runlight 0.1.3 → 0.1.6

data/assets/tracker.js

@@ -1 +1 @@
-(function(){var a=window,n=document,u=navigator,p=n.currentScript;if(p){var o=function(e){return p.getAttribute("data-"+e)},R=p.src.replace(/s\.js(\?.*)?$/,"e"),b=o("site"),U=o("hash")!==null,I=o("manual")!==null,$=function(e){return new RegExp("^"+e.replace(/[.+?^${}()|[\]\\]/g,"\\$&").replace(/\*/g,".*")+"$")},C=(o("exclude")||"").split(",").filter(Boolean).map(function(e){return $(e.trim())}),A=!1,H=a.runlight&&a.runlight.q||[],m="__RUNLIGHT_RULES__",T=typeof m=="object"&&(m[b]||m[location.hostname.replace(/^www\./,"")]||m["*"])||[];if(/[?&]runlight=pick\b/.test(location.search)&&/[?&]runlight_ticket=/.test(location.search)){var M=n.createElement("script");M.src=p.src.replace(/s\.js(\?.*)?$/,"pick.js")+location.search,n.head.appendChild(M),a.runlight=function(){};return}var N=!1;try{var O=/[?&]runlight=(ignore|track)\b/.exec(location.search);O&&(O[1]==="ignore"?localStorage.setItem("runlight_ignore","1"):localStorage.removeItem("runlight_ignore")),N=localStorage.getItem("runlight_ignore")==="1"}catch(e){}if(u.webdriver||N||o("dnt")!==null&&(u.doNotTrack==="1"||a.doNotTrack==="1")){a.runlight=function(){};return}var k=function(e,t){if(!A){var r={k:e,u:w};b&&(r.s=b);for(var i in t)r[i]=t[i];var s=JSON.stringify(r);u.sendBeacon&&u.sendBeacon(R,s)||a.fetch&&fetch(R,{method:"POST",body:s,keepalive:!0}).catch(function(){})}},G=function(){var e=new Uint8Array(8);return(a.crypto||{}).getRandomValues?crypto.getRandomValues(e):e.forEach(function(t,r){e[r]=Math.random()*256}),Array.prototype.map.call(e,function(t){return(t+256).toString(36).slice(-2)}).join("").slice(0,12)},z=o("404")!==null,w="",v="",f=0,d=0,y=0,J=function(){return n.visibilityState==="visible"&&n.hasFocus()},B=function(){d&&(f+=Date.now()-d),d=0},c=function(){!d&&J()&&(d=Date.now())},E=function(){B(),v&&f>=1e3&&(k("engagement",{i:v,e:f,d:y}),f=0)},F=function(){var e=n.documentElement,t=Math.max(e.scrollHeight,n.body?n.body.scrollHeight:0),r=(a.scrollY||e.scrollTop)+a.innerHeight,i=t>0?Math.min(100,Math.round(r/t*100)):100;i>y&&(y=i)},P=function(){var e=location;return e.protocol+"//"+e.host+e.pathname+e.search+(U?e.hash:"")},h=function(e){var t=typeof e=="string"?new URL(e,location.href).href:P();if(t!==w){var r=w||n.referrer;E(),w=t;var i=new URL(t).pathname;A=C.some(function(s){return s.test(i)}),v=G(),f=0,y=0,F(),c(),k("pageview",{i:v,r,t:n.title,w:screen.width,h:screen.height,l:u.language}),z&&l("404",{path:location.pathname}),z=!1}},l=function(e,t){typeof e!="string"||!e||k("event",{i:v,n:e,p:t&&typeof t=="object"?t:void 0})},D=function(e){var t=history[e];history[e]=function(){var r=t.apply(this,arguments);return h(),r}};I||(D("pushState"),D("replaceState"),a.addEventListener("popstate",h),U&&a.addEventListener("hashchange",h)),n.addEventListener("visibilitychange",function(){n.visibilityState==="hidden"?E():c()}),a.addEventListener("pagehide",E),a.addEventListener("blur",B),a.addEventListener("focus",c),a.addEventListener("scroll",function(){F(),c()},{passive:!0}),n.addEventListener("pointerdown",c,!0),n.addEventListener("keydown",c,!0);var Y=/\.(pdf|zip|gz|tgz|dmg|pkg|exe|msi|apk|docx?|xlsx?|pptx?|csv|txt|rtf|epub|mp3|wav|mp4|mov|avi|mkv|psd|ai|svg|key|numbers|pages)$/i;n.addEventListener("click",function(e){var t=e.target;if(!(!t||!t.closest)){for(var r=t.closest("a[href]"),i=0;i<T.length;i++)try{var s=T[i],S=s[1];(s[0]==="s"?t.closest(S):r&&$(S).test(S.charAt(0)==="/"?r.pathname:r.href))&&l(s[2])}catch(q){}var g=t.closest("[data-runlight]");if(g){for(var V={},x=0;x<g.attributes.length;x++){var _=g.attributes[x];_.name.indexOf("data-runlight-")===0&&(V[_.name.slice(14)]=_.value)}l(g.getAttribute("data-runlight"),V)}if(!(!r||g)){var j=r.href;/^https?:/.test(j)&&(o("downloads")!=="false"&&Y.test(r.pathname)?l("File download",{url:j}):o("outbound")!=="false"&&r.host!==location.host&&l("Outbound link",{url:j}))}}},!0),a.runlight=l,l.pageview=h,I||h();for(var L=0;L<H.length;L++)l.apply(null,H[L])}})();
+(function(){var n=window,a=document,u=navigator,p=a.currentScript;if(p){var o=function(e){return p.getAttribute("data-"+e)},R=p.src.replace(/s\.js(\?.*)?$/,"e"),k=o("site"),U=o("hash")!==null,I=o("manual")!==null,$=o("before-send"),A=function(e){return new RegExp("^"+e.replace(/[.+?^${}()|[\]\\]/g,"\\$&").replace(/\*/g,".*")+"$")},G=(o("exclude")||"").split(",").filter(Boolean).map(function(e){return A(e.trim())}),H=!1,O=n.runlight&&n.runlight.q||[],m="__RUNLIGHT_RULES__",T=typeof m=="object"&&(m[k]||m[location.hostname.replace(/^www\./,"")]||m["*"])||[];if(/[?&]runlight=pick\b/.test(location.search)&&/[?&]runlight_ticket=/.test(location.search)){var M=a.createElement("script");M.src=p.src.replace(/s\.js(\?.*)?$/,"pick.js")+location.search,a.head.appendChild(M),n.runlight=function(){};return}var N=!1;try{var z=/[?&]runlight=(ignore|track)\b/.exec(location.search);z&&(z[1]==="ignore"?localStorage.setItem("runlight_ignore","1"):localStorage.removeItem("runlight_ignore")),N=localStorage.getItem("runlight_ignore")==="1"}catch(e){}if(u.webdriver||N||o("dnt")!==null&&(u.doNotTrack==="1"||n.doNotTrack==="1")){n.runlight=function(){};return}var E=function(e,t){if(!H){var r={k:e,u:b};k&&(r.s=k);for(var i in t)r[i]=t[i];if($!==null)try{if(r=n[$](r),!r||r.constructor!==Object)return}catch(y){return}var s=JSON.stringify(r);u.sendBeacon&&u.sendBeacon(R,s)||n.fetch&&fetch(R,{method:"POST",body:s,keepalive:!0}).catch(function(){})}},J=function(){var e=new Uint8Array(6);return(n.crypto||{}).getRandomValues?crypto.getRandomValues(e):e.forEach(function(t,r){e[r]=Math.random()*256}),Array.from(e,function(t){return(t+256).toString(36).slice(-2)}).join("")},B=o("404")!==null,b="",v="",f=0,d=0,w=0,P=function(){return a.visibilityState==="visible"&&a.hasFocus()},F=function(){d&&(f+=Date.now()-d),d=0},c=function(){!d&&P()&&(d=Date.now())},S=function(){F(),v&&f>=1e3&&(E("engagement",{i:v,e:f,d:w}),f=0)},D=function(){var e=a.documentElement,t=Math.max(e.scrollHeight,a.body?a.body.scrollHeight:0),r=(n.scrollY||e.scrollTop)+n.innerHeight,i=t>0?Math.min(100,Math.round(r/t*100)):100;i>w&&(w=i)},Y=function(){var e=location;return e.protocol+"//"+e.host+e.pathname+e.search+(U?e.hash:"")},h=function(e){var t=typeof e=="string"?new URL(e,location.href).href:Y();if(t!==b){var r=b||a.referrer;S(),b=t;var i=new URL(t).pathname;H=G.some(function(s){return s.test(i)}),v=J(),f=0,w=0,D(),c(),E("pageview",{i:v,r,t:a.title,w:screen.width,h:screen.height,l:u.language}),B&&l("404",{path:location.pathname}),B=!1}},l=function(e,t){typeof e!="string"||!e||E("event",{i:v,n:e,p:t&&typeof t=="object"?t:void 0})},V=function(e){var t=history[e];history[e]=function(){var r=t.apply(this,arguments);return h(),r}};I||(V("pushState"),V("replaceState"),n.addEventListener("popstate",h),U&&n.addEventListener("hashchange",h)),a.addEventListener("visibilitychange",function(){a.visibilityState==="hidden"?S():c()}),n.addEventListener("pagehide",S),n.addEventListener("blur",F),n.addEventListener("focus",c),n.addEventListener("scroll",function(){D(),c()},{passive:!0}),a.addEventListener("pointerdown",c,!0),a.addEventListener("keydown",c,!0);var q=/\.(pdf|zip|gz|tgz|dmg|pkg|exe|msi|apk|docx?|xlsx?|pptx?|csv|txt|rtf|epub|mp3|wav|mp4|mov|avi|mkv|psd|ai|svg|key|numbers|pages)$/i;a.addEventListener("click",function(e){var t=e.target;if(!(!t||!t.closest)){for(var r=t.closest("a[href]"),i=0;i<T.length;i++)try{var s=T[i],y=s[1];(s[0]==="s"?t.closest(y):r&&A(y).test(y.charAt(0)==="/"?r.pathname:r.href))&&l(s[2])}catch(K){}var g=t.closest("[data-runlight]");if(g){for(var C={},x=0;x<g.attributes.length;x++){var _=g.attributes[x];_.name.indexOf("data-runlight-")===0&&(C[_.name.slice(14)]=_.value)}l(g.getAttribute("data-runlight"),C)}if(!(!r||g)){var j=r.href;/^https?:/.test(j)&&(o("downloads")!=="false"&&q.test(r.pathname)?l("File download",{url:j}):o("outbound")!=="false"&&r.host!==location.host&&l("Outbound link",{url:j}))}}},!0),n.runlight=l,l.pageview=h,I||h();for(var L=0;L<O.length;L++)l.apply(null,O[L])}})();

data/lib/runlight/accounts/accounts.rb

@@ -222,6 +222,7 @@ module Runlight
           if user["role"] == "owner"
             raise AccountError.new("Only the owner can change their own role, by handing ownership to an admin", "owner_protected")
           end
+          raise AccountError.new("An admin needs access to all sites", "role_scope") if !user["site"].nil? && role == "admin"
           raise AccountError.new("Ownership is handed over by the owner", "owner_hand_over") if role == "owner"
 
           @store.db.run("UPDATE rl_users SET role = ? WHERE id = ?", [role, id])
@@ -240,7 +241,7 @@ module Runlight
           nxt = find(to)
           raise AccountError.new("Only the owner can hand over ownership", "owner_hand_over") if owner.nil? || owner["role"] != "owner"
           raise AccountError.new("Unknown account", "unknown_account") if nxt.nil?
-          raise AccountError.new("Make them an admin first", "owner_needs_admin") if nxt["role"] != "admin"
+          raise AccountError.new("Make them an admin first", "owner_needs_admin") if !nxt["site"].nil? || nxt["role"] != "admin"
 
           @store.db.run("UPDATE rl_users SET role = 'owner' WHERE id = ?", [to])
           @store.db.run("UPDATE rl_users SET role = 'admin' WHERE id = ?", [from])
@@ -266,8 +267,9 @@ module Runlight
 
       # Makes an account, or sets a new password on an existing one. A new account is the owner when it is the first,
       # and otherwise an admin unless a role is given, since a server has one owner.
-      def set_password(email, password, now, role = nil)
+      def set_password(email, password, now, role = nil, site = nil)
         init
+        raise AccountError.new("Choose member or viewer for one site", "role_scope") if !site.nil? && (site.empty? || !%w[member viewer].include?(role))
         address = Js.lower(Js.trim(email))
         raise AccountError.new("Enter an email address", "email_invalid") unless address.match?(EMAIL)
         if Js.length(password) < MIN_PASSWORD
@@ -291,9 +293,10 @@ module Runlight
           "createdAt" => now,
           "twoFactor" => false,
           "recoveryLeft" => 0,
+          **(site.nil? ? {} : { "site" => site }),
         }
-        @store.db.run("INSERT INTO rl_users (id, email, hash, role, created_at) VALUES (?, ?, ?, ?, ?)",
-                      [user["id"], user["email"], user["hash"], user["role"], user["createdAt"]])
+        @store.db.run("INSERT INTO rl_users (id, email, hash, role, created_at, site) VALUES (?, ?, ?, ?, ?, ?)",
+                      [user["id"], user["email"], user["hash"], user["role"], user["createdAt"], site])
         user
       end
 
@@ -306,9 +309,9 @@ module Runlight
 
       # Invites someone to join with a role, and returns {"invite" => ..., "code" => ...}, the code for their link.
       # Asking again replaces the earlier invite, so only the newest link works.
-      def invite(email, role, invited_by, now)
+      def invite(email, role, invited_by, now, site = nil)
         init
-        turn { invite_now(email, role, invited_by, now) }
+        turn { invite_now(email, role, invited_by, now, site) }
       end
 
       # The invite a link's code belongs to, while it still works.
@@ -337,7 +340,7 @@ module Runlight
           next nil if invite.nil?
 
           sender = by_email(invite["invitedBy"])
-          if sender.nil? || !self.class.may_invite?(sender["role"])
+          if sender.nil? || !sender["site"].nil? || !self.class.may_invite?(sender["role"])
             # Left without raising, since an error inside a turn on SQLite would roll this back.
             @store.db.run("DELETE FROM rl_invites WHERE id = ?", [invite["id"]])
             next nil
@@ -346,7 +349,7 @@ module Runlight
             raise AccountError.new("#{invite["email"]} already has an account", "account_exists", { "email" => invite["email"] })
           end
 
-          made = set_password(invite["email"], password, now, invite["role"])
+          made = set_password(invite["email"], password, now, invite["role"], invite["site"])
           @store.db.run("DELETE FROM rl_invites WHERE id = ?", [invite["id"]])
           made
         end
@@ -451,6 +454,10 @@ module Runlight
             "CREATE TABLE IF NOT EXISTS rl_invites (id #{str.call(100)} PRIMARY KEY, email #{str.call(320)} NOT NULL UNIQUE, role #{str.call(20)} NOT NULL, " \
             "code_hash #{str.call(128)} NOT NULL UNIQUE, invited_by #{str.call(100)} NOT NULL, created_at BIGINT NOT NULL, expires_at BIGINT NOT NULL)#{table}",
           )
+          %w[rl_users rl_invites].each do |name|
+            fields = db.dialect == "sqlite" ? db.all("PRAGMA table_info(#{name})") : db.all("SELECT column_name AS name FROM information_schema.columns WHERE table_name = '#{name}' AND table_schema = #{my ? 'DATABASE()' : 'current_schema()'}")
+            db.run("ALTER TABLE #{name} ADD COLUMN site TEXT") unless fields.any? { |c| c["name"] == "site" }
+          end
           # A server has one owner. One from before, with several, keeps the first and the rest become admins,
           # who can still do everything but remove the owner. Invites to join as an owner become invites as an admin.
           owners = db.all("SELECT id FROM rl_users WHERE role = 'owner' ORDER BY created_at, id")
@@ -467,6 +474,7 @@ module Runlight
           "email" => r["email"].to_s,
           "hash" => r["hash"].to_s,
           "role" => self.class.role_from(r["role"]),
+          **(r["site"].nil? ? {} : { "site" => r["site"].to_s }),
           "createdAt" => Js.number(r["created_at"]),
           "twoFactor" => Js.truthy?(r["totp_secret"]),
           "recoveryLeft" => recovery.length,
@@ -534,22 +542,24 @@ module Runlight
           "id" => r["id"].to_s,
           "email" => r["email"].to_s,
           "role" => self.class.role_from(r["role"]),
+          **(r["site"].nil? ? {} : { "site" => r["site"].to_s }),
           "invitedBy" => r["invited_by"].to_s,
           "createdAt" => Js.number(r["created_at"]),
           "expiresAt" => Js.number(r["expires_at"]),
         }
       end
 
-      def invite_now(email, role, invited_by, now)
+      def invite_now(email, role, invited_by, now, site = nil)
+        raise AccountError.new("Choose member or viewer for one site", "role_scope") if !site.nil? && (site.empty? || !%w[member viewer].include?(role))
         address = Js.lower(Js.trim(email))
         raise AccountError.new("Enter an email address", "email_invalid") unless address.match?(EMAIL)
         raise AccountError.new("#{address} already has an account", "account_exists", { "email" => address }) unless by_email(address).nil?
 
         code = Crypto.base64url(Crypto.random_bytes(24))
-        invite = { "id" => Crypto.hex(Crypto.random_bytes(12)), "email" => address, "role" => role, "invitedBy" => invited_by, "createdAt" => now,
+        invite = { **(site.nil? ? {} : { "site" => site }), "id" => Crypto.hex(Crypto.random_bytes(12)), "email" => address, "role" => role, "invitedBy" => invited_by, "createdAt" => now,
                    "expiresAt" => now + INVITE_MS }
         @store.db.run("DELETE FROM rl_invites WHERE email = ?", [address])
-        @store.db.run("INSERT INTO rl_invites (id, email, role, code_hash, invited_by, created_at, expires_at) VALUES (?, ?, ?, ?, ?, ?, ?)", [
+        @store.db.run("INSERT INTO rl_invites (id, email, role, code_hash, invited_by, created_at, expires_at, site) VALUES (?, ?, ?, ?, ?, ?, ?, ?)", [
           invite["id"],
           invite["email"],
           invite["role"],
@@ -557,6 +567,7 @@ module Runlight
           invite["invitedBy"],
           invite["createdAt"],
           invite["expiresAt"],
+          site,
         ])
         { "invite" => invite, "code" => code }
       end

data/lib/runlight/accounts/pages.rb

@@ -37,6 +37,14 @@ module Runlight
         .theme:hover { color: var(--ink); }
         .theme svg { width: 16px; height: 16px; fill: none; stroke: currentColor; stroke-width: 1.5; stroke-linecap: round; stroke-linejoin: round; }
         .theme svg:not(.on) { display: none; }
+        .strength { display: flex; align-items: center; gap: 10px; margin-top: 8px; font-size: 12px; color: var(--muted); }
+        .strength[hidden] { display: none; }
+        .strength-bar { display: grid; grid-template-columns: repeat(4, 1fr); gap: 4px; width: 120px; }
+        .strength-bar span { height: 4px; border-radius: 2px; background: var(--line); }
+        .strength[data-score="0"] .strength-label, .strength[data-score="1"] .strength-label { color: var(--bad); }
+        .strength[data-score="1"] .on { background: var(--bad); }
+        .strength[data-score="2"] .on { background: #b7791f; }
+        .strength[data-score="3"] .on, .strength[data-score="4"] .on { background: #22a065; }
         .secret { position: relative; display: block; margin-top: 6px; }
         .secret input { margin-top: 0; padding-right: 44px; }
         .eye { position: absolute; top: 50%; right: 5px; display: grid; place-items: center; width: 32px; height: 30px; margin: 0; padding: 0; border: 0; border-radius: 6px; background: none; color: var(--muted); transform: translateY(-50%); cursor: pointer; }
@@ -48,6 +56,37 @@ module Runlight
       # Applies the saved theme before the page paints, then runs the switch and Cmd+Shift+D (Ctrl+Shift+D).
       AUTH_JS = <<~'JS'.chomp
         (() => {
+          const COMMON = ["password", "passw0rd", "123456", "qwerty", "azerty", "letmein", "welcome", "admin", "runlight", "iloveyou", "abc123", "monkey", "dragon", "football", "baseball", "sunshine", "princess", "shadow", "master"];
+          function strength(password, avoid = []) {
+            if (password.length < 10) return 0;
+            let pool = 0;
+            if (/[a-z]/.test(password)) pool += 26;
+            if (/[A-Z]/.test(password)) pool += 26;
+            if (/[0-9]/.test(password)) pool += 10;
+            if (/[^A-Za-z0-9]/.test(password)) pool += 33;
+            // Each character only counts once it adds something new: a pattern repeating ("abab", "Aa1!Aa1!",
+            // "aaaa") adds nothing, and a doubled letter or a run like "abc" adds little.
+            let effective = 0;
+            for (let i = 0; i < password.length; i++) {
+              const c = password.charCodeAt(i);
+              const prev = password.charCodeAt(i - 1);
+              let pattern = false;
+              for (let k = 1; k <= 4 && !pattern; k++) pattern = i - 1 - k >= 0 && password[i] === password[i - k] && password[i - 1] === password[i - 1 - k];
+              const repeat = i > 0 && c === prev;
+              const run = i > 1 && c - prev === prev - password.charCodeAt(i - 2) && Math.abs(c - prev) === 1;
+              effective += pattern ? 0 : repeat || run ? 0.25 : 1;
+            }
+            let bits = effective * Math.log2(Math.max(pool, 10));
+            const lower = password.toLowerCase();
+            for (const word of [...COMMON, ...avoid.map((a) => a.toLowerCase()).filter((a) => a.length >= 3)]) {
+              // Every time it appears, so "jonjonjon" costs three times.
+              bits -= (lower.split(word).length - 1) * word.length * 3;
+            }
+            if (bits < 40) return 1;
+            if (bits < 60) return 2;
+            if (bits < 80) return 3;
+            return 4;
+          }
           const KEY = "runlight_theme";
           const root = document.documentElement;
           const read = () => { try { const v = localStorage.getItem(KEY); return v === "dark" || v === "system" ? v : "light"; } catch { return "light"; } };
@@ -85,6 +124,30 @@ module Runlight
               eye.addEventListener("click", () => set(input.type === "password"));
               wrap.append(eye);
             }
+            const password = document.querySelector('input[name="password"][autocomplete="new-password"]');
+            if (password) {
+              const meter = document.createElement("span");
+              meter.className = "strength";
+              meter.id = "password-strength";
+              meter.setAttribute("aria-live", "polite");
+              meter.innerHTML = '<span class="strength-bar" aria-hidden="true"><span></span><span></span><span></span><span></span></span><span class="strength-label"></span>';
+              password.closest(".secret").after(meter);
+              password.setAttribute("aria-describedby", meter.id);
+              const email = document.querySelector('input[name="email"]');
+              const update = () => {
+                const address = email?.value || "";
+                const score = strength(password.value, [address, address.split("@")[0]]);
+                meter.hidden = !password.value;
+                meter.dataset.score = String(score);
+                meter.querySelector(".strength-label").textContent = ["Too short", "Weak", "Fair", "Good", "Strong"][score];
+                meter.querySelectorAll(".strength-bar span").forEach((bar, i) => bar.classList.toggle("on", score > i));
+              };
+              password.addEventListener("input", update);
+              password.addEventListener("change", update);
+              email?.addEventListener("input", update);
+              window.addEventListener("pageshow", update);
+              update();
+            }
             show();
             document.querySelector(".theme")?.addEventListener("click", () => set({ light: "dark", dark: "system", system: "light" }[read()]));
           });
@@ -178,7 +241,8 @@ module Runlight
       end
 
       # What someone invited with a role can do, after "as".
-      def role_text(role)
+      def role_text(role, site = nil)
+        return role == "viewer" ? "a viewer, who can read the stats for #{site} only" : "a member, who can change the settings of #{site} only" unless site.nil?
         return "a viewer, who can read every site's stats" if role == "viewer"
         return "a member, who can change the settings of every site" if role == "member"
 
@@ -190,7 +254,7 @@ module Runlight
         b = esc(base)
         page(base, "Join Runlight", <<~HTML.chomp)
           <h1>Join Runlight</h1>
-          <p>You were invited to #{esc(opts["host"])} as #{role_text(opts["role"])}. Choose a password to finish.</p>
+          <p>You were invited to #{esc(opts["host"])} as #{esc(role_text(opts["role"], opts["site"]))}. Choose a password to finish.</p>
           #{error(opts["error"])}
           <form method="post" action="#{b}/invite">
           <input type="hidden" name="code" value="#{esc(opts["code"])}">
@@ -221,7 +285,7 @@ module Runlight
                 end
         page(base, "Create your account", <<~HTML.chomp)
           <h1>Create your account</h1>
-          <p>This account owns the dashboard. You can invite more people later in Settings, People.</p>
+          <p>This account owns the dashboard. You can invite more people later in Settings, Team Members.</p>
           #{error(opts["error"])}
           <form method="post" action="#{b}/setup">
           #{field}

data/lib/runlight/accounts/web.rb

@@ -120,7 +120,9 @@ module Runlight
       # Notes who made a token. A viewer makes no tokens; someone removed or made a viewer since allowing an app
       # gets none for it, and false takes the token back.
       def token_made(token, by)
-        role = @accounts.by_id(by)&.fetch("role", nil)
+        user = @accounts.by_id(by)
+        return false if user.nil? || !user["site"].nil?
+        role = user["role"]
         return false if role.nil? || role == "viewer"
 
         @store.set_setting("#{MADE_BY}#{token["id"]}", by)
@@ -148,6 +150,14 @@ module Runlight
         nil
       end
 
+      def confirm_password(request)
+        user = signed_in(request)
+        return coded("Sign in first", "sign_in", 401) if user.nil?
+        input = body(request)
+        return coded("Send JSON", "send_json", 415) if input.nil?
+        recheck(user, input, "password", ["Your password is not right", "password_wrong"])
+      end
+
       private
 
       def now
@@ -202,11 +212,11 @@ module Runlight
       end
 
       def person(u)
-        { "id" => u["id"], "email" => u["email"], "role" => u["role"], "createdAt" => u["createdAt"], "twoFactor" => u["twoFactor"], "recoveryLeft" => u["recoveryLeft"] }
+        { **(u["site"].nil? ? {} : { "site" => u["site"] }), "id" => u["id"], "email" => u["email"], "role" => u["role"], "createdAt" => u["createdAt"], "twoFactor" => u["twoFactor"], "recoveryLeft" => u["recoveryLeft"] }
       end
 
       def invite_view(i)
-        { "id" => i["id"], "email" => i["email"], "role" => i["role"], "invitedBy" => i["invitedBy"], "createdAt" => i["createdAt"], "expiresAt" => i["expiresAt"] }
+        { **(i["site"].nil? ? {} : { "site" => i["site"] }), "id" => i["id"], "email" => i["email"], "role" => i["role"], "invitedBy" => i["invitedBy"], "createdAt" => i["createdAt"], "expiresAt" => i["expiresAt"] }
       end
 
       # The media type of a request's body, as a cross-site form cannot send application/json.
@@ -270,7 +280,7 @@ module Runlight
         origin = home_origin || Http::Url.new(request.url).origin
         link = "#{origin}#{@base}/invite?code=#{code}"
         host = Http::Url.new(origin).host
-        what = Pages.role_text(invite["role"])
+        what = Pages.role_text(invite["role"], invite["site"])
         return { "link" => link, "emailed" => false } unless @rl.mail_settings
 
         begin
@@ -278,8 +288,8 @@ module Runlight
             "to" => invite["email"],
             "subject" => "#{invite["invitedBy"]} invited you to Runlight",
             "text" => "#{invite["invitedBy"]} invited you to the Runlight at #{host} as #{what}.\n\nChoose a password to join:\n#{link}\n\nThe link works for seven days.\n",
-            "html" => "<div style=\"font:15px/1.6 -apple-system,BlinkMacSystemFont,'Segoe UI',Helvetica,Arial,sans-serif;color:#111827;max-width:480px\"><p>" \
-                      "#{esc(invite["invitedBy"])} invited you to the Runlight at #{esc(host)} as #{what}.</p><p><a href=\"#{esc(link)}\" " \
+            "html" => "<div style=\"font:15px/1.6 -apple-system,BlinkMacSystemFont,'Segoe UI',Helvetica,Arial,sans-serif;color:#111827;max-width:480px\"><img src=\"https://runlight.sh/icon-192.png\" width=\"48\" height=\"48\" alt=\"Runlight\" style=\"display:block;width:48px;height:48px;margin-bottom:24px;border:0;border-radius:10px\"><p>" \
+                      "#{esc(invite["invitedBy"])} invited you to the Runlight at #{esc(host)} as #{esc(what)}.</p><p><a href=\"#{esc(link)}\" " \
                       "style=\"display:inline-block;padding:10px 18px;border-radius:8px;background:#111827;color:#ffffff;text-decoration:none;font-weight:600\">" \
                       "Choose a password and join</a></p><p style=\"color:#6b7280;font-size:13px\">The link works for seven days. If you were not expecting this, " \
                       "you can ignore it.</p></div>",
@@ -316,7 +326,7 @@ module Runlight
           "subject" => "Sign in to Runlight",
           "text" => "Someone, most likely you, signed in to Runlight at #{host} with your password while your account was held up by too many failed tries.\n\n" \
                     "Sign in with this link within fifteen minutes:\n#{link}\n\nIf this was not you, change your password, since someone knows it.\n",
-          "html" => "<div style=\"font:15px/1.6 -apple-system,BlinkMacSystemFont,'Segoe UI',Helvetica,Arial,sans-serif;color:#111827;max-width:480px\">" \
+          "html" => "<div style=\"font:15px/1.6 -apple-system,BlinkMacSystemFont,'Segoe UI',Helvetica,Arial,sans-serif;color:#111827;max-width:480px\"><img src=\"https://runlight.sh/icon-192.png\" width=\"48\" height=\"48\" alt=\"Runlight\" style=\"display:block;width:48px;height:48px;margin-bottom:24px;border:0;border-radius:10px\">" \
                     "<p>Someone, most likely you, signed in to Runlight at #{esc(host)} with your password while your account was held up by too many failed tries.</p>" \
                     "<p><a href=\"#{esc(link)}\" style=\"display:inline-block;padding:10px 18px;border-radius:8px;background:#111827;color:#ffffff;" \
                     "text-decoration:none;font-weight:600\">Sign in</a></p><p style=\"color:#6b7280;font-size:13px\">The link works for fifteen minutes. " \
@@ -424,7 +434,7 @@ module Runlight
             invite = @accounts.invite_by_code(code, now)
             return html(Pages.invite_gone_page(base), 410) if invite.nil?
 
-            return html(Pages.invite_page(base, { "code" => code, "email" => invite["email"], "role" => invite["role"], "host" => url.host }))
+            return html(Pages.invite_page(base, { "code" => code, "email" => invite["email"], "role" => invite["role"], "site" => invite["site"], "host" => url.host }))
           end
           if method == "POST"
             form = Http::SearchParams.new(request.text)
@@ -433,7 +443,7 @@ module Runlight
             return html(Pages.invite_gone_page(base), 410) if invite.nil?
 
             again = lambda do |error|
-              html(Pages.invite_page(base, { "code" => code, "email" => invite["email"], "role" => invite["role"], "host" => url.host, "error" => error }), 400)
+              html(Pages.invite_page(base, { "code" => code, "email" => invite["email"], "role" => invite["role"], "site" => invite["site"], "host" => url.host, "error" => error }), 400)
             end
             return again.call("The two passwords are not the same.") if (form.get("password") || "") != (form.get("again") || "")
 
@@ -510,6 +520,21 @@ module Runlight
         html(login_page.call({ "error" => e.message, "email" => email }), 503, { "retry-after" => "5" })
       end
 
+      def recheck(user, input, name, wrong)
+        return coded("Too many tries. Wait fifteen minutes and try again.", "too_many_tries", 429) unless @rechecks.take(user["id"], now)
+        begin
+          right = @accounts.sign_in(user["email"], field(input, name))
+        rescue AccountError => e
+          raise unless e.code == "busy"
+
+          return coded("Runlight is busy checking other sign-ins. Try again in a moment.", "busy", 503)
+        end
+        return coded(wrong[0], wrong[1], 400) if right.nil?
+
+        @rechecks.forgive(user["id"], now)
+        nil
+      end
+
       # Your own account, and for the owner and admins, everyone else's.
       def api(request, path)
         user = signed_in(request)
@@ -522,26 +547,12 @@ module Runlight
         return coded("Send JSON", "send_json", 415) if method == "POST" && media_type(request) != "application/json"
         return reply({ "account" => person(user) }) if path == "/api/account" && method == "GET"
 
-        recheck = lambda do |input, name, wrong|
-          return coded("Too many tries. Wait fifteen minutes and try again.", "too_many_tries", 429) unless @rechecks.take(user["id"], now)
-          begin
-            right = @accounts.sign_in(user["email"], field(input, name))
-          rescue AccountError => e
-            raise unless e.code == "busy"
-
-            return coded("Runlight is busy checking other sign-ins. Try again in a moment.", "busy", 503)
-          end
-          return coded(wrong[0], wrong[1], 400) if right.nil?
-
-          @rechecks.forgive(user["id"], now)
-          nil
-        end
         fresh = ->(updated) { { "set-cookie" => session_cookie(request, @accounts.session_for(updated, now), Accounts::SESSION_MS / 1000) } }
         if path == "/api/account/password" && method == "POST"
           input = body(request)
           return coded("Send JSON", "send_json", 415) if input.nil?
 
-          refused = recheck.call(input, "current", ["Your current password is not right", "password_current_wrong"])
+          refused = recheck(user, input, "current", ["Your current password is not right", "password_current_wrong"])
           return refused unless refused.nil?
 
           begin
@@ -573,7 +584,7 @@ module Runlight
             updated = @accounts.by_id(user["id"])
             return reply({ "recovery" => codes }, 200, fresh.call(updated))
           end
-          refused = recheck.call(input, "password", ["Your password is not right", "password_wrong"])
+          refused = recheck(user, input, "password", ["Your password is not right", "password_wrong"])
           return refused unless refused.nil?
 
           if action == "/start"
@@ -594,7 +605,7 @@ module Runlight
           end
           return coded("Not found", "not_found", 404)
         end
-        return coded("Only the owner or an admin can manage people", "people_owner", 403) if user["role"] != "owner" && user["role"] != "admin"
+        return coded("Only the owner or an admin can manage people", "people_owner", 403) if !user["site"].nil? || (user["role"] != "owner" && user["role"] != "admin")
 
         # The owner or an admin can turn off someone else's two-factor, for a coworker who lost both phone and recovery
         # codes, though never the owner's. It asks for their password like every other two-factor change, and their own
@@ -605,7 +616,7 @@ module Runlight
           input = body(request)
           return coded("Send JSON", "send_json", 415) if input.nil?
 
-          refused = recheck.call(input, "password", ["Your password is not right", "password_wrong"])
+          refused = recheck(user, input, "password", ["Your password is not right", "password_wrong"])
           return refused unless refused.nil?
 
           target = @accounts.by_id(reset[1])
@@ -622,7 +633,7 @@ module Runlight
           input = body(request)
           return coded("Send JSON", "send_json", 415) if input.nil?
 
-          refused = recheck.call(input, "password", ["Your password is not right", "password_wrong"])
+          refused = recheck(user, input, "password", ["Your password is not right", "password_wrong"])
           return refused unless refused.nil?
 
           begin
@@ -648,7 +659,11 @@ module Runlight
           return coded("#{email} already has an account", "account_exists", 409, { "email" => email }) unless @accounts.by_email(email).nil?
 
           begin
-            made = @accounts.invite(email, role, user["email"], now)
+            @rl.init
+            site = input["allSites"] == true ? nil : input["site"]
+            return coded("Choose a site or explicitly invite to all sites", "invite_site", 400) if input["allSites"] != true && (!site.is_a?(String) || site.empty?)
+            return coded("Unknown site", "unknown_site", 404) if !site.nil? && @rl.site(site).nil?
+            made = @accounts.invite(email, role, user["email"], now, site)
             return reply({ "invite" => invite_view(made["invite"]) }.merge(send_invite(request, made["invite"], made["code"])), 201)
           rescue AccountError => e
             return coded(e.message, e.code, 400, e.params)
@@ -664,7 +679,7 @@ module Runlight
             return coded("Unknown invite", "unknown_invite", 404) if old.nil?
 
             # A new link replaces the old one, which stops working.
-            made = @accounts.invite(old["email"], old["role"], user["email"], now)
+            made = @accounts.invite(old["email"], old["role"], user["email"], now, old["site"])
             return reply({ "invite" => invite_view(made["invite"]) }.merge(send_invite(request, made["invite"], made["code"])))
           end
         end

data/lib/runlight/assistant.rb

@@ -203,7 +203,7 @@ module Runlight
       end
 
       if provider["protocol"] == "anthropic"
-        tools = Mcp.tools.map { |t| { "name" => t["name"], "description" => t["description"], "input_schema" => t["inputSchema"] } }
+        tools = (Mcp.tools + [Json.decode(File.read(File.expand_path("../../assets/assistant-action.json", __dir__)))]).map { |t| { "name" => t["name"], "description" => t["description"], "input_schema" => t["inputSchema"] } }
         convo = history.dup
         MAX_ROUNDS.times do
           data = post(
@@ -238,6 +238,7 @@ module Runlight
             name = Js.get(call, "name")
             name = "" if name.nil? || name.equal?(UNDEFINED)
             used << name
+            return { "reply" => "", "tools" => used[0...-1], "action" => Js.get(call, "input") } if name == "prepare_action"
             out = tool_text(name, Js.get(call, "input"), read_api)
             result = { "type" => "tool_result", "tool_use_id" => Js.get(call, "id"), "content" => out["text"] }
             result["is_error"] = true if out["error"]
@@ -248,7 +249,7 @@ module Runlight
         raise AssistantError.new("The assistant needed too many steps for that question. Try asking something narrower.", "assistant_steps")
       end
 
-      tools = Mcp.tools.map { |t| { "type" => "function", "function" => { "name" => t["name"], "description" => t["description"], "parameters" => t["inputSchema"] } } }
+      tools = (Mcp.tools + [Json.decode(File.read(File.expand_path("../../assets/assistant-action.json", __dir__)))]).map { |t| { "type" => "function", "function" => { "name" => t["name"], "description" => t["description"], "parameters" => t["inputSchema"] } } }
       convo = [{ "role" => "system", "content" => system_prompt(context) }, *history]
       headers = key == "" ? {} : { "authorization" => "Bearer #{key}" }
       MAX_ROUNDS.times do
@@ -274,6 +275,7 @@ module Runlight
           given = Js.get(function, "arguments")
           parsed, args = Js.parse_json(Js.truthy?(given) ? Js.string(given) : "{}")
           args = {} unless parsed
+          return { "reply" => "", "tools" => used[0...-1], "action" => args } if name == "prepare_action"
           out = tool_text(name, args, read_api)
           convo << { "role" => "tool", "tool_call_id" => Js.get(call, "id"), "content" => out["text"] }
         end

data/lib/runlight/core.rb

@@ -1451,11 +1451,7 @@ module Runlight
       Accounts::Throttle.sweep(@store, now)
       # Every site's retention covers any one site's that is still waiting.
       @pruning = []
-      begin
-        apply_retention
-      rescue StandardError => e
-        warn("Runlight: could not apply retention #{e.message}")
-      end
+      apply_retention
       if now - @optimized_at >= 86_400_000
         @optimized_at = now
         @store.optimize

data/lib/runlight/reports.rb

@@ -183,12 +183,7 @@ module Runlight
       u = Http::Url.parse(links["dashboard"])
       where = u.nil? ? links["dashboard"] : u.host + u.pathname.sub(%r{/\z}, "")
       at = t.call("email.at", { "where" => where })
-      # The Runlight mark in table cells: mail apps block SVG and most inline images.
-      mark = <<~HTML.chomp
-        <table role="presentation" cellpadding="0" cellspacing="0" style="border-collapse:collapse"><tr>
-        <td class="rl-mark" width="24" height="24" align="center" style="width:24px;height:24px;background:#111827;border-radius:7px;color:#ffffff;font-size:15px;font-weight:700;line-height:24px;text-align:center;font-family:#{font}">R</td>
-        <td class="rl-ink" style="padding-left:8px;font-size:15px;font-weight:700;color:#111827;font-family:#{font}">Runlight</td></tr></table>
-      HTML
+      mark = "<img src=\"https://runlight.sh/icon-192.png\" width=\"48\" height=\"48\" alt=\"Runlight\" style=\"display:block;width:48px;height:48px;margin-bottom:24px;border:0;border-radius:10px\">"
 
       footer = t.call("email.footer", { "frequency" => t.call(monthly ? "email.monthly" : "email.weekly"), "site" => site["name"] })
       at_line = esc(t.call("email.at", { "where" => "\0" }))

data/lib/runlight/routes.rb

@@ -600,6 +600,10 @@ module Runlight
     end
 
     # Whether this request acts as the owner. "read" is someone signed in who may only read, such as a viewer.
+    def session_scope(request)
+      @web.signed_in(request) if @web
+    end
+
     def can_read(request)
       return true if @managed.key?(request)
 
@@ -609,6 +613,8 @@ module Runlight
         given = bearer(request)
         return true if authorize.nil? && !@token.nil? && @token != "" && given != "" && constant_time_equal(given, @token)
 
+        scoped = session_scope(request)
+        return false if scoped && !scoped["site"].nil? && Http::Url.new(request.url).pathname.delete_prefix(@base).start_with?("/oauth/")
         answer = authorize.nil? ? @web.access(request) : authorize.call(request)
         # A member changes things like an owner, apart from the few controls admin_only? names.
         @members[request] = true if answer == "member"
@@ -1248,7 +1254,7 @@ module Runlight
             "to" => to,
             "subject" => t.call("email.test.subject"),
             "text" => t.call("email.test.body", { "service" => name }),
-            "html" => "<p style=\"font-family:sans-serif;font-size:15px\">#{escape_html(t.call("email.test.body", { "service" => name }))}</p>",
+            "html" => "<img src=\"https://runlight.sh/icon-192.png\" width=\"48\" height=\"48\" alt=\"Runlight\" style=\"display:block;width:48px;height:48px;margin-bottom:24px;border:0;border-radius:10px\"><p style=\"font-family:sans-serif;font-size:15px\">#{escape_html(t.call("email.test.body", { "service" => name }))}</p>",
           })
           return json({ "ok" => true })
         end
@@ -1535,6 +1541,27 @@ module Runlight
     def api(request, path, url)
       rl = @rl
       method = request.method
+      scoped = session_scope(request)
+      if scoped && !scoped["site"].nil?
+        rl.init
+        site = scoped["site"]
+        return coded("Unknown site", "unknown_site", 404) if rl.site(site).nil?
+        asked = url.search_params.get("site")
+        site_path = path.match(%r{\A/api/sites/([^/]+)\z})
+        return coded("Unknown site", "unknown_site", 404) if (!asked.nil? && asked != site) || (site_path && decode_part(site_path[1]) != site)
+        read = method == "GET" && shared_path?(path)
+        assistant = (path == "/api/assistant" && method == "GET") || (path == "/api/assistant/chat" && method == "POST")
+        manage = scoped["role"] == "member" && manage_path(method, path)
+        return coded("Your account only has access to its assigned site", "site_access", 403) unless read || assistant || manage
+        if path == "/api/assistant/chat"
+          parsed, body = Js.parse_json(request.text)
+          return coded("Unknown site", "unknown_site", 404) unless parsed && Js.object?(body) && Js.get(body, "site") == site
+        end
+        url = Http::Url.new(url.href)
+        query = url.search_params
+        query.set("site", site)
+        url.search_params = query
+      end
       # An embedded dashboard reads what a share link shows and nothing else, whoever else the request comes from.
       if !request.headers.get(EMBED_HEADER).nil? && !(method == "GET" && shared_path?(path))
         return coded("Not available on a shared dashboard", "share_not_available", 403)
@@ -1987,6 +2014,10 @@ module Runlight
         id = decode_part(site_match[1])
         return coded("Unknown site", "unknown_site", 404) if id.nil?
 
+        if @web && session_scope(request)
+          refused = @web.confirm_password(request)
+          return refused unless refused.nil?
+        end
         begin
           rl.delete_site(id)
           return json({ "ok" => true })
@@ -2209,7 +2240,8 @@ module Runlight
       share_id = request.headers.get(SHARE_HEADER)
       shared = nil
       # The one site a share or a site's API token may read; nil for every site.
-      only = nil
+      scoped = session_scope(request)
+      only = scoped && scoped["site"]
       embed = request.headers.get(EMBED_HEADER)
       if share_id.nil? && !embed.nil?
         token = embed_reader(embed)
@@ -2225,7 +2257,7 @@ module Runlight
         if access != true
           return coded("API tokens can only read", "token_read_only", 403) unless shared_path?(path)
 
-          only = access["site"] != "" ? access["site"] : nil
+          only = scoped && scoped["site"] || (access["site"] != "" ? access["site"] : nil)
         end
       else
         shared = share_id.match?(SHARE_ID) ? store.share_by_id(share_id) : nil
@@ -2259,7 +2291,7 @@ module Runlight
           row
         end
         # A share never learns how the install is run.
-        return json(shared.nil? ? { "sites" => rows, "managed" => rl.managed_sites } : { "sites" => rows })
+        return json(shared.nil? ? { "sites" => rows, "managed" => !(scoped && scoped["site"]) && rl.managed_sites } : { "sites" => rows })
       end
 
       site = if !shared.nil?

data/lib/runlight/store/sql_store.rb

@@ -1295,7 +1295,7 @@ module Runlight
         )
         sources = @db.all(
           "SELECT s.source AS value, COUNT(DISTINCT e.visitor) AS visitors FROM rl_events e JOIN rl_sessions s ON s.id = e.session
-       WHERE e.site = ? AND e.ts >= ? AND e.kind IN ('pageview', 'event') AND s.source <> ''
+       WHERE e.site = ? AND e.ts >= ? AND e.kind IN ('pageview', 'event')
        GROUP BY s.source ORDER BY visitors DESC, s.source#{text_order} LIMIT 10",
           [site, since],
         )