runlight 0.1.1 → 0.1.3

data/lib/runlight/db/db.rb

@@ -22,6 +22,23 @@ module Runlight
       # Arbitrary but fixed, so every Runlight process takes the same lock to create tables.
       MIGRATION_LOCK = 7_331_906
 
+      # The longest a process waits for another one creating or upgrading the tables before it gives up.
+      LOCK_WAIT_MS = 30_000
+
+      @lock_wait = LOCK_WAIT_MS
+
+      class << self
+        # How long the lock for creating tables is waited for: LOCK_WAIT_MS, unless a test has set another.
+        def lock_wait_ms
+          @lock_wait
+        end
+
+        # For tests: the lock is waited for this long instead, or LOCK_WAIT_MS again with nil.
+        def lock_wait_in_tests(ms)
+          @lock_wait = ms || LOCK_WAIT_MS
+        end
+      end
+
       # One lock per MySQL database, so installs sharing a server do not wait on each other. Lock names are 64
       # characters at most.
       MYSQL_LOCK = "CONCAT('runlight:', LEFT(SHA2(COALESCE(DATABASE(), ''), 256), 48))"
@@ -34,6 +51,9 @@ module Runlight
       # they do not linger in the file's free space. Rails' pragmas setting takes this one only as on or off.
       SECURE_DELETE = "PRAGMA secure_delete = FAST"
 
+      # How long a SQLite connection waits for a lock another one holds, as Connect.sqlite sets it.
+      BUSY_TIMEOUT_MS = 5000
+
       attr_reader :connection_class
 
       # connection_class: an ActiveRecord::Base subclass whose pool to use (ActiveRecord::Base for the app's
@@ -106,7 +126,8 @@ module Runlight
       end
 
       # Runs the block while holding a database-wide lock, so two processes starting at once do not race to
-      # create the same tables. Yields this database.
+      # create the same tables. Waits for the lock at most LOCK_WAIT_MS, then raises a TablesBusyError. Yields
+      # this database.
       def exclusive(&block)
         connection do |c|
           @held += 1
@@ -249,9 +270,20 @@ module Runlight
 
         c.execute(dialect == "sqlite" ? SECURE_DELETE : NO_BACKSLASH_ESCAPES_OFF, "Runlight")
         raw = c.instance_variable_get(:@raw_connection)
+        wait_without_the_lock(raw) if dialect == "sqlite"
         @set_up[raw] = true if raw
       end
 
+      # Rails 7.2 sets SQLite's busy timeout with busy_timeout, which sleeps in C holding Ruby's global lock. A
+      # thread waiting for the file's write lock then stops the thread of the same process that holds it from
+      # ever finishing, so the wait runs out and raises "database is locked". busy_handler_timeout= (sqlite3
+      # 2.x, and what Rails 8 uses) waits the same time but lets other threads run.
+      def wait_without_the_lock(raw)
+        return unless raw.respond_to?(:busy_handler_timeout=)
+
+        raw.busy_handler_timeout = BUSY_TIMEOUT_MS
+      end
+
       # A statement on a connection. A connection the server dropped (a restart, a failover, an idle timeout)
       # is replaced, as a pool replaces it, and the statement sent again: it never reached the server. Not
       # inside a transaction or a lock, whose work went with the connection.
@@ -298,7 +330,14 @@ module Runlight
         if dialect == "postgres"
           # Asked for again and again rather than waited on: a waiting statement would hold up an index being
           # built CONCURRENTLY by whoever has the lock, and the two would wait on each other for good.
-          sleep 0.1 until truthy(value(c, "SELECT pg_try_advisory_lock(#{MIGRATION_LOCK}) AS ok"))
+          # Up to LOCK_WAIT_MS, so a request does not wait on a long index build for good.
+          wait = self.class.lock_wait_ms
+          until_at = monotonic_ms + wait
+          until truthy(value(c, "SELECT pg_try_advisory_lock(#{MIGRATION_LOCK}) AS ok"))
+            raise TablesBusyError, wait if monotonic_ms >= until_at
+
+            sleep 0.1
+          end
           begin
             return yield(self)
           ensure
@@ -309,11 +348,16 @@ module Runlight
             end
           end
         end
+        # Up to LOCK_WAIT_MS, so a request does not wait on a long index build for good.
+        wait = self.class.lock_wait_ms
+        until_at = monotonic_ms + wait
         loop do
-          ok = value(c, "SELECT GET_LOCK(#{MYSQL_LOCK}, 5) AS ok")
+          left = ((until_at - monotonic_ms) / 1000.0).ceil.clamp(1, 5)
+          ok = value(c, "SELECT GET_LOCK(#{MYSQL_LOCK}, #{left}) AS ok")
           raise "Runlight: MySQL refused the lock for creating tables" if ok.nil?
           break if ok.to_i == 1
-          # Not got within 5 seconds: another process is creating the tables. Ask again.
+          # Not got in time: another process is creating the tables. Ask again, until the wait is up.
+          raise TablesBusyError, wait if monotonic_ms >= until_at
         end
         begin
           # An index on a big table takes a while to build, so the build may run past the statement timeout.
@@ -330,6 +374,10 @@ module Runlight
         end
       end
 
+      def monotonic_ms
+        Process.clock_gettime(Process::CLOCK_MONOTONIC, :millisecond)
+      end
+
       # The first column of a statement's first row, always asked of the database. select_value goes through
       # Rails' query cache, which a Rails request turns on for every pool, so a poll for a lock would see its
       # first answer again and again; exec_query is never cached.

data/lib/runlight/db/prefixed.rb

@@ -0,0 +1,92 @@
+# frozen_string_literal: true
+
+module Runlight
+  module Db
+    # A database whose tables and indexes start with a prefix of the app's choosing in place of `rl_`, such as
+    # `wp_rl_` beside a WordPress database's tables, so two apps sharing one database each keep a set of their
+    # own. Runlight's SQL names every table and index `rl_` and something, and those names alone are rewritten
+    # on the way through, in each statement and in the names a schema check compares as text. A store given a
+    # prefix puts one in front of its database, so the accounts and importers that reach the database through
+    # the store follow it too. Values bound to `?` are never rewritten.
+    class Prefixed
+      # Whatever else the database underneath has (close, limit_statements, connection_class) is passed on.
+      OPTIONAL = %i[affected turn metered?].freeze
+      private_constant :OPTIONAL
+
+      attr_reader :inner, :prefix
+
+      def initialize(inner, prefix)
+        # A name in a statement, and short enough that the longest index name stays inside MySQL's 64.
+        unless prefix.is_a?(String) && prefix.match?(/\A[A-Za-z_][A-Za-z0-9_]{0,31}\z/)
+          raise ArgumentError, "Runlight: a table prefix is up to 32 letters, digits, and underscores, and does not start with a digit"
+        end
+
+        @inner = inner
+        @prefix = prefix
+      end
+
+      # A statement with each of Runlight's names under the prefix.
+      def sql(text)
+        text.gsub(/\brl_(?=[a-z])/, @prefix)
+      end
+
+      def dialect
+        @inner.dialect
+      end
+
+      def all(text, params = [])
+        @inner.all(sql(text), params)
+      end
+
+      def run(text, params = [])
+        @inner.run(sql(text), params)
+      end
+
+      def affected(text, params = [])
+        @inner.affected(sql(text), params)
+      end
+
+      def metered?
+        @inner.metered?
+      end
+
+      def transaction
+        @inner.transaction { |db| yield wrap(db) }
+      end
+
+      def exclusive
+        @inner.exclusive { |db| yield wrap(db) }
+      end
+
+      def turn
+        @inner.turn { |db| yield wrap(db) }
+      end
+
+      def close
+        @inner.close
+      end
+
+      def respond_to?(name, include_all = false)
+        return @inner.respond_to?(name, include_all) if OPTIONAL.include?(name.to_sym)
+
+        super
+      end
+
+      private
+
+      def wrap(db)
+        db.equal?(@inner) ? self : Prefixed.new(db, @prefix)
+      end
+
+      def method_missing(name, ...)
+        return super unless @inner.respond_to?(name)
+
+        @inner.public_send(name, ...)
+      end
+
+      def respond_to_missing?(name, include_all = false)
+        @inner.respond_to?(name, include_all) || super
+      end
+    end
+  end
+end

data/lib/runlight/geo.rb

@@ -102,9 +102,10 @@ module Runlight
     end
 
     # The location of a request: the platform's headers when they name a country, else the lookup's answer
-    # for the address, else nowhere.
-    def locate(headers, ip, lookup = nil)
-      from_headers = location_from_headers(headers)
+    # for the address, else nowhere. The headers are believed only with trust_headers, as the address is: without
+    # a proxy in front, a client writes them itself.
+    def locate(headers, ip, lookup = nil, trust_headers = true)
+      from_headers = trust_headers ? location_from_headers(headers) : nil
       return from_headers if !from_headers.nil? && from_headers["country"] != ""
 
       if !lookup.nil? && ip != ""

data/lib/runlight/http/fetcher.rb

@@ -58,6 +58,20 @@ module Runlight
 
       private
 
+      # Opens the connection. A name pinned to several addresses is tried address by address, as a connection
+      # by name is, so a host that listens on one of them is reached; only the failure of the last is raised.
+      def connect(http, addresses)
+        tries = addresses.empty? ? [nil] : addresses
+        tries.each_with_index do |address, at|
+          http.ipaddr = address unless address.nil?
+          begin
+            return http.start
+          rescue SystemCallError, SocketError, Net::OpenTimeout
+            raise if at == tries.length - 1
+          end
+        end
+      end
+
       def monotonic
         Process.clock_gettime(Process::CLOCK_MONOTONIC)
       end
@@ -78,13 +92,18 @@ module Runlight
         http = pinned ? Net::HTTP.new(host, port, nil) : Net::HTTP.new(host, port)
         http.use_ssl = https
         # A pin connects to the checked address, with the name kept for the Host header and the certificate.
+        addresses = []
         Array(init["resolve"]).each do |pin|
-          m = pin.to_s.match(/\A(.+):(\d+):\[?([^\],]+)\]?/)
-          next unless m && m[1].casecmp?(host) && m[2].to_i == port
+          lead = "#{host}:#{port}:"
+          next unless pin.to_s.length > lead.length && pin.to_s[0, lead.length].casecmp?(lead)
 
-          http.ipaddr = m[3]
+          addresses = pin.to_s[lead.length..].split(",").map { |address| address.delete_prefix("[").delete_suffix("]") }.reject(&:empty?)
+          http.ipaddr = addresses.first
           break
         end
+        # A pin that names another host or port would leave the name to be looked up again: refused, never
+        # fetched unpinned.
+        raise FetchError, "fetch failed" if pinned && http.ipaddr.nil?
         http.open_timeout = [left, 15].min
         http.read_timeout = left
         http.write_timeout = left
@@ -108,8 +127,9 @@ module Runlight
           # Past maxBytes the whole request is left by a throw, which closes the connection: a break would leave
           # only read_body, and Net::HTTP would then read the rest of the body after all.
           catch(:too_long) do
-            http.start do |connection|
-              connection.request(request) do |answer|
+            connect(http, addresses)
+            begin
+              http.request(request) do |answer|
                 status = answer.code.to_i
                 answer.each_capitalized_name { |name| answer_headers[name.downcase] = answer.get_fields(name) }
                 answer.read_body do |chunk|
@@ -123,6 +143,8 @@ module Runlight
                   received << chunk
                 end
               end
+            ensure
+              http.finish if http.started?
             end
           end
         rescue Net::OpenTimeout, Net::ReadTimeout, Net::WriteTimeout, Timeout::Error

data/lib/runlight/mail/ses.rb

@@ -79,13 +79,14 @@ module Runlight
         })
         headers.delete("host")
         begin
-          response = (fetcher || Http::NetFetcher.new).fetch(url.href, { "method" => "POST", "headers" => headers, "body" => body, "timeoutMs" => 20_000 })
+          response = (fetcher || Http::NetFetcher.new).fetch(url.href, { "method" => "POST", "headers" => headers, "body" => body, "timeoutMs" => 20_000,
+                                                                            "maxBytes" => Transports::MAX_ERROR_BYTES + 1, "truncate" => true })
         rescue Http::FetchError => e
           raise MailError.new("Could not reach Amazon SES: #{e.message}", "mail_unreachable", { "host" => "Amazon SES", "detail" => e.message })
         end
         return if response.ok?
 
-        message = Transports.service_message(response.text)
+        message = Transports.service_message(Transports.error_text(response))
         raise MailError.new("Amazon SES answered #{response.status}#{message.empty? ? "" : ": #{message}"}", "mail_refused",
                             { "host" => "Amazon SES", "detail" => "#{response.status}#{message.empty? ? "" : " #{message}"}" })
       end

data/lib/runlight/mail/transports.rb

@@ -81,17 +81,34 @@ module Runlight
         ""
       end
 
+      # The most of a service's error read, so an answer without end never fills memory. One byte more is asked of
+      # the fetcher, which hands back what it read, so that an answer past the limit is seen as such and read as empty.
+      MAX_ERROR_BYTES = 65_536
+
+      # A service's error text, or none when it runs past MAX_ERROR_BYTES.
+      def error_text(response)
+        Body.read_text_capped(response, MAX_ERROR_BYTES)
+      rescue Http::BodyTooLong
+        ""
+      end
+
       # POSTs to a service, with the errors the dashboard shows. init: "headers" and "body".
       def post(fetcher, url, init, explains = true)
         begin
-          response = fetcher.fetch(url, { "method" => "POST", "headers" => init["headers"], "body" => init["body"], "timeoutMs" => 20_000 })
+          # A webhook can be at any address, so it and each redirect are checked, as for every service.
+          response = Safefetch.service_fetch(url, { "method" => "POST", "headers" => init["headers"], "body" => init["body"], "timeoutMs" => 20_000,
+                                                     "maxBytes" => MAX_ERROR_BYTES + 1, "truncate" => true }, fetcher)
+        rescue MetadataAddressError => e
+          raise MailError.new(e.message, "address_refused", { "host" => e.host })
+        rescue RedirectRefusedError => e
+          raise MailError.new(e.message, "redirect_refused", { "host" => e.host, "to" => e.to })
         rescue Http::FetchError => e
           host = Http::Url.new(url).host
           raise MailError.new("Could not reach #{host}: #{e.message}", "mail_unreachable", { "host" => host, "detail" => e.message })
         end
         return if response.ok?
 
-        message = explains ? service_message(response.text) : ""
+        message = explains ? service_message(error_text(response)) : ""
         host = Http::Url.new(url).host
         raise MailError.new("#{host} answered #{response.status}#{message.empty? ? "" : ": #{message}"}", "mail_refused",
                             { "host" => host, "detail" => "#{response.status}#{message.empty? ? "" : " #{message}"}" })

data/lib/runlight/metadata_address_error.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+module Runlight
+  # Refused before anything was fetched, because the address is link-local or a cloud's metadata service.
+  class MetadataAddressError < RuntimeError
+    attr_reader :host
+
+    def initialize(host)
+      @host = host
+      super("#{host} is a link-local or cloud metadata address, which Runlight never connects to")
+    end
+  end
+end

data/lib/runlight/oauth.rb

@@ -16,7 +16,10 @@ module Runlight
   # The token is an ordinary API token, so it appears in Settings, API and AI,
   # beside the others, and deleting it there disconnects the app. It reads
   # stats, or with the "manage" scope (asked for by a Runlight hub) it also
-  # changes one site's settings.
+  # changes one site's settings. With the "cms" scope (asked for by the
+  # WordPress, Drupal, and Craft plugins) it is the site's dashboard key, which
+  # only opens its read-only dashboard in the CMS, and the answer also carries
+  # the site's agents key, so connecting fills in the plugin's settings.
   #
   # The context the routes pass is a Hash: "runlight", "base", "isOwner" (callable(request) giving a bool), and
   # optionally "signIn" (String), "isReader" (callable(request) giving a bool), "accountOf" (callable(request)
@@ -29,6 +32,7 @@ module Runlight
     REGISTRATIONS_PER_MINUTE = 10
     # The longest client id, which carries the app's name and redirect addresses.
     MAX_CLIENT_ID = 2048
+    SCOPES = %w[read manage cms].freeze
 
     # Where the per-address count of registrations is kept. TypeScript keeps it in memory per install; here it
     # lives in the install's settings, keyed by a hash of the address, so every process shares it.
@@ -41,7 +45,7 @@ module Runlight
     }.freeze
 
     ESCAPES = { "&" => "&amp;", "<" => "&lt;", ">" => "&gt;", '"' => "&quot;", "'" => "&#39;" }.freeze
-    private_constant :REGISTRATIONS, :CORS, :ESCAPES
+    private_constant :REGISTRATIONS, :CORS, :ESCAPES, :SCOPES
 
     module_function
 
@@ -50,6 +54,16 @@ module Runlight
       base64url(OpenSSL::Digest::SHA256.digest(verifier))
     end
 
+    # The key a CMS plugin reports AI agents reading a site's pages with: made on first ask, or a new one that replaces it.
+    def agents_key(runlight, site, replace = false)
+      name = "observe-key:#{site}"
+      return runlight.store.setting_or_add(name) { "rlo_#{Hashing.random_id(20)}" } unless replace
+
+      key = "rlo_#{Hashing.random_id(20)}"
+      runlight.store.set_setting(name, key)
+      key
+    end
+
     # The URL that a 401 from the MCP endpoint points clients at, to start OAuth.
     def resource_metadata_url(origin, base)
       "#{origin}#{base}/.well-known/oauth-protected-resource"
@@ -71,7 +85,7 @@ module Runlight
       end
 
       if known.start_with?("/.well-known/oauth-protected-resource")
-        return json({ "resource" => "#{issuer}/mcp", "authorization_servers" => [issuer], "scopes_supported" => %w[read manage], "bearer_methods_supported" => ["header"] })
+        return json({ "resource" => "#{issuer}/mcp", "authorization_servers" => [issuer], "scopes_supported" => SCOPES, "bearer_methods_supported" => ["header"] })
       end
       if known.start_with?("/.well-known/oauth-authorization-server") || known.start_with?("/.well-known/openid-configuration")
         return json({
@@ -83,7 +97,7 @@ module Runlight
           "grant_types_supported" => ["authorization_code"],
           "code_challenge_methods_supported" => ["S256"],
           "token_endpoint_auth_methods_supported" => ["none"],
-          "scopes_supported" => %w[read manage],
+          "scopes_supported" => SCOPES,
         })
       end
 
@@ -141,8 +155,15 @@ module Runlight
           return refuse.call({ "error" => "invalid_request", "error_description" => "PKCE with S256 is required" })
         end
 
-        manage = (form.get("scope") || "").split(/[#{Js::SPACE}]+/o).include?("manage")
+        scopes = (form.get("scope") || "").split(/[#{Js::SPACE}]+/o)
+        cms = scopes.include?("cms")
+        manage = !cms && scopes.include?("manage")
         name = client["name"].to_s
+        # A CMS plugin is for the site it runs on: one of the sites counting its admin's domain, or a new one for it.
+        host = site_host(redirect)
+        # As the tracker counts: a site that lists the domain, or the only site here when it lists none, which counts any.
+        local = runlight.sites.select { |s| runlight.remote(s["id"]).nil? }
+        counting = local.length == 1 && local[0]["hostnames"].empty? ? local : local.select { |s| s["hostnames"].include?(host) }
 
         unless ctx["isOwner"].call(request)
           # Someone signed in who may only read would be sent to sign in again and again.
@@ -169,6 +190,27 @@ module Runlight
           end
           # The app names itself, so the page also shows where the answer goes, which it cannot fake.
           sends_to = "<p class=\"note\">Allowing sends you back to <strong>#{esc(Http::Url.new(redirect).host)}</strong>. Only allow it if you started connecting there.</p>"
+          if cms
+            if counting.empty? && !runlight.managed_sites
+              return page("Add this site first",
+                          "<p>No site in this Runlight counts <strong>#{esc(host)}</strong>. Add it to a site's domains in your code, then connect again from #{esc(name)}.</p>", 400)
+            end
+
+            choices = +""
+            counting.each { |s| choices << "<option value=\"#{esc(s["id"])}\">#{esc(s["name"])}</option>" }
+            choices << "<option value=\"new\">A new site for #{esc(host)}</option>" if runlight.managed_sites && counting.empty?
+            return page(
+              "Connect #{esc(name)}",
+              "<p><strong>#{esc(name)}</strong> wants to count <strong>#{esc(host)}</strong> in this Runlight.</p>\n" \
+              "<p>It will get the site's agents key, to report AI agents such as ChatGPT and Claude reading its pages, and a dashboard key, to show the site's " \
+              "read-only dashboard in its admin pages. It cannot change anything here or read other sites.</p>\n" \
+              "#{sends_to}\n" \
+              "<form method=\"post\" action=\"#{esc(base)}/oauth/authorize\">#{hidden}\n" \
+              "<label>Site<select name=\"site\">#{choices}</select></label>\n" \
+              "<p class=\"note\">Its dashboard key appears in Settings, API and AI, where deleting it stops the dashboard in #{esc(name)}.</p>\n" \
+              '<div class="buttons"><button type="submit" name="decision" value="deny" class="ghost">Deny</button><button type="submit" name="decision" value="allow">Allow</button></div></form>',
+            )
+          end
           sites = runlight.sites
           if manage
             # Changing settings is for one site at a time, so there is no "every site" here.
@@ -209,6 +251,22 @@ module Runlight
         return back.call({ "error" => "access_denied" }) if form.get("decision") != "allow"
 
         site = form.get("site") || ""
+        if cms
+          if site == "new"
+            begin
+              site = if !counting.empty? then counting[0]["id"]
+                     elsif runlight.managed_sites then runlight.add_site({ "hostnames" => [host] })["id"]
+                     else ""
+                     end
+            rescue RangeError => e
+              # Such as an address, which a site cannot count by: there is no new site to make.
+              return back.call({ "error" => "invalid_request", "error_description" => e.message })
+            end
+          elsif counting.none? { |s| s["id"] == site }
+            site = ""
+          end
+          return back.call({ "error" => "invalid_request", "error_description" => "Pick a site that counts #{host}" }) if site == ""
+        end
         return back.call({ "error" => "invalid_request", "error_description" => "Unknown site" }) if site != "" && runlight.site(site).nil?
         if manage && (site == "" || !runlight.remote(site).nil?)
           return back.call({ "error" => "invalid_request", "error_description" => "Pick the site to manage" })
@@ -216,7 +274,7 @@ module Runlight
 
         code = Hashing.random_id(32)
         by = ctx["accountOf"]&.call(request)
-        grant = { "client" => client_id, "redirect" => redirect, "challenge" => challenge, "site" => site, "scope" => manage ? "manage" : "read",
+        grant = { "client" => client_id, "redirect" => redirect, "challenge" => challenge, "site" => site, "scope" => cms ? "cms" : manage ? "manage" : "read",
                   "expires" => runlight.now + CODE_MS }
         grant["by"] = by if !by.nil? && by != ""
         runlight.store.set_setting("oauth-code:#{Hashing.sha256(code)}", Json.encode(grant))
@@ -248,12 +306,16 @@ module Runlight
           runlight.store.set_setting(found["usedKey"], stored_client ? Json.encode(used) : runlight.now.to_s)
         end
         secret = "rl_#{Hashing.random_id(20)}"
-        scope = grant["scope"] == "manage" ? "manage" : "read"
+        scope = if grant["scope"] == "cms" then "cms"
+                elsif grant["scope"] == "manage" then "manage"
+                else "read"
+                end
+        # A CMS plugin's token is the site's dashboard key, which only opens its read-only dashboard there.
         row = {
           "id" => Hashing.random_id,
           "name" => Js.slice("#{Js.string(client["name"].nil? ? "An app" : client["name"])} (OAuth)", 0, 100),
           "site" => grant["site"].to_s,
-          "scope" => scope,
+          "scope" => scope == "cms" ? "embed" : scope,
           "hash" => Hashing.sha256(secret),
           "hint" => secret[-4..],
           "createdAt" => runlight.now,
@@ -267,6 +329,11 @@ module Runlight
         end
         # A hub's own address, from where it asked to be sent back, so the picker only ever sends choices there.
         runlight.store.set_setting("token-origin:#{row["id"]}", Http::Url.new(grant["redirect"].to_s).origin) if scope == "manage"
+        # A CMS plugin gets the site's agents key too, so connecting fills in every key its settings ask for.
+        if scope == "cms"
+          return json({ "access_token" => secret, "token_type" => "Bearer", "scope" => scope, "site" => grant["site"],
+                        "agents_key" => agents_key(runlight, grant["site"].to_s) })
+        end
         # site is not part of OAuth, but a hub needs to know which site it was given.
         answer = { "access_token" => secret, "token_type" => "Bearer", "scope" => scope }
         answer["site"] = grant["site"] if grant["site"] != ""
@@ -286,12 +353,8 @@ module Runlight
 
     # The key client ids are signed with, made on first use and kept in the database for every process.
     def client_key(runlight)
-      saved = runlight.store.setting("oauth-key")
-      return saved if !saved.nil? && saved != ""
-
-      made = Hashing.random_id(32)
-      runlight.store.set_setting("oauth-key", made)
-      made
+      # Written only if no other request wrote one first, so every process signs with the same key.
+      runlight.store.setting_or_add("oauth-key") { Hashing.random_id(32) }
     end
 
     # The app a client id names, and where to note that it connected: {"client" => ..., "usedKey" => ...}, or nil.
@@ -314,6 +377,11 @@ module Runlight
       { "client" => client, "usedKey" => used_key }
     end
 
+    # A redirect address's host as a site's domains are kept: lowercase, with no port and no www.
+    def site_host(redirect)
+      Http::Url.new(redirect).hostname.downcase.sub(/\.+\z/, "").sub(/\Awww\./, "")
+    end
+
     def constant_time_equal(a, b)
       a.bytesize == b.bytesize && OpenSSL.fixed_length_secure_compare(a, b)
     end
@@ -405,7 +473,7 @@ module Runlight
       )
     end
 
-    private_class_method :base64url, :from_base64url, :client_key, :client_for, :constant_time_equal, :esc, :json, :oauth_error,
+    private_class_method :base64url, :from_base64url, :client_key, :client_for, :site_host, :constant_time_equal, :esc, :json, :oauth_error,
                          :allowed_redirect, :json_form, :allow_registration, :register, :page
   end
 end

data/lib/runlight/rack_app.rb

@@ -5,9 +5,10 @@ module Runlight
   # in the order the standalone server answers: a link domain added in Settings
   # first (it leaves the dashboard's own paths alone), then `{linkPath}/{slug}`
   # on the app's own domain, then the dashboard and API under the routes' base
-  # path. As middleware, every other request goes on to the app, after AI agent
-  # fetches among them are recorded (observe), which returns at once for
-  # everyone else.
+  # path. As middleware, every other request goes on to the app, a short link
+  # with no link by that name included, so the app's own 404 page answers it,
+  # after AI agent fetches among them are recorded (observe), which returns at
+  # once for everyone else. Alone, Runlight answers those with its own 404.
   #
   #   # config.ru, Runlight alone
   #   run Runlight::RackApp.new(runlight: RL, base_path: "/runlight")
@@ -86,7 +87,13 @@ module Runlight
         linked = core.link_domain_response(request, context)
         return linked unless linked.nil?
       end
-      return core.link_handler.call(request, context) if link
+      if link
+        linked = core.link_handler.call(request, context)
+        # A slug with no link is the app's to answer, so its own 404 page shows.
+        return linked unless @app && linked.status == 404
+
+        own = mine?(path) || Routes.oauth_document?(path)
+      end
       return routes.handle(request) if own
 
       nil

data/lib/runlight/redirect_refused_error.rb

@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+
+module Runlight
+  # Refused before anything was sent there, because a service's redirect led to another origin.
+  class RedirectRefusedError < RuntimeError
+    attr_reader :host, :to
+
+    def initialize(host, to)
+      @host = host
+      @to = to
+      super("#{host} redirected to #{to}. Runlight sends a service's key and request only to the address it was set up with, so set it up with that address instead")
+    end
+  end
+end