runlight 0.1.1 → 0.1.6

data/assets/pick-return.js

@@ -0,0 +1 @@
+(function(){var a=window,r=document,i=location.hash.slice(1);history.replaceState(null,"",location.pathname);var t={};i.split("&").forEach(function(e){var n=e.indexOf("=");try{n>0&&(t[e.slice(0,n)]=decodeURIComponent(e.slice(n+1)))}catch(s){}});var o=null;try{o=localStorage.getItem("runlight-pick")}catch(e){}var c=/^[a-f0-9]{32}$/.test(t.n||"")&&t.n===o&&typeof t.s=="string"&&!!a.BroadcastChannel;if(c){try{localStorage.removeItem("runlight-pick")}catch(e){}var l=new BroadcastChannel("runlight-pick");l.postMessage({runlight:"pick",nonce:t.n,selector:t.s,href:t.h||"",text:t.t||""}),l.close(),setTimeout(function(){a.close()},900)}r.getElementById(c?"done":"gone").hidden=!1})();

data/assets/picker.js

@@ -1 +1 @@
-(function(){var l=window,a=document,g=l.opener;if(g){var d="__RUNLIGHT_PICK_TARGET__";if(/^https?:\/\//.test(d)){var x=JSON.parse("__RUNLIGHT_PICK_HOSTS__");if(!(x.length&&x.indexOf(location.hostname.toLowerCase().replace(/^www\./,""))<0)){var m={en:["Click what you want to count","Use this","Pick again","Cancel","Matches {n} on this page","Sent to Runlight. You can close this tab."],fr:["Cliquez sur ce que vous voulez compter","Utiliser","Choisir \xE0 nouveau","Annuler","{n} sur cette page","Envoy\xE9 \xE0 Runlight. Vous pouvez fermer cet onglet."],es:["Haz clic en lo que quieres contar","Usar esto","Elegir otra vez","Cancelar","{n} en esta p\xE1gina","Enviado a Runlight. Puedes cerrar esta pesta\xF1a."],de:["Klicke auf das, was gez\xE4hlt werden soll","Verwenden","Neu w\xE4hlen","Abbrechen","{n} auf dieser Seite","An Runlight gesendet. Du kannst diesen Tab schlie\xDFen."],pt:["Clique no que quer contar","Usar","Escolher de novo","Cancelar","{n} nesta p\xE1gina","Enviado ao Runlight. Pode fechar esta aba."]},T=(/[?&]runlight_lang=([a-z]{2})/.exec(location.search)||[])[1],s=m[T]||m.en,b=function(t){return/^[a-zA-Z][\w-]{1,40}$/.test(t)&&!/\d{3,}|^(css|sc|jsx|svelte|astro)-|__\w{5,}/.test(t)},w=function(t){return l.CSS&&CSS.escape?CSS.escape(t):t.replace(/[^\w-]/g,"\\$&")},C=function(t){try{return a.querySelectorAll(t).length===1}catch(e){return!1}},A=function(t){for(var e=[],n=t;n&&n.nodeType===1&&n!==a.documentElement;n=n.parentElement){if(n.id&&b(n.id)){e.unshift("#"+w(n.id));break}var r=n.tagName.toLowerCase(),v=n.getAttribute("data-runlight")||n.getAttribute("data-testid");if(v)r+="["+(n.hasAttribute("data-runlight")?"data-runlight":"data-testid")+'="'+v.replace(/"/g,'\\"')+'"]';else{var q=Array.prototype.filter.call(n.classList,b).slice(0,2);q.length&&(r+="."+q.map(w).join("."))}e.unshift(r);var E=e.join(" > ");if(C(E)||e.length>=4)return E;var _=n.parentElement;if(_){var k=Array.prototype.filter.call(_.children,function(z){return z.tagName===n.tagName});if(k.length>1&&(e[0]+=":nth-of-type("+(k.indexOf(n)+1)+")"),C(e.join(" > ")))return e.join(" > ")}}return e.join(" > ")},o=a.createElement("div");o.style.cssText="position:fixed;inset:0;z-index:2147483647;pointer-events:none";var u=o.attachShadow?o.attachShadow({mode:"open"}):o;u.innerHTML="<style>.box{position:fixed;border:2px solid #2563eb;background:rgba(37,99,235,.1);border-radius:4px;pointer-events:none;transition:all .06s}.bar{position:fixed;left:50%;bottom:20px;transform:translateX(-50%);display:flex;align-items:center;gap:10px;max-width:min(720px,calc(100vw - 32px));padding:10px 12px 10px 16px;border-radius:12px;background:#111;color:#fff;font:14px/1.4 system-ui,sans-serif;box-shadow:0 8px 30px rgba(0,0,0,.3);pointer-events:auto}.msg{flex:1;min-width:0;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}code{font:12px ui-monospace,monospace;color:#93c5fd}button{height:32px;padding:0 12px;border:0;border-radius:8px;font:inherit;cursor:pointer;background:#333;color:#fff}button.go{background:#fff;color:#111}</style><div class='box' hidden></div><div class='bar'><span class='msg'></span><span class='acts'></span></div>",a.documentElement.appendChild(o);var f=u.querySelector(".box"),c=u.querySelector(".msg"),p=u.querySelector(".acts"),i=null,h=function(t,e,n){var r=a.createElement("button");r.textContent=t,e&&(r.className=e),r.addEventListener("click",n),p.appendChild(r)},y=function(t){if(!t)return f.hidden=!0;var e=t.getBoundingClientRect();f.hidden=!1,f.style.cssText+=";left:"+(e.left-2)+"px;top:"+(e.top-2)+"px;width:"+(e.width+4)+"px;height:"+(e.height+4)+"px"},S=function(){i=null,c.innerHTML="<span></span> \xB7 <code></code>",c.querySelector("span").textContent=s[0],c.querySelector("code").textContent=d.replace(/^https?:\/\//,""),p.textContent="",h(s[3],"",function(){l.close()})},L=function(t){var e=A(t),n=t.closest("a[href]"),r=0;try{r=a.querySelectorAll(e).length}catch(v){}i={selector:e,href:n?n.href:"",text:(t.textContent||"").trim().slice(0,80)},c.innerHTML="<code></code> \xB7 "+s[4].replace("{n}",r),c.querySelector("code").textContent=e,p.textContent="",h(s[2],"",S),h(s[1],"go",function(){g.postMessage({runlight:"pick",selector:i.selector,href:i.href,text:i.text},d),c.textContent=s[5],p.textContent="",setTimeout(function(){l.close()},900)})};a.addEventListener("mouseover",function(t){i||y(t.target)},!0),["click","mousedown","mouseup","pointerdown","submit"].forEach(function(t){a.addEventListener(t,function(e){e.composedPath&&e.composedPath()[0]&&o.contains&&e.composedPath().indexOf(o)>=0||(e.preventDefault(),e.stopPropagation(),t==="click"&&!i&&(y(e.target),L(e.target)))},!0)}),S()}}}})();
+(function(){var p=window,o=document,d="__RUNLIGHT_PICK_TARGET__";if(/^https?:\/\//.test(d)){var g="__RUNLIGHT_PICK_RETURN__",x="__RUNLIGHT_PICK_NONCE__",m=g.indexOf(d+"/")===0&&/^[a-f0-9]{32}$/.test(x),b=p.opener;if(!(!m&&!b)){var C=JSON.parse("__RUNLIGHT_PICK_HOSTS__");if(!(C.length&&C.indexOf(location.hostname.toLowerCase().replace(/^www\./,""))<0)){var w={en:["Click what you want to count","Use this","Pick again","Cancel","Matches {n} on this page","Sent to Runlight. You can close this tab."],fr:["Cliquez sur ce que vous voulez compter","Utiliser","Choisir \xE0 nouveau","Annuler","{n} sur cette page","Envoy\xE9 \xE0 Runlight. Vous pouvez fermer cet onglet."],es:["Haz clic en lo que quieres contar","Usar esto","Elegir otra vez","Cancelar","{n} en esta p\xE1gina","Enviado a Runlight. Puedes cerrar esta pesta\xF1a."],de:["Klicke auf das, was gez\xE4hlt werden soll","Verwenden","Neu w\xE4hlen","Abbrechen","{n} auf dieser Seite","An Runlight gesendet. Du kannst diesen Tab schlie\xDFen."],pt:["Clique no que quer contar","Usar","Escolher de novo","Cancelar","{n} nesta p\xE1gina","Enviado ao Runlight. Pode fechar esta aba."]},N=(/[?&]runlight_lang=([a-z]{2})/.exec(location.search)||[])[1],c=w[N]||w.en,_=function(t){return/^[a-zA-Z][\w-]{1,40}$/.test(t)&&!/\d{3,}|^(css|sc|jsx|svelte|astro)-|__\w{5,}/.test(t)},y=function(t){return p.CSS&&CSS.escape?CSS.escape(t):t.replace(/[^\w-]/g,"\\$&")},S=function(t){try{return o.querySelectorAll(t).length===1}catch(e){return!1}},A=function(t){for(var e=[],n=t;n&&n.nodeType===1&&n!==o.documentElement;n=n.parentElement){if(n.id&&_(n.id)){e.unshift("#"+y(n.id));break}var r=n.tagName.toLowerCase(),i=n.getAttribute("data-runlight")||n.getAttribute("data-testid");if(i)r+="["+(n.hasAttribute("data-runlight")?"data-runlight":"data-testid")+'="'+i.replace(/"/g,'\\"')+'"]';else{var q=Array.prototype.filter.call(n.classList,_).slice(0,2);q.length&&(r+="."+q.map(y).join("."))}e.unshift(r);var R=e.join(" > ");if(S(R)||e.length>=4)return R;var T=n.parentElement;if(T){var L=Array.prototype.filter.call(T.children,function(I){return I.tagName===n.tagName});if(L.length>1&&(e[0]+=":nth-of-type("+(L.indexOf(n)+1)+")"),S(e.join(" > ")))return e.join(" > ")}}return e.join(" > ")},s=o.createElement("div");s.style.cssText="position:fixed;inset:0;z-index:2147483647;pointer-events:none";var u=s.attachShadow?s.attachShadow({mode:"open"}):s;u.innerHTML="<style>.box{position:fixed;border:2px solid #2563eb;background:rgba(37,99,235,.1);border-radius:4px;pointer-events:none;transition:all .06s}.bar{position:fixed;left:50%;bottom:20px;transform:translateX(-50%);display:flex;align-items:center;gap:10px;max-width:min(720px,calc(100vw - 32px));padding:10px 12px 10px 16px;border-radius:12px;background:#111;color:#fff;font:14px/1.4 system-ui,sans-serif;box-shadow:0 8px 30px rgba(0,0,0,.3);pointer-events:auto}.msg{flex:1;min-width:0;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}code{font:12px ui-monospace,monospace;color:#93c5fd}button{height:32px;padding:0 12px;border:0;border-radius:8px;font:inherit;cursor:pointer;background:#333;color:#fff}button.go{background:#fff;color:#111}</style><div class='box' hidden></div><div class='bar'><span class='msg'></span><span class='acts'></span></div>",o.documentElement.appendChild(s);var h=u.querySelector(".box"),l=u.querySelector(".msg"),f=u.querySelector(".acts"),a=null,v=function(t,e,n){var r=o.createElement("button");r.textContent=t,e&&(r.className=e),r.addEventListener("click",n),f.appendChild(r)},E=function(t){if(!t)return h.hidden=!0;var e=t.getBoundingClientRect();h.hidden=!1,h.style.cssText+=";left:"+(e.left-2)+"px;top:"+(e.top-2)+"px;width:"+(e.width+4)+"px;height:"+(e.height+4)+"px"},k=function(){a=null,l.innerHTML="<span></span> \xB7 <code></code>",l.querySelector("span").textContent=c[0],l.querySelector("code").textContent=d.replace(/^https?:\/\//,""),f.textContent="",v(c[3],"",function(){p.close()})},U=function(t){var e=A(t),n=t.closest("a[href]"),r=0;try{r=o.querySelectorAll(e).length}catch(i){}a={selector:e,href:n?n.href:"",text:(t.textContent||"").trim().slice(0,80)},l.innerHTML="<code></code> \xB7 "+c[4].replace("{n}",r),l.querySelector("code").textContent=e,f.textContent="",v(c[2],"",k),v(c[1],"go",function(){if(l.textContent=c[5],f.textContent="",m){var i=o.createElement("a");i.rel="noreferrer",i.href=g+"#n="+x+"&s="+encodeURIComponent(a.selector)+"&h="+encodeURIComponent(a.href)+"&t="+encodeURIComponent(a.text),u.appendChild(i),i.click();return}b.postMessage({runlight:"pick",selector:a.selector,href:a.href,text:a.text},d),setTimeout(function(){p.close()},900)})};o.addEventListener("mouseover",function(t){a||E(t.target)},!0),["click","mousedown","mouseup","pointerdown","submit"].forEach(function(t){o.addEventListener(t,function(e){e.composedPath&&e.composedPath()[0]&&s.contains&&e.composedPath().indexOf(s)>=0||(e.preventDefault(),e.stopPropagation(),t==="click"&&!a&&(E(e.target),U(e.target)))},!0)}),k()}}}})();

data/assets/tracker.js

@@ -1 +1 @@
-(function(){var a=window,n=document,u=navigator,p=n.currentScript;if(p){var o=function(e){return p.getAttribute("data-"+e)},R=p.src.replace(/s\.js(\?.*)?$/,"e"),b=o("site"),U=o("hash")!==null,I=o("manual")!==null,$=function(e){return new RegExp("^"+e.replace(/[.+?^${}()|[\]\\]/g,"\\$&").replace(/\*/g,".*")+"$")},C=(o("exclude")||"").split(",").filter(Boolean).map(function(e){return $(e.trim())}),A=!1,H=a.runlight&&a.runlight.q||[],m="__RUNLIGHT_RULES__",T=typeof m=="object"&&(m[b]||m[location.hostname.replace(/^www\./,"")]||m["*"])||[];if(/[?&]runlight=pick\b/.test(location.search)&&a.opener){var M=n.createElement("script");M.src=p.src.replace(/s\.js(\?.*)?$/,"pick.js")+location.search,n.head.appendChild(M),a.runlight=function(){};return}var N=!1;try{var O=/[?&]runlight=(ignore|track)\b/.exec(location.search);O&&(O[1]==="ignore"?localStorage.setItem("runlight_ignore","1"):localStorage.removeItem("runlight_ignore")),N=localStorage.getItem("runlight_ignore")==="1"}catch(e){}if(u.webdriver||N||o("dnt")!==null&&(u.doNotTrack==="1"||a.doNotTrack==="1")){a.runlight=function(){};return}var k=function(e,t){if(!A){var r={k:e,u:w};b&&(r.s=b);for(var i in t)r[i]=t[i];var s=JSON.stringify(r);u.sendBeacon&&u.sendBeacon(R,s)||a.fetch&&fetch(R,{method:"POST",body:s,keepalive:!0}).catch(function(){})}},G=function(){var e=new Uint8Array(8);return(a.crypto||{}).getRandomValues?crypto.getRandomValues(e):e.forEach(function(t,r){e[r]=Math.random()*256}),Array.prototype.map.call(e,function(t){return(t+256).toString(36).slice(-2)}).join("").slice(0,12)},z=o("404")!==null,w="",v="",f=0,d=0,y=0,J=function(){return n.visibilityState==="visible"&&n.hasFocus()},B=function(){d&&(f+=Date.now()-d),d=0},c=function(){!d&&J()&&(d=Date.now())},E=function(){B(),v&&f>=1e3&&(k("engagement",{i:v,e:f,d:y}),f=0)},F=function(){var e=n.documentElement,t=Math.max(e.scrollHeight,n.body?n.body.scrollHeight:0),r=(a.scrollY||e.scrollTop)+a.innerHeight,i=t>0?Math.min(100,Math.round(r/t*100)):100;i>y&&(y=i)},P=function(){var e=location;return e.protocol+"//"+e.host+e.pathname+e.search+(U?e.hash:"")},h=function(e){var t=typeof e=="string"?new URL(e,location.href).href:P();if(t!==w){var r=w||n.referrer;E(),w=t;var i=new URL(t).pathname;A=C.some(function(s){return s.test(i)}),v=G(),f=0,y=0,F(),c(),k("pageview",{i:v,r,t:n.title,w:screen.width,h:screen.height,l:u.language}),z&&l("404",{path:location.pathname}),z=!1}},l=function(e,t){typeof e!="string"||!e||k("event",{i:v,n:e,p:t&&typeof t=="object"?t:void 0})},D=function(e){var t=history[e];history[e]=function(){var r=t.apply(this,arguments);return h(),r}};I||(D("pushState"),D("replaceState"),a.addEventListener("popstate",h),U&&a.addEventListener("hashchange",h)),n.addEventListener("visibilitychange",function(){n.visibilityState==="hidden"?E():c()}),a.addEventListener("pagehide",E),a.addEventListener("blur",B),a.addEventListener("focus",c),a.addEventListener("scroll",function(){F(),c()},{passive:!0}),n.addEventListener("pointerdown",c,!0),n.addEventListener("keydown",c,!0);var Y=/\.(pdf|zip|gz|tgz|dmg|pkg|exe|msi|apk|docx?|xlsx?|pptx?|csv|txt|rtf|epub|mp3|wav|mp4|mov|avi|mkv|psd|ai|svg|key|numbers|pages)$/i;n.addEventListener("click",function(e){var t=e.target;if(!(!t||!t.closest)){for(var r=t.closest("a[href]"),i=0;i<T.length;i++)try{var s=T[i],S=s[1];(s[0]==="s"?t.closest(S):r&&$(S).test(S.charAt(0)==="/"?r.pathname:r.href))&&l(s[2])}catch(q){}var g=t.closest("[data-runlight]");if(g){for(var V={},x=0;x<g.attributes.length;x++){var _=g.attributes[x];_.name.indexOf("data-runlight-")===0&&(V[_.name.slice(14)]=_.value)}l(g.getAttribute("data-runlight"),V)}if(!(!r||g)){var j=r.href;/^https?:/.test(j)&&(o("downloads")!=="false"&&Y.test(r.pathname)?l("File download",{url:j}):o("outbound")!=="false"&&r.host!==location.host&&l("Outbound link",{url:j}))}}},!0),a.runlight=l,l.pageview=h,I||h();for(var L=0;L<H.length;L++)l.apply(null,H[L])}})();
+(function(){var n=window,a=document,u=navigator,p=a.currentScript;if(p){var o=function(e){return p.getAttribute("data-"+e)},R=p.src.replace(/s\.js(\?.*)?$/,"e"),k=o("site"),U=o("hash")!==null,I=o("manual")!==null,$=o("before-send"),A=function(e){return new RegExp("^"+e.replace(/[.+?^${}()|[\]\\]/g,"\\$&").replace(/\*/g,".*")+"$")},G=(o("exclude")||"").split(",").filter(Boolean).map(function(e){return A(e.trim())}),H=!1,O=n.runlight&&n.runlight.q||[],m="__RUNLIGHT_RULES__",T=typeof m=="object"&&(m[k]||m[location.hostname.replace(/^www\./,"")]||m["*"])||[];if(/[?&]runlight=pick\b/.test(location.search)&&/[?&]runlight_ticket=/.test(location.search)){var M=a.createElement("script");M.src=p.src.replace(/s\.js(\?.*)?$/,"pick.js")+location.search,a.head.appendChild(M),n.runlight=function(){};return}var N=!1;try{var z=/[?&]runlight=(ignore|track)\b/.exec(location.search);z&&(z[1]==="ignore"?localStorage.setItem("runlight_ignore","1"):localStorage.removeItem("runlight_ignore")),N=localStorage.getItem("runlight_ignore")==="1"}catch(e){}if(u.webdriver||N||o("dnt")!==null&&(u.doNotTrack==="1"||n.doNotTrack==="1")){n.runlight=function(){};return}var E=function(e,t){if(!H){var r={k:e,u:b};k&&(r.s=k);for(var i in t)r[i]=t[i];if($!==null)try{if(r=n[$](r),!r||r.constructor!==Object)return}catch(y){return}var s=JSON.stringify(r);u.sendBeacon&&u.sendBeacon(R,s)||n.fetch&&fetch(R,{method:"POST",body:s,keepalive:!0}).catch(function(){})}},J=function(){var e=new Uint8Array(6);return(n.crypto||{}).getRandomValues?crypto.getRandomValues(e):e.forEach(function(t,r){e[r]=Math.random()*256}),Array.from(e,function(t){return(t+256).toString(36).slice(-2)}).join("")},B=o("404")!==null,b="",v="",f=0,d=0,w=0,P=function(){return a.visibilityState==="visible"&&a.hasFocus()},F=function(){d&&(f+=Date.now()-d),d=0},c=function(){!d&&P()&&(d=Date.now())},S=function(){F(),v&&f>=1e3&&(E("engagement",{i:v,e:f,d:w}),f=0)},D=function(){var e=a.documentElement,t=Math.max(e.scrollHeight,a.body?a.body.scrollHeight:0),r=(n.scrollY||e.scrollTop)+n.innerHeight,i=t>0?Math.min(100,Math.round(r/t*100)):100;i>w&&(w=i)},Y=function(){var e=location;return e.protocol+"//"+e.host+e.pathname+e.search+(U?e.hash:"")},h=function(e){var t=typeof e=="string"?new URL(e,location.href).href:Y();if(t!==b){var r=b||a.referrer;S(),b=t;var i=new URL(t).pathname;H=G.some(function(s){return s.test(i)}),v=J(),f=0,w=0,D(),c(),E("pageview",{i:v,r,t:a.title,w:screen.width,h:screen.height,l:u.language}),B&&l("404",{path:location.pathname}),B=!1}},l=function(e,t){typeof e!="string"||!e||E("event",{i:v,n:e,p:t&&typeof t=="object"?t:void 0})},V=function(e){var t=history[e];history[e]=function(){var r=t.apply(this,arguments);return h(),r}};I||(V("pushState"),V("replaceState"),n.addEventListener("popstate",h),U&&n.addEventListener("hashchange",h)),a.addEventListener("visibilitychange",function(){a.visibilityState==="hidden"?S():c()}),n.addEventListener("pagehide",S),n.addEventListener("blur",F),n.addEventListener("focus",c),n.addEventListener("scroll",function(){D(),c()},{passive:!0}),a.addEventListener("pointerdown",c,!0),a.addEventListener("keydown",c,!0);var q=/\.(pdf|zip|gz|tgz|dmg|pkg|exe|msi|apk|docx?|xlsx?|pptx?|csv|txt|rtf|epub|mp3|wav|mp4|mov|avi|mkv|psd|ai|svg|key|numbers|pages)$/i;a.addEventListener("click",function(e){var t=e.target;if(!(!t||!t.closest)){for(var r=t.closest("a[href]"),i=0;i<T.length;i++)try{var s=T[i],y=s[1];(s[0]==="s"?t.closest(y):r&&A(y).test(y.charAt(0)==="/"?r.pathname:r.href))&&l(s[2])}catch(K){}var g=t.closest("[data-runlight]");if(g){for(var C={},x=0;x<g.attributes.length;x++){var _=g.attributes[x];_.name.indexOf("data-runlight-")===0&&(C[_.name.slice(14)]=_.value)}l(g.getAttribute("data-runlight"),C)}if(!(!r||g)){var j=r.href;/^https?:/.test(j)&&(o("downloads")!=="false"&&q.test(r.pathname)?l("File download",{url:j}):o("outbound")!=="false"&&r.host!==location.host&&l("Outbound link",{url:j}))}}},!0),n.runlight=l,l.pageview=h,I||h();for(var L=0;L<O.length;L++)l.apply(null,O[L])}})();

data/lib/runlight/accounts/accounts.rb

@@ -138,7 +138,8 @@ module Runlight
       # Checks a six-digit code, or a recovery code, for an account with two-factor on.
       # A code works once: one already used, or older, is refused, and a recovery code is crossed off.
       # One check at a time, so two sign-ins at once cannot both use the same code: TypeScript queues them per
-      # account in its process, and here the database's lock is taken, which holds across processes too.
+      # account in its process, and here the database's lock is taken, which holds across processes too. The
+      # update that uses a code is also conditional, so the database has the last word either way.
       def check_second_factor(id, code, now)
         init
         turn { check_second_factor_now(id, code, now) }
@@ -221,6 +222,7 @@ module Runlight
           if user["role"] == "owner"
             raise AccountError.new("Only the owner can change their own role, by handing ownership to an admin", "owner_protected")
           end
+          raise AccountError.new("An admin needs access to all sites", "role_scope") if !user["site"].nil? && role == "admin"
           raise AccountError.new("Ownership is handed over by the owner", "owner_hand_over") if role == "owner"
 
           @store.db.run("UPDATE rl_users SET role = ? WHERE id = ?", [role, id])
@@ -239,7 +241,7 @@ module Runlight
           nxt = find(to)
           raise AccountError.new("Only the owner can hand over ownership", "owner_hand_over") if owner.nil? || owner["role"] != "owner"
           raise AccountError.new("Unknown account", "unknown_account") if nxt.nil?
-          raise AccountError.new("Make them an admin first", "owner_needs_admin") if nxt["role"] != "admin"
+          raise AccountError.new("Make them an admin first", "owner_needs_admin") if !nxt["site"].nil? || nxt["role"] != "admin"
 
           @store.db.run("UPDATE rl_users SET role = 'owner' WHERE id = ?", [to])
           @store.db.run("UPDATE rl_users SET role = 'admin' WHERE id = ?", [from])
@@ -265,8 +267,9 @@ module Runlight
 
       # Makes an account, or sets a new password on an existing one. A new account is the owner when it is the first,
       # and otherwise an admin unless a role is given, since a server has one owner.
-      def set_password(email, password, now, role = nil)
+      def set_password(email, password, now, role = nil, site = nil)
         init
+        raise AccountError.new("Choose member or viewer for one site", "role_scope") if !site.nil? && (site.empty? || !%w[member viewer].include?(role))
         address = Js.lower(Js.trim(email))
         raise AccountError.new("Enter an email address", "email_invalid") unless address.match?(EMAIL)
         if Js.length(password) < MIN_PASSWORD
@@ -290,9 +293,10 @@ module Runlight
           "createdAt" => now,
           "twoFactor" => false,
           "recoveryLeft" => 0,
+          **(site.nil? ? {} : { "site" => site }),
         }
-        @store.db.run("INSERT INTO rl_users (id, email, hash, role, created_at) VALUES (?, ?, ?, ?, ?)",
-                      [user["id"], user["email"], user["hash"], user["role"], user["createdAt"]])
+        @store.db.run("INSERT INTO rl_users (id, email, hash, role, created_at, site) VALUES (?, ?, ?, ?, ?, ?)",
+                      [user["id"], user["email"], user["hash"], user["role"], user["createdAt"], site])
         user
       end
 
@@ -305,9 +309,9 @@ module Runlight
 
       # Invites someone to join with a role, and returns {"invite" => ..., "code" => ...}, the code for their link.
       # Asking again replaces the earlier invite, so only the newest link works.
-      def invite(email, role, invited_by, now)
+      def invite(email, role, invited_by, now, site = nil)
         init
-        turn { invite_now(email, role, invited_by, now) }
+        turn { invite_now(email, role, invited_by, now, site) }
       end
 
       # The invite a link's code belongs to, while it still works.
@@ -336,7 +340,7 @@ module Runlight
           next nil if invite.nil?
 
           sender = by_email(invite["invitedBy"])
-          if sender.nil? || !self.class.may_invite?(sender["role"])
+          if sender.nil? || !sender["site"].nil? || !self.class.may_invite?(sender["role"])
             # Left without raising, since an error inside a turn on SQLite would roll this back.
             @store.db.run("DELETE FROM rl_invites WHERE id = ?", [invite["id"]])
             next nil
@@ -345,7 +349,7 @@ module Runlight
             raise AccountError.new("#{invite["email"]} already has an account", "account_exists", { "email" => invite["email"] })
           end
 
-          made = set_password(invite["email"], password, now, invite["role"])
+          made = set_password(invite["email"], password, now, invite["role"], invite["site"])
           @store.db.run("DELETE FROM rl_invites WHERE id = ?", [invite["id"]])
           made
         end
@@ -450,6 +454,10 @@ module Runlight
             "CREATE TABLE IF NOT EXISTS rl_invites (id #{str.call(100)} PRIMARY KEY, email #{str.call(320)} NOT NULL UNIQUE, role #{str.call(20)} NOT NULL, " \
             "code_hash #{str.call(128)} NOT NULL UNIQUE, invited_by #{str.call(100)} NOT NULL, created_at BIGINT NOT NULL, expires_at BIGINT NOT NULL)#{table}",
           )
+          %w[rl_users rl_invites].each do |name|
+            fields = db.dialect == "sqlite" ? db.all("PRAGMA table_info(#{name})") : db.all("SELECT column_name AS name FROM information_schema.columns WHERE table_name = '#{name}' AND table_schema = #{my ? 'DATABASE()' : 'current_schema()'}")
+            db.run("ALTER TABLE #{name} ADD COLUMN site TEXT") unless fields.any? { |c| c["name"] == "site" }
+          end
           # A server has one owner. One from before, with several, keeps the first and the rest become admins,
           # who can still do everything but remove the owner. Invites to join as an owner become invites as an admin.
           owners = db.all("SELECT id FROM rl_users WHERE role = 'owner' ORDER BY created_at, id")
@@ -466,6 +474,7 @@ module Runlight
           "email" => r["email"].to_s,
           "hash" => r["hash"].to_s,
           "role" => self.class.role_from(r["role"]),
+          **(r["site"].nil? ? {} : { "site" => r["site"].to_s }),
           "createdAt" => Js.number(r["created_at"]),
           "twoFactor" => Js.truthy?(r["totp_secret"]),
           "recoveryLeft" => recovery.length,
@@ -493,16 +502,17 @@ module Runlight
           step = !secret.nil? && secret != "" ? Crypto.match_step(secret, digits, now, after) : nil
           return false if step.nil?
 
-          @store.db.run("UPDATE rl_users SET totp_step = ? WHERE id = ?", [step, id])
-          return true
+          # Only if no check since has used this step or a later one, whatever took the turn before this one.
+          return @store.db.affected("UPDATE rl_users SET totp_step = ? WHERE id = ? AND (totp_step IS NULL OR totp_step < ?)", [step, id, step]) == 1
         end
-        hashes = Js.truthy?(row["totp_recovery"]) ? Json.decode(row["totp_recovery"].to_s) : []
+        read = Js.truthy?(row["totp_recovery"]) ? row["totp_recovery"].to_s : nil
+        hashes = read.nil? ? [] : Json.decode(read)
         at = hashes.index(Crypto.recovery_hash(given))
         return false if at.nil?
 
         hashes.delete_at(at)
-        @store.db.run("UPDATE rl_users SET totp_recovery = ? WHERE id = ?", [Json.encode(hashes), id])
-        true
+        # Only if the codes are still the ones read, so a code crossed off at the same moment elsewhere is not used twice.
+        @store.db.affected("UPDATE rl_users SET totp_recovery = ? WHERE id = ? AND totp_recovery = ?", [Json.encode(hashes), id, read]) == 1
       end
 
       def ticket(kind, user, expires)
@@ -532,22 +542,24 @@ module Runlight
           "id" => r["id"].to_s,
           "email" => r["email"].to_s,
           "role" => self.class.role_from(r["role"]),
+          **(r["site"].nil? ? {} : { "site" => r["site"].to_s }),
           "invitedBy" => r["invited_by"].to_s,
           "createdAt" => Js.number(r["created_at"]),
           "expiresAt" => Js.number(r["expires_at"]),
         }
       end
 
-      def invite_now(email, role, invited_by, now)
+      def invite_now(email, role, invited_by, now, site = nil)
+        raise AccountError.new("Choose member or viewer for one site", "role_scope") if !site.nil? && (site.empty? || !%w[member viewer].include?(role))
         address = Js.lower(Js.trim(email))
         raise AccountError.new("Enter an email address", "email_invalid") unless address.match?(EMAIL)
         raise AccountError.new("#{address} already has an account", "account_exists", { "email" => address }) unless by_email(address).nil?
 
         code = Crypto.base64url(Crypto.random_bytes(24))
-        invite = { "id" => Crypto.hex(Crypto.random_bytes(12)), "email" => address, "role" => role, "invitedBy" => invited_by, "createdAt" => now,
+        invite = { **(site.nil? ? {} : { "site" => site }), "id" => Crypto.hex(Crypto.random_bytes(12)), "email" => address, "role" => role, "invitedBy" => invited_by, "createdAt" => now,
                    "expiresAt" => now + INVITE_MS }
         @store.db.run("DELETE FROM rl_invites WHERE email = ?", [address])
-        @store.db.run("INSERT INTO rl_invites (id, email, role, code_hash, invited_by, created_at, expires_at) VALUES (?, ?, ?, ?, ?, ?, ?)", [
+        @store.db.run("INSERT INTO rl_invites (id, email, role, code_hash, invited_by, created_at, expires_at, site) VALUES (?, ?, ?, ?, ?, ?, ?, ?)", [
           invite["id"],
           invite["email"],
           invite["role"],
@@ -555,6 +567,7 @@ module Runlight
           invite["invitedBy"],
           invite["createdAt"],
           invite["expiresAt"],
+          site,
         ])
         { "invite" => invite, "code" => code }
       end

data/lib/runlight/accounts/pages.rb

@@ -37,6 +37,14 @@ module Runlight
         .theme:hover { color: var(--ink); }
         .theme svg { width: 16px; height: 16px; fill: none; stroke: currentColor; stroke-width: 1.5; stroke-linecap: round; stroke-linejoin: round; }
         .theme svg:not(.on) { display: none; }
+        .strength { display: flex; align-items: center; gap: 10px; margin-top: 8px; font-size: 12px; color: var(--muted); }
+        .strength[hidden] { display: none; }
+        .strength-bar { display: grid; grid-template-columns: repeat(4, 1fr); gap: 4px; width: 120px; }
+        .strength-bar span { height: 4px; border-radius: 2px; background: var(--line); }
+        .strength[data-score="0"] .strength-label, .strength[data-score="1"] .strength-label { color: var(--bad); }
+        .strength[data-score="1"] .on { background: var(--bad); }
+        .strength[data-score="2"] .on { background: #b7791f; }
+        .strength[data-score="3"] .on, .strength[data-score="4"] .on { background: #22a065; }
         .secret { position: relative; display: block; margin-top: 6px; }
         .secret input { margin-top: 0; padding-right: 44px; }
         .eye { position: absolute; top: 50%; right: 5px; display: grid; place-items: center; width: 32px; height: 30px; margin: 0; padding: 0; border: 0; border-radius: 6px; background: none; color: var(--muted); transform: translateY(-50%); cursor: pointer; }
@@ -48,6 +56,37 @@ module Runlight
       # Applies the saved theme before the page paints, then runs the switch and Cmd+Shift+D (Ctrl+Shift+D).
       AUTH_JS = <<~'JS'.chomp
         (() => {
+          const COMMON = ["password", "passw0rd", "123456", "qwerty", "azerty", "letmein", "welcome", "admin", "runlight", "iloveyou", "abc123", "monkey", "dragon", "football", "baseball", "sunshine", "princess", "shadow", "master"];
+          function strength(password, avoid = []) {
+            if (password.length < 10) return 0;
+            let pool = 0;
+            if (/[a-z]/.test(password)) pool += 26;
+            if (/[A-Z]/.test(password)) pool += 26;
+            if (/[0-9]/.test(password)) pool += 10;
+            if (/[^A-Za-z0-9]/.test(password)) pool += 33;
+            // Each character only counts once it adds something new: a pattern repeating ("abab", "Aa1!Aa1!",
+            // "aaaa") adds nothing, and a doubled letter or a run like "abc" adds little.
+            let effective = 0;
+            for (let i = 0; i < password.length; i++) {
+              const c = password.charCodeAt(i);
+              const prev = password.charCodeAt(i - 1);
+              let pattern = false;
+              for (let k = 1; k <= 4 && !pattern; k++) pattern = i - 1 - k >= 0 && password[i] === password[i - k] && password[i - 1] === password[i - 1 - k];
+              const repeat = i > 0 && c === prev;
+              const run = i > 1 && c - prev === prev - password.charCodeAt(i - 2) && Math.abs(c - prev) === 1;
+              effective += pattern ? 0 : repeat || run ? 0.25 : 1;
+            }
+            let bits = effective * Math.log2(Math.max(pool, 10));
+            const lower = password.toLowerCase();
+            for (const word of [...COMMON, ...avoid.map((a) => a.toLowerCase()).filter((a) => a.length >= 3)]) {
+              // Every time it appears, so "jonjonjon" costs three times.
+              bits -= (lower.split(word).length - 1) * word.length * 3;
+            }
+            if (bits < 40) return 1;
+            if (bits < 60) return 2;
+            if (bits < 80) return 3;
+            return 4;
+          }
           const KEY = "runlight_theme";
           const root = document.documentElement;
           const read = () => { try { const v = localStorage.getItem(KEY); return v === "dark" || v === "system" ? v : "light"; } catch { return "light"; } };
@@ -85,6 +124,30 @@ module Runlight
               eye.addEventListener("click", () => set(input.type === "password"));
               wrap.append(eye);
             }
+            const password = document.querySelector('input[name="password"][autocomplete="new-password"]');
+            if (password) {
+              const meter = document.createElement("span");
+              meter.className = "strength";
+              meter.id = "password-strength";
+              meter.setAttribute("aria-live", "polite");
+              meter.innerHTML = '<span class="strength-bar" aria-hidden="true"><span></span><span></span><span></span><span></span></span><span class="strength-label"></span>';
+              password.closest(".secret").after(meter);
+              password.setAttribute("aria-describedby", meter.id);
+              const email = document.querySelector('input[name="email"]');
+              const update = () => {
+                const address = email?.value || "";
+                const score = strength(password.value, [address, address.split("@")[0]]);
+                meter.hidden = !password.value;
+                meter.dataset.score = String(score);
+                meter.querySelector(".strength-label").textContent = ["Too short", "Weak", "Fair", "Good", "Strong"][score];
+                meter.querySelectorAll(".strength-bar span").forEach((bar, i) => bar.classList.toggle("on", score > i));
+              };
+              password.addEventListener("input", update);
+              password.addEventListener("change", update);
+              email?.addEventListener("input", update);
+              window.addEventListener("pageshow", update);
+              update();
+            }
             show();
             document.querySelector(".theme")?.addEventListener("click", () => set({ light: "dark", dark: "system", system: "light" }[read()]));
           });
@@ -178,7 +241,8 @@ module Runlight
       end
 
       # What someone invited with a role can do, after "as".
-      def role_text(role)
+      def role_text(role, site = nil)
+        return role == "viewer" ? "a viewer, who can read the stats for #{site} only" : "a member, who can change the settings of #{site} only" unless site.nil?
         return "a viewer, who can read every site's stats" if role == "viewer"
         return "a member, who can change the settings of every site" if role == "member"
 
@@ -190,7 +254,7 @@ module Runlight
         b = esc(base)
         page(base, "Join Runlight", <<~HTML.chomp)
           <h1>Join Runlight</h1>
-          <p>You were invited to #{esc(opts["host"])} as #{role_text(opts["role"])}. Choose a password to finish.</p>
+          <p>You were invited to #{esc(opts["host"])} as #{esc(role_text(opts["role"], opts["site"]))}. Choose a password to finish.</p>
           #{error(opts["error"])}
           <form method="post" action="#{b}/invite">
           <input type="hidden" name="code" value="#{esc(opts["code"])}">
@@ -221,7 +285,7 @@ module Runlight
                 end
         page(base, "Create your account", <<~HTML.chomp)
           <h1>Create your account</h1>
-          <p>This account owns the dashboard. You can invite more people later in Settings, People.</p>
+          <p>This account owns the dashboard. You can invite more people later in Settings, Team Members.</p>
           #{error(opts["error"])}
           <form method="post" action="#{b}/setup">
           #{field}

data/lib/runlight/accounts/web.rb

@@ -120,7 +120,9 @@ module Runlight
       # Notes who made a token. A viewer makes no tokens; someone removed or made a viewer since allowing an app
       # gets none for it, and false takes the token back.
       def token_made(token, by)
-        role = @accounts.by_id(by)&.fetch("role", nil)
+        user = @accounts.by_id(by)
+        return false if user.nil? || !user["site"].nil?
+        role = user["role"]
         return false if role.nil? || role == "viewer"
 
         @store.set_setting("#{MADE_BY}#{token["id"]}", by)
@@ -148,6 +150,14 @@ module Runlight
         nil
       end
 
+      def confirm_password(request)
+        user = signed_in(request)
+        return coded("Sign in first", "sign_in", 401) if user.nil?
+        input = body(request)
+        return coded("Send JSON", "send_json", 415) if input.nil?
+        recheck(user, input, "password", ["Your password is not right", "password_wrong"])
+      end
+
       private
 
       def now
@@ -202,11 +212,11 @@ module Runlight
       end
 
       def person(u)
-        { "id" => u["id"], "email" => u["email"], "role" => u["role"], "createdAt" => u["createdAt"], "twoFactor" => u["twoFactor"], "recoveryLeft" => u["recoveryLeft"] }
+        { **(u["site"].nil? ? {} : { "site" => u["site"] }), "id" => u["id"], "email" => u["email"], "role" => u["role"], "createdAt" => u["createdAt"], "twoFactor" => u["twoFactor"], "recoveryLeft" => u["recoveryLeft"] }
       end
 
       def invite_view(i)
-        { "id" => i["id"], "email" => i["email"], "role" => i["role"], "invitedBy" => i["invitedBy"], "createdAt" => i["createdAt"], "expiresAt" => i["expiresAt"] }
+        { **(i["site"].nil? ? {} : { "site" => i["site"] }), "id" => i["id"], "email" => i["email"], "role" => i["role"], "invitedBy" => i["invitedBy"], "createdAt" => i["createdAt"], "expiresAt" => i["expiresAt"] }
       end
 
       # The media type of a request's body, as a cross-site form cannot send application/json.
@@ -270,7 +280,7 @@ module Runlight
         origin = home_origin || Http::Url.new(request.url).origin
         link = "#{origin}#{@base}/invite?code=#{code}"
         host = Http::Url.new(origin).host
-        what = Pages.role_text(invite["role"])
+        what = Pages.role_text(invite["role"], invite["site"])
         return { "link" => link, "emailed" => false } unless @rl.mail_settings
 
         begin
@@ -278,8 +288,8 @@ module Runlight
             "to" => invite["email"],
             "subject" => "#{invite["invitedBy"]} invited you to Runlight",
             "text" => "#{invite["invitedBy"]} invited you to the Runlight at #{host} as #{what}.\n\nChoose a password to join:\n#{link}\n\nThe link works for seven days.\n",
-            "html" => "<div style=\"font:15px/1.6 -apple-system,BlinkMacSystemFont,'Segoe UI',Helvetica,Arial,sans-serif;color:#111827;max-width:480px\"><p>" \
-                      "#{esc(invite["invitedBy"])} invited you to the Runlight at #{esc(host)} as #{what}.</p><p><a href=\"#{esc(link)}\" " \
+            "html" => "<div style=\"font:15px/1.6 -apple-system,BlinkMacSystemFont,'Segoe UI',Helvetica,Arial,sans-serif;color:#111827;max-width:480px\"><img src=\"https://runlight.sh/icon-192.png\" width=\"48\" height=\"48\" alt=\"Runlight\" style=\"display:block;width:48px;height:48px;margin-bottom:24px;border:0;border-radius:10px\"><p>" \
+                      "#{esc(invite["invitedBy"])} invited you to the Runlight at #{esc(host)} as #{esc(what)}.</p><p><a href=\"#{esc(link)}\" " \
                       "style=\"display:inline-block;padding:10px 18px;border-radius:8px;background:#111827;color:#ffffff;text-decoration:none;font-weight:600\">" \
                       "Choose a password and join</a></p><p style=\"color:#6b7280;font-size:13px\">The link works for seven days. If you were not expecting this, " \
                       "you can ignore it.</p></div>",
@@ -316,7 +326,7 @@ module Runlight
           "subject" => "Sign in to Runlight",
           "text" => "Someone, most likely you, signed in to Runlight at #{host} with your password while your account was held up by too many failed tries.\n\n" \
                     "Sign in with this link within fifteen minutes:\n#{link}\n\nIf this was not you, change your password, since someone knows it.\n",
-          "html" => "<div style=\"font:15px/1.6 -apple-system,BlinkMacSystemFont,'Segoe UI',Helvetica,Arial,sans-serif;color:#111827;max-width:480px\">" \
+          "html" => "<div style=\"font:15px/1.6 -apple-system,BlinkMacSystemFont,'Segoe UI',Helvetica,Arial,sans-serif;color:#111827;max-width:480px\"><img src=\"https://runlight.sh/icon-192.png\" width=\"48\" height=\"48\" alt=\"Runlight\" style=\"display:block;width:48px;height:48px;margin-bottom:24px;border:0;border-radius:10px\">" \
                     "<p>Someone, most likely you, signed in to Runlight at #{esc(host)} with your password while your account was held up by too many failed tries.</p>" \
                     "<p><a href=\"#{esc(link)}\" style=\"display:inline-block;padding:10px 18px;border-radius:8px;background:#111827;color:#ffffff;" \
                     "text-decoration:none;font-weight:600\">Sign in</a></p><p style=\"color:#6b7280;font-size:13px\">The link works for fifteen minutes. " \
@@ -424,7 +434,7 @@ module Runlight
             invite = @accounts.invite_by_code(code, now)
             return html(Pages.invite_gone_page(base), 410) if invite.nil?
 
-            return html(Pages.invite_page(base, { "code" => code, "email" => invite["email"], "role" => invite["role"], "host" => url.host }))
+            return html(Pages.invite_page(base, { "code" => code, "email" => invite["email"], "role" => invite["role"], "site" => invite["site"], "host" => url.host }))
           end
           if method == "POST"
             form = Http::SearchParams.new(request.text)
@@ -433,7 +443,7 @@ module Runlight
             return html(Pages.invite_gone_page(base), 410) if invite.nil?
 
             again = lambda do |error|
-              html(Pages.invite_page(base, { "code" => code, "email" => invite["email"], "role" => invite["role"], "host" => url.host, "error" => error }), 400)
+              html(Pages.invite_page(base, { "code" => code, "email" => invite["email"], "role" => invite["role"], "site" => invite["site"], "host" => url.host, "error" => error }), 400)
             end
             return again.call("The two passwords are not the same.") if (form.get("password") || "") != (form.get("again") || "")
 
@@ -510,6 +520,21 @@ module Runlight
         html(login_page.call({ "error" => e.message, "email" => email }), 503, { "retry-after" => "5" })
       end
 
+      def recheck(user, input, name, wrong)
+        return coded("Too many tries. Wait fifteen minutes and try again.", "too_many_tries", 429) unless @rechecks.take(user["id"], now)
+        begin
+          right = @accounts.sign_in(user["email"], field(input, name))
+        rescue AccountError => e
+          raise unless e.code == "busy"
+
+          return coded("Runlight is busy checking other sign-ins. Try again in a moment.", "busy", 503)
+        end
+        return coded(wrong[0], wrong[1], 400) if right.nil?
+
+        @rechecks.forgive(user["id"], now)
+        nil
+      end
+
       # Your own account, and for the owner and admins, everyone else's.
       def api(request, path)
         user = signed_in(request)
@@ -522,26 +547,12 @@ module Runlight
         return coded("Send JSON", "send_json", 415) if method == "POST" && media_type(request) != "application/json"
         return reply({ "account" => person(user) }) if path == "/api/account" && method == "GET"
 
-        recheck = lambda do |input, name, wrong|
-          return coded("Too many tries. Wait fifteen minutes and try again.", "too_many_tries", 429) unless @rechecks.take(user["id"], now)
-          begin
-            right = @accounts.sign_in(user["email"], field(input, name))
-          rescue AccountError => e
-            raise unless e.code == "busy"
-
-            return coded("Runlight is busy checking other sign-ins. Try again in a moment.", "busy", 503)
-          end
-          return coded(wrong[0], wrong[1], 400) if right.nil?
-
-          @rechecks.forgive(user["id"], now)
-          nil
-        end
         fresh = ->(updated) { { "set-cookie" => session_cookie(request, @accounts.session_for(updated, now), Accounts::SESSION_MS / 1000) } }
         if path == "/api/account/password" && method == "POST"
           input = body(request)
           return coded("Send JSON", "send_json", 415) if input.nil?
 
-          refused = recheck.call(input, "current", ["Your current password is not right", "password_current_wrong"])
+          refused = recheck(user, input, "current", ["Your current password is not right", "password_current_wrong"])
           return refused unless refused.nil?
 
           begin
@@ -573,7 +584,7 @@ module Runlight
             updated = @accounts.by_id(user["id"])
             return reply({ "recovery" => codes }, 200, fresh.call(updated))
           end
-          refused = recheck.call(input, "password", ["Your password is not right", "password_wrong"])
+          refused = recheck(user, input, "password", ["Your password is not right", "password_wrong"])
           return refused unless refused.nil?
 
           if action == "/start"
@@ -594,7 +605,7 @@ module Runlight
           end
           return coded("Not found", "not_found", 404)
         end
-        return coded("Only the owner or an admin can manage people", "people_owner", 403) if user["role"] != "owner" && user["role"] != "admin"
+        return coded("Only the owner or an admin can manage people", "people_owner", 403) if !user["site"].nil? || (user["role"] != "owner" && user["role"] != "admin")
 
         # The owner or an admin can turn off someone else's two-factor, for a coworker who lost both phone and recovery
         # codes, though never the owner's. It asks for their password like every other two-factor change, and their own
@@ -605,7 +616,7 @@ module Runlight
           input = body(request)
           return coded("Send JSON", "send_json", 415) if input.nil?
 
-          refused = recheck.call(input, "password", ["Your password is not right", "password_wrong"])
+          refused = recheck(user, input, "password", ["Your password is not right", "password_wrong"])
           return refused unless refused.nil?
 
           target = @accounts.by_id(reset[1])
@@ -622,7 +633,7 @@ module Runlight
           input = body(request)
           return coded("Send JSON", "send_json", 415) if input.nil?
 
-          refused = recheck.call(input, "password", ["Your password is not right", "password_wrong"])
+          refused = recheck(user, input, "password", ["Your password is not right", "password_wrong"])
           return refused unless refused.nil?
 
           begin
@@ -648,7 +659,11 @@ module Runlight
           return coded("#{email} already has an account", "account_exists", 409, { "email" => email }) unless @accounts.by_email(email).nil?
 
           begin
-            made = @accounts.invite(email, role, user["email"], now)
+            @rl.init
+            site = input["allSites"] == true ? nil : input["site"]
+            return coded("Choose a site or explicitly invite to all sites", "invite_site", 400) if input["allSites"] != true && (!site.is_a?(String) || site.empty?)
+            return coded("Unknown site", "unknown_site", 404) if !site.nil? && @rl.site(site).nil?
+            made = @accounts.invite(email, role, user["email"], now, site)
             return reply({ "invite" => invite_view(made["invite"]) }.merge(send_invite(request, made["invite"], made["code"])), 201)
           rescue AccountError => e
             return coded(e.message, e.code, 400, e.params)
@@ -664,7 +679,7 @@ module Runlight
             return coded("Unknown invite", "unknown_invite", 404) if old.nil?
 
             # A new link replaces the old one, which stops working.
-            made = @accounts.invite(old["email"], old["role"], user["email"], now)
+            made = @accounts.invite(old["email"], old["role"], user["email"], now, old["site"])
             return reply({ "invite" => invite_view(made["invite"]) }.merge(send_invite(request, made["invite"], made["code"])))
           end
         end