil? || @remotes.key?(site)
-
-      unless months.nil? || (months.is_a?(Numeric) && RETENTION_MONTHS.include?(months))
-        list = RETENTION_MONTHS.join(", ")
-        raise SettingsError.new("Keep visits for #{list} months, or forever", "retention_bad", { "months" => list })
-      end
-
+      check_retention(site, months)
       @store.set_setting("retention:#{site}", months.nil? ? nil : Json.number(months))
       @pruning << site
       nil
@@ -731,6 +813,10 @@ module Runlight
       return if !Ua.ai_agent(ua).nil? || Ua.bot?(ua)
       return if !@limit.nil? && !@limit.allow(client_ip(request, context))
 
+      # While another process creates or upgrades the tables (an index on a big table takes a while), a hit
+      # waits a moment at most and is then dropped, rather than holding its request until that is done.
+      return unless ready_within(TRACKER_WAIT_MS)
+
       # A database too busy to take the hit right now (every pooled connection held by long reports, or
       # another process writing the SQLite file) gets it a little later, at the time it arrived.
       at = now
@@ -758,7 +844,8 @@ module Runlight
     def link_handler
       lambda do |request, context = {}|
         path = Http::Url.new(request.url).pathname
-        slug = path.start_with?("#{@link_path}/") ? decode(path[(@link_path.length + 1)..]) : ""
+        # A slug with broken escapes is one no link has.
+        slug = path.start_with?("#{@link_path}/") ? Js.decode_uri_component(path[(@link_path.length + 1)..]) || "" : ""
         found = slug != "" && !slug.include?("/") ? redirect(request, slug, "", context) : nil
         found || not_found
       end
@@ -785,7 +872,7 @@ module Runlight
       (@route_bases.empty? ? ["/runlight"] : @route_bases).each do |base|
         return nil if base != "/" && (url.pathname == base || url.pathname.start_with?("#{base}/"))
       end
-      slug = decode(url.pathname[1..].to_s)
+      slug = Js.decode_uri_component(url.pathname[1..].to_s) || ""
       found = slug != "" && !slug.include?("/") ? redirect(request, slug, host, context) : nil
       found || not_found
     end
@@ -954,11 +1041,6 @@ module Runlight
       Http::Response.new("Not found", status: 404, headers: { "content-type" => "text/plain; charset=utf-8" })
     end
 
-    # decodeURIComponent, raising where it throws a URIError.
-    def decode(text)
-      Js.decode_uri_component(text) || raise(ArgumentError, "URI malformed")
-    end
-
     # True for a database that could not take a statement just now and may a moment later.
     def busy?(error)
       error.message.match?(BUSY)
@@ -976,6 +1058,15 @@ module Runlight
     end
 
     # Checks a list of hostnames for a managed site: at least one, each a domain, none taken.
+    def check_retention(site, months)
+      raise SettingsError.new("Unknown site", "unknown_site") if site(site).nil? || @remotes.key?(site)
+
+      unless months.nil? || (months.is_a?(Numeric) && RETENTION_MONTHS.include?(months))
+        list = RETENTION_MONTHS.join(", ")
+        raise SettingsError.new("Keep visits for #{list} months, or forever", "retention_bad", { "months" => list })
+      end
+    end
+
     def hostnames_for(input, except = nil)
       items = input.is_a?(Array) ? input : Js.string(input.nil? ? "" : input).split(/[#{Js::SPACE},]+/)
       hostnames = []
@@ -1281,7 +1372,7 @@ module Runlight
         "mobile" => request.headers.get("sec-ch-ua-mobile"),
         "platform" => request.headers.get("sec-ch-ua-platform"),
       }, client["screenWidth"])
-      location = Geo.locate(request.headers, ip, @geo)
+      location = Geo.locate(request.headers, ip, @geo, Js.truthy?(@trust_proxy))
       row = {
         "id" => session["id"],
         "site" => site["id"],

data/lib/runlight/dates.rb

@@ -19,8 +19,10 @@ module Runlight
     COMPARE_MODES = %w[previous year custom off].freeze
 
     MAX_BUCKETS = 1000
-    # A month of hours. Longer hourly ranges are cut off rather than refused.
+    # A month of hours. A longer range is counted by the day instead.
     MAX_HOURS = 744
+    # The next coarser interval, for a range too long for its own.
+    COARSER = { "hour" => "day", "day" => "week", "week" => "month" }.freeze
 
     # Names Intl reads as another zone where TZInfo has no name, or reads it differently.
     ALIASES = {
@@ -47,7 +49,7 @@ module Runlight
     }.freeze
 
     OFFSET = /\A([+\-]|−)([01][0-9]|2[0-3])(?::?([0-5][0-9]))?\z/
-    private_constant :MAX_BUCKETS, :MAX_HOURS, :ALIASES, :OFFSET
+    private_constant :MAX_BUCKETS, :MAX_HOURS, :COARSER, :ALIASES, :OFFSET
 
     # A zone: a TZInfo::Timezone, or the seconds of a fixed offset; false where Intl throws a RangeError.
     @zones = {}
@@ -284,8 +286,26 @@ module Runlight
       end
 
       interval = INTERVALS.include?(input["interval"]) ? input["interval"] : default_interval(from_date, to_date)
-      { "from" => start_of(from_date, timezone), "to" => start_of(add_days(to_date, 1), timezone), "fromDate" => from_date,
-        "toDate" => to_date, "interval" => interval }
+      from_ms = start_of(from_date, timezone)
+      to_ms = start_of(add_days(to_date, 1), timezone)
+      # An interval too fine for the range moves up to the next one that fits, and the range says which it is.
+      # Past 1,000 months there is none.
+      while bucket_count(from_ms, to_ms, from_date, to_date, interval) > (interval == "hour" ? MAX_HOURS : MAX_BUCKETS)
+        interval = COARSER[interval]
+        return nil if interval.nil?
+      end
+      { "from" => from_ms, "to" => to_ms, "fromDate" => from_date, "toDate" => to_date, "interval" => interval }
+    end
+
+    # How many chart buckets a range has at an interval, the first and last counted even when partial.
+    def bucket_count(from_ms, to_ms, from_date, to_date, interval)
+      return (to_ms - from_ms).fdiv(3_600_000).ceil if interval == "hour"
+      return days_between(from_date, to_date) + 1 if interval == "day"
+      return tdiv(days_between(add_days(from_date, -weekday(from_date)), to_date), 7) + 1 if interval == "week"
+
+      fy, fm = split(from_date)
+      ty, tm = split(to_date)
+      ((ty - fy) * 12) + (tm - fm) + 1
     end
 
     def add_years(date, years)
@@ -323,12 +343,15 @@ module Runlight
         "toDate" => to_date, "interval" => range["interval"] }
     end
 
-    # Chart buckets covering a range, each starting on a local boundary.
+    # Chart buckets covering a range, each starting on a local boundary and ending at the next, so only the
+    # first and last can be partial. resolve_range picks an interval that fits; a range given here with more
+    # buckets than that, such as a longer comparison, is cut off at a boundary, never merged into its last bucket.
     def buckets(range, timezone)
       starts = []
+      # One start past the limit, so the last bucket kept still ends where the next would begin.
       if range["interval"] == "hour"
         t = range["from"]
-        while t < range["to"] && starts.length < MAX_HOURS
+        while t < range["to"] && starts.length <= MAX_HOURS
           starts << t
           t += 3_600_000
         end
@@ -339,7 +362,7 @@ module Runlight
         elsif range["interval"] == "month"
           date = "#{date[0, 8]}01"
         end
-        while date <= range["toDate"] && starts.length < MAX_BUCKETS
+        while date <= range["toDate"] && starts.length <= MAX_BUCKETS
           starts << start_of(date, timezone)
           date = case range["interval"]
                  when "day" then add_days(date, 1)
@@ -348,7 +371,7 @@ module Runlight
                  end
         end
       end
-      starts.each_with_index.map do |start, i|
+      starts.first(range["interval"] == "hour" ? MAX_HOURS : MAX_BUCKETS).each_with_index.map do |start, i|
         { "start" => [start, range["from"]].max, "end" => [starts[i + 1] || range["to"], range["to"]].min }
       end
     end

data/lib/runlight/db/connect.rb

@@ -31,9 +31,15 @@ module Runlight
       def sqlite(path)
         path = path.to_s
         memory = path == ":memory:" || path.empty?
-        # A file in a folder that is not there yet gets the folder, as a fresh app's data/ often is.
-        FileUtils.mkdir_p(File.dirname(path)) if !memory && !path.start_with?("file:") && !File.directory?(File.dirname(path))
-        config = { adapter: "sqlite3", database: memory ? ":memory:" : path, timeout: 5000,
+        file = !memory && !path.start_with?("file:")
+        # A file in a folder that is not there yet gets the folder, as a fresh app's data/ often is, for its
+        # owner and group alone, as the file is.
+        if file && !File.directory?(File.dirname(path))
+          FileUtils.mkdir_p(File.dirname(path), mode: 0o770)
+          owner_and_group(File.dirname(path), 0o770)
+        end
+        made(path) if file && !File.exist?(path)
+        config = { adapter: "sqlite3", database: memory ? ":memory:" : path, timeout: Database::BUSY_TIMEOUT_MS,
                    # One connection for a database in memory, which every connection would otherwise make anew.
                    pool: memory ? 1 : 5 }
         Database.new(Pools.make(config), owned: true, dialect: "sqlite")
@@ -57,7 +63,7 @@ module Runlight
         Database.new(Pools.make(config.compact), owned: true, dialect: "postgres")
       end
 
-      # MySQL 8.4 or MariaDB 11.4 and later from a URL like mysql://user:pass@host:3306/db (or mariadb://),
+      # MySQL 8.0.20 or MariaDB 11.4 and later from a URL like mysql://user:pass@host:3306/db (or mariadb://),
       # through the trilogy gem when it is installed, else mysql2. The session is utf8mb4 with the server's own
       # SQL mode plus IGNORE_SPACE, as mysql2 opens it for the TypeScript driver (its connect flags ask for
       # that, which neither Ruby driver can, so it is set as the session's mode), less NO_BACKSLASH_ESCAPES, as
@@ -93,6 +99,23 @@ module Runlight
         end
       end
 
+      # A database file made here is for its owner and group alone (0660), whatever the umask: the visits in it
+      # are nobody else's to read, and a scheduled job running as another user of the same group can still
+      # write to it. It is made empty, which SQLite takes as a new database, before anything opens it, so the
+      # -wal and -shm files SQLite makes beside it later take the same mode.
+      def made(path)
+        File.open(path, File::WRONLY | File::CREAT | File::EXCL, 0o660) { nil }
+        owner_and_group(path, 0o660)
+      rescue SystemCallError
+        # Made by another process meanwhile, or a folder this one may not write to, which opening reports.
+      end
+
+      def owner_and_group(path, mode)
+        File.chmod(mode, path)
+      rescue SystemCallError, NotImplementedError
+        # Not a file this process may change, or a system with no such modes.
+      end
+
       def quote_name(name, quote)
         "#{quote}#{name.to_s.gsub(quote, quote * 2)}#{quote}"
       end