runlight 0.1.6 → 0.1.8

data/lib/runlight/oauth.rb

@@ -54,16 +54,29 @@ module Runlight
       base64url(OpenSSL::Digest::SHA256.digest(verifier))
     end
 
-    # The key a CMS plugin reports AI agents reading a site's pages with: made on first ask, or a new one that replaces it.
+    # The key a CMS plugin reports AI agents reading a site's pages with: made on first ask, or a new one that
+    # replaces it. It is kept sealed with the server's secret, as the mail service's keys are, so a copied
+    # database alone cannot report for the site; one kept before as plain text is sealed the next time it is read.
     def agents_key(runlight, site, replace = false)
       name = "observe-key:#{site}"
-      return runlight.store.setting_or_add(name) { "rlo_#{Hashing.random_id(20)}" } unless replace
-
+      unless replace
+        made = Mail::Secret.seal("rlo_#{Hashing.random_id(20)}", runlight.secret)
+        stored = runlight.store.setting_or_add(name) { made }
+        key = open_agents_key(runlight, stored)
+        runlight.store.set_setting(name, Mail::Secret.seal(key, runlight.secret)) if key && stored.start_with?("rlo_")
+        # One sealed under a secret the server no longer has cannot be shown or checked, so it is replaced.
+        return key if key
+      end
       key = "rlo_#{Hashing.random_id(20)}"
-      runlight.store.set_setting(name, key)
+      runlight.store.set_setting(name, Mail::Secret.seal(key, runlight.secret))
       key
     end
 
+    # A site's agents key as kept in its setting: sealed, or plain text from before keys were sealed. Nil when it cannot be opened.
+    def open_agents_key(runlight, stored)
+      stored.start_with?("rlo_") ? stored : Mail::Secret.unseal(stored, runlight.secret)
+    end
+
     # The URL that a 401 from the MCP endpoint points clients at, to start OAuth.
     def resource_metadata_url(origin, base)
       "#{origin}#{base}/.well-known/oauth-protected-resource"
@@ -120,13 +133,17 @@ module Runlight
 
       if path == "/oauth/authorize" && (request.method == "GET" || request.method == "POST")
         runlight.init
+        translator = Messages.translator(Messages.accepted_language(request))
+        h = translator["html"]
+        lang = translator["lang"]
+        page = ->(title, body, status = 200) { page_in(lang, title, body, status) }
         form = request.method == "POST" ? Http::SearchParams.new(request.text) : url.search_params
         client_id = form.get("client_id") || ""
         client = client_for(runlight, client_id)&.fetch("client", nil)
         redirect = form.get("redirect_uri") || ""
         # Without a known client and one of its own addresses there is nowhere safe to send an answer.
         if client.nil? || !Array(client["redirects"]).include?(redirect)
-          return page("This app is not registered", "<p>Start connecting again from the app.</p>", 400)
+          return page.call(h.call("oauth.unregisteredTitle"), "<p>#{h.call("oauth.startAgain")}</p>", 400)
         end
 
         back = lambda do |params|
@@ -144,8 +161,8 @@ module Runlight
           if client.key?("usedAt") && Js.truthy?(client["usedAt"])
             back.call(params)
           else
-            page("This app asked in a way Runlight does not support",
-                 "<p>#{esc(client["name"].to_s)} sent #{esc(params["error_description"] || params["error"])}. Start connecting again from the app.</p>", 400)
+            page.call(h.call("oauth.unsupportedTitle"),
+                      "<p>#{h.call("oauth.unsupported", { "app" => esc(client["name"].to_s), "error" => esc(params["error_description"] || params["error"]) })}</p>", 400)
           end
         end
         return refuse.call({ "error" => "unsupported_response_type" }) if form.get("response_type") != "code"
@@ -168,7 +185,7 @@ module Runlight
         unless ctx["isOwner"].call(request)
           # Someone signed in who may only read would be sent to sign in again and again.
           if ctx["isReader"]&.call(request)
-            return page("Ask an owner to connect this", "<p>You are signed in as a viewer, and only an owner of this Runlight can connect #{esc(name)}.</p>", 403)
+            return page.call(h.call("oauth.viewerTitle"), "<p>#{h.call("oauth.viewer", { "app" => esc(name) })}</p>", 403)
           end
 
           # The site stays, since on the way in it only says which one to offer first.
@@ -180,7 +197,8 @@ module Runlight
           end
 
           home = base == "" ? "/" : base
-          return page("Sign in first", "<p>Open your Runlight dashboard at <a href=\"#{esc(home)}\">#{esc("#{url.host}#{home}")}</a> and sign in, then connect #{esc(name)} again.</p>", 401)
+          return page.call(h.call("oauth.signInTitle"),
+                           "<p>#{h.call("oauth.signIn", { "link" => "<a href=\"#{esc(home)}\">#{esc("#{url.host}#{home}")}</a>", "app" => esc(name) })}</p>", 401)
         end
 
         if request.method == "GET"
@@ -189,26 +207,27 @@ module Runlight
             hidden << "<input type=\"hidden\" name=\"#{k}\" value=\"#{esc(form.get(k))}\">" unless form.get(k).nil?
           end
           # The app names itself, so the page also shows where the answer goes, which it cannot fake.
-          sends_to = "<p class=\"note\">Allowing sends you back to <strong>#{esc(Http::Url.new(redirect).host)}</strong>. Only allow it if you started connecting there.</p>"
+          sends_to = "<p class=\"note\">#{h.call("oauth.sendsTo", { "host" => "<strong>#{esc(Http::Url.new(redirect).host)}</strong>" })}</p>"
+          buttons = "<div class=\"buttons\"><button type=\"submit\" name=\"decision\" value=\"deny\" class=\"ghost\">#{h.call("oauth.deny")}</button>" \
+                    "<button type=\"submit\" name=\"decision\" value=\"allow\">#{h.call("oauth.allow")}</button></div></form>"
           if cms
             if counting.empty? && !runlight.managed_sites
-              return page("Add this site first",
-                          "<p>No site in this Runlight counts <strong>#{esc(host)}</strong>. Add it to a site's domains in your code, then connect again from #{esc(name)}.</p>", 400)
+              return page.call(h.call("oauth.addSiteTitle"),
+                               "<p>#{h.call("oauth.addSite", { "host" => "<strong>#{esc(host)}</strong>", "app" => esc(name) })}</p>", 400)
             end
 
             choices = +""
             counting.each { |s| choices << "<option value=\"#{esc(s["id"])}\">#{esc(s["name"])}</option>" }
-            choices << "<option value=\"new\">A new site for #{esc(host)}</option>" if runlight.managed_sites && counting.empty?
-            return page(
-              "Connect #{esc(name)}",
-              "<p><strong>#{esc(name)}</strong> wants to count <strong>#{esc(host)}</strong> in this Runlight.</p>\n" \
-              "<p>It will get the site's agents key, to report AI agents such as ChatGPT and Claude reading its pages, and a dashboard key, to show the site's " \
-              "read-only dashboard in its admin pages. It cannot change anything here or read other sites.</p>\n" \
+            choices << "<option value=\"new\">#{h.call("oauth.newSite", { "host" => esc(host) })}</option>" if runlight.managed_sites && counting.empty?
+            return page.call(
+              h.call("oauth.connectTitle", { "app" => esc(name) }),
+              "<p>#{h.call("oauth.cmsIntro", { "app" => "<strong>#{esc(name)}</strong>", "host" => "<strong>#{esc(host)}</strong>" })}</p>\n" \
+              "<p>#{h.call("oauth.cmsDetail")}</p>\n" \
               "#{sends_to}\n" \
               "<form method=\"post\" action=\"#{esc(base)}/oauth/authorize\">#{hidden}\n" \
-              "<label>Site<select name=\"site\">#{choices}</select></label>\n" \
-              "<p class=\"note\">Its dashboard key appears in Settings, API and AI, where deleting it stops the dashboard in #{esc(name)}.</p>\n" \
-              '<div class="buttons"><button type="submit" name="decision" value="deny" class="ghost">Deny</button><button type="submit" name="decision" value="allow">Allow</button></div></form>',
+              "<label>#{h.call("app.site")}<select name=\"site\">#{choices}</select></label>\n" \
+              "<p class=\"note\">#{h.call("oauth.cmsNote", { "app" => esc(name) })}</p>\n" \
+              "#{buttons}",
             )
           end
           sites = runlight.sites
@@ -221,33 +240,32 @@ module Runlight
 
               choices << "<option value=\"#{esc(s["id"])}\"#{s["id"] == wanted ? " selected" : ""}>#{esc(s["name"])}</option>"
             end
-            return page(
-              "Connect #{esc(name)}",
-              "<p><strong>#{esc(name)}</strong> wants to show this site’s stats and change its settings, so you can manage it from there.</p>\n" \
-              "<p>It will be able to change goals, funnels, short links, link domains, email reports, and share links for the site you pick, along with its name, " \
-              "timezone, and retention. It cannot read other sites, add people, make tokens, or change how email is sent.</p>\n" \
+            return page.call(
+              h.call("oauth.connectTitle", { "app" => esc(name) }),
+              "<p>#{h.call("oauth.manageIntro", { "app" => "<strong>#{esc(name)}</strong>" })}</p>\n" \
+              "<p>#{h.call("oauth.manageDetail")}</p>\n" \
               "#{sends_to}\n" \
               "<form method=\"post\" action=\"#{esc(base)}/oauth/authorize\">#{hidden}\n" \
-              "<label>Site<select name=\"site\">#{choices}</select></label>\n" \
-              "<p class=\"note\">Its token appears in Settings, API and AI, where deleting it disconnects #{esc(name)}.</p>\n" \
-              '<div class="buttons"><button type="submit" name="decision" value="deny" class="ghost">Deny</button><button type="submit" name="decision" value="allow">Allow</button></div></form>',
+              "<label>#{h.call("app.site")}<select name=\"site\">#{choices}</select></label>\n" \
+              "<p class=\"note\">#{h.call("oauth.manageNote", { "app" => esc(name) })}</p>\n" \
+              "#{buttons}",
             )
           end
           options = +""
-          sites.each { |s| options << "<option value=\"#{esc(s["id"])}\">#{esc(s["name"])} only</option>" }
-          return page(
-            "Connect #{esc(name)}",
-            "<p><strong>#{esc(name)}</strong> wants to read your Runlight stats so it can answer questions about them. It will be able to read and never to change anything.</p>\n" \
+          sites.each { |s| options << "<option value=\"#{esc(s["id"])}\">#{h.call("oauth.siteOnly", { "site" => esc(s["name"]) })}</option>" }
+          return page.call(
+            h.call("oauth.connectTitle", { "app" => esc(name) }),
+            "<p>#{h.call("oauth.readIntro", { "app" => "<strong>#{esc(name)}</strong>" })}</p>\n" \
             "#{sends_to}\n" \
             "<form method=\"post\" action=\"#{esc(base)}/oauth/authorize\">#{hidden}\n" \
-            "<label>Which sites it can read<select name=\"site\"><option value=\"\">Every site</option>#{sites.length > 1 ? options : ""}</select></label>\n" \
-            "<p class=\"note\">Its token appears in Settings, API and AI, where deleting it disconnects the app.</p>\n" \
-            '<div class="buttons"><button type="submit" name="decision" value="deny" class="ghost">Deny</button><button type="submit" name="decision" value="allow">Allow</button></div></form>',
+            "<label>#{h.call("oauth.readSites")}<select name=\"site\"><option value=\"\">#{h.call("tokens.allSites")}</option>#{sites.length > 1 ? options : ""}</select></label>\n" \
+            "<p class=\"note\">#{h.call("oauth.readNote")}</p>\n" \
+            "#{buttons}",
           )
         end
         # The consent form posts here from this page only; a form from another site is refused.
         origin = request.headers.get("origin")
-        return page("This request came from another site", "<p>Start connecting again from the app.</p>", 403) if !origin.nil? && origin != "" && origin != url.origin
+        return page.call(h.call("oauth.anotherSiteTitle"), "<p>#{h.call("oauth.startAgain")}</p>", 403) if !origin.nil? && origin != "" && origin != url.origin
         return back.call({ "error" => "access_denied" }) if form.get("decision") != "allow"
 
         site = form.get("site") || ""
@@ -391,7 +409,7 @@ module Runlight
     end
 
     def json(body, status = 200)
-      Http::Response.new(Json.encode(body), status: status, headers: { "content-type" => "application/json; charset=utf-8", "cache-control" => "no-store" }.merge(CORS))
+      Http::Response.new(Json.encode(body), status: status, headers: { "content-type" => "application/json; charset=utf-8", "cache-control" => "no-store", "x-content-type-options" => "nosniff" }.merge(CORS))
     end
 
     def oauth_error(error, description, status = 400)
@@ -455,9 +473,10 @@ module Runlight
              "grant_types" => ["authorization_code"], "response_types" => ["code"] }, 201)
     end
 
-    def page(title, body, status = 200)
+    # A page in the visitor's language, with a title already written as HTML.
+    def page_in(lang, title, body, status = 200)
       Http::Response.new(
-        "<!doctype html><html lang=\"en\"><head><meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width,initial-scale=1\"><meta name=\"robots\" content=\"noindex\"><title>#{title} | Runlight</title>\n" \
+        "<!doctype html><html lang=\"#{lang}\"><head><meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width,initial-scale=1\"><meta name=\"robots\" content=\"noindex\"><title>#{title} | Runlight</title>\n" \
         '<style>:root{color-scheme:light dark;--page:#f4f4f5;--card:#fff;--ink:#111827;--muted:#4b5563;--line:#e5e7eb}@media (prefers-color-scheme:dark){:root{--page:#09090b;--card:#141417;--ink:#fafafa;--muted:#a1a1aa;--line:#27272a}}body{margin:0;min-height:100vh;display:grid;place-items:center;background:var(--page);color:var(--ink);font:16px/1.5 -apple-system,BlinkMacSystemFont,"Segoe UI",Helvetica,Arial,sans-serif}main{width:min(440px,calc(100% - 32px));padding:28px;background:var(--card);border:1px solid var(--line);border-radius:14px}h1{font-size:20px;margin:0 0 12px}p{margin:0 0 16px;color:var(--muted)}p strong{color:var(--ink)}a{color:inherit}label{display:block;margin:0 0 14px;font-size:13px;font-weight:600}select{display:block;width:100%;height:40px;margin-top:6px;padding:0 36px 0 12px;border:1px solid var(--line);border-radius:8px;background:var(--card) url("data:image/svg+xml,%3Csvg xmlns=\'http://www.w3.org/2000/svg\' viewBox=\'0 0 16 16\'%3E%3Cpath d=\'M4 6l4 4 4-4\' fill=\'none\' stroke=\'%238a8a93\' stroke-width=\'1.6\' stroke-linecap=\'round\' stroke-linejoin=\'round\'/%3E%3C/svg%3E") right 12px center/14px no-repeat;color:var(--ink);font:inherit;font-weight:400;appearance:none;cursor:pointer}.note{font-size:13px}.buttons{display:flex;justify-content:flex-end;gap:8px}button{height:40px;padding:0 18px;border:0;border-radius:8px;background:var(--ink);color:var(--card);font:inherit;font-weight:600;cursor:pointer}button.ghost{background:none;color:var(--ink);border:1px solid var(--line)}</style></head><body><main><h1>' \
         "#{title}</h1>#{body}</main></body></html>",
         status: status,
@@ -474,6 +493,6 @@ module Runlight
     end
 
     private_class_method :base64url, :from_base64url, :client_key, :client_for, :site_host, :constant_time_equal, :esc, :json, :oauth_error,
-                         :allowed_redirect, :json_form, :allow_registration, :register, :page
+                         :allowed_redirect, :json_form, :allow_registration, :register, :page_in
   end
 end

data/lib/runlight/routes.rb

@@ -279,15 +279,6 @@ module Runlight
         )
       end
 
-      # The first language a browser asks for that the dashboard speaks, else English.
-      def accepted_language(request)
-        (request.headers.get("accept-language") || "").split(",", -1).each do |part|
-          code = Js.lower(Js.slice(Js.trim(part.split(";", -1).first.to_s), 0, 2))
-          return code if Messages.languages.include?(code)
-        end
-        "en"
-      end
-
       # Rows of objects as CSV, with a column for every key the first row has, in the units a spreadsheet reads.
       def rows_csv(rows, sheet)
         readable = rows.map { |r| sheet_row(r, sheet) }
@@ -467,11 +458,12 @@ module Runlight
         out
       end
 
-      # `Math.min(1000, Math.max(1, Number(value) || fallback))`.
-      def limit(value, fallback)
+      # A whole number from a query, within 1 and `max`, or `fallback` for anything else: a fraction, a huge
+      # number, or text.
+      def whole_param(value, fallback, max)
         n = Js.number(value)
-        n = fallback if (n.is_a?(Float) && n.nan?) || n.zero?
-        [1000, [1, n].max].min
+        n = n.to_i if n.is_a?(Float) && n.finite? && n == n.floor
+        n.is_a?(Integer) && n.abs <= 9_007_199_254_740_991 && n >= 1 ? [n, max].min : fallback
       end
 
       # A number as a whole one for SQL, as PHP's (int) cast makes it.
@@ -1200,8 +1192,9 @@ module Runlight
                 fields[f["name"]] = value.nil? ? "" : Js.string(value)
               end
             end
-            # A hub with a manage token learns which service sends the reports and from where, nothing more.
-            via_manage = @managed.key?(request)
+            # A hub with a manage token, or an account kept to one site, learns which service sends the reports and
+            # from where, nothing more: a webhook's address is often its own credential.
+            via_manage = @managed.key?(request) || !session_scope(request)&.dig("site").nil?
             answer = {
               "source" => known["source"],
               "service" => known["source"] == "app" ? "" : known["service"] || "",
@@ -1244,6 +1237,12 @@ module Runlight
           settings = @rl.mail_settings
           return coded("Set up a mail service first", "mail_unset", 400) if settings.nil?
 
+          # One test a minute through each mail service, as samples are held, so the button cannot flood an inbox
+          # or use up a service's quota; one just set up can be tried at once.
+          tested = "test:#{settings["source"]}:#{settings["service"]}"
+          last = @lock.synchronize { @sample_sent[tested] || 0 }
+          return coded("A test went out a moment ago. Wait a minute and try again.", "test_soon", 429) if @rl.now - last < 60_000
+
           t = Messages.translator(text(body, "lang", "en"))["t"]
           name = if settings["source"] == "app"
                    settings["via"] || ""
@@ -1256,6 +1255,8 @@ module Runlight
             "text" => t.call("email.test.body", { "service" => name }),
             "html" => "<img src=\"https://runlight.sh/icon-192.png\" width=\"48\" height=\"48\" alt=\"Runlight\" style=\"display:block;width:48px;height:48px;margin-bottom:24px;border:0;border-radius:10px\"><p style=\"font-family:sans-serif;font-size:15px\">#{escape_html(t.call("email.test.body", { "service" => name }))}</p>",
           })
+          # Counted once it went out, so a test that failed can be tried again as soon as the setting is fixed.
+          @lock.synchronize { @sample_sent[tested] = @rl.now }
           return json({ "ok" => true })
         end
 
@@ -1557,6 +1558,12 @@ module Runlight
           parsed, body = Js.parse_json(request.text)
           return coded("Unknown site", "unknown_site", 404) unless parsed && Js.object?(body) && Js.get(body, "site") == site
         end
+        if site_path && json?(request)
+          # Where a site lives stays with whoever runs the install: an account kept to the site may rename it, as
+          # a hub may, never move it.
+          parsed, body = Js.parse_json(request.text)
+          return coded("Your account cannot change a site's domains", "site_domains", 403) if parsed && body.is_a?(Hash) && body.key?("hostnames")
+        end
         url = Http::Url.new(url.href)
         query = url.search_params
         query.set("site", site)
@@ -2020,6 +2027,8 @@ module Runlight
         end
         begin
           rl.delete_site(id)
+          # Those kept to the site go with it, so a site made later with the same id is not theirs.
+          @web.accounts.forget_site(id) if @web
           return json({ "ok" => true })
         rescue RangeError => e
           return e.message == "Unknown site" ? coded(e.message, "unknown_site", 404) : refused(e, "site_invalid")
@@ -2049,7 +2058,8 @@ module Runlight
         rl.init
         store.settings_starting_with("observe-key:").each do |row|
           id = row["key"].delete_prefix("observe-key:")
-          key_site = id if id != "" && !row["value"].nil? && constant_time_equal(given, row["value"]) && !rl.site(id).nil?
+          opened = row["value"].nil? ? nil : OAuth.open_agents_key(rl, row["value"])
+          key_site = id if id != "" && !opened.nil? && constant_time_equal(given, opened) && !rl.site(id).nil?
         end
         return coded("Unauthorized", "unauthorized", 401) if key_site.nil?
       end
@@ -2339,8 +2349,10 @@ module Runlight
         })
       end
 
-      return json(unfeed.call(store.realtime(site["id"], rl.now))) if path == "/api/realtime"
+      return json(unfeed.call(store.realtime(site["id"], @rl.now))) if path == "/api/realtime"
 
+      # Statistics that fit the data, for an app that never runs the scheduled check (at most hourly).
+      @rl.freshen_statistics
       read = read_query(url, site)
       return read if read.is_a?(Http::Response)
 
@@ -2358,6 +2370,7 @@ module Runlight
       end
 
       if path == "/api/goals"
+        return json({ "site" => site["id"], "goals" => store.goals(site["id"]) }) if params.get("definitions") == "1"
         goals = store.goals(site["id"])
         visitors = store.visitors(query)
         previous_visitors = before.nil? ? 0 : store.visitors(before)
@@ -2430,15 +2443,17 @@ module Runlight
         # Journeys reads the newest visits up to a cap; say when it was reached.
         read = store.journey_pages(query, Journeys::PAGES_PER_VISIT)
         options = { "steps" => Js.number(params.get("steps") || 5) }
-        options["start"] = params.get("start") if Js.truthy?(params.get("start"))
-        options["end"] = params.get("end") if Js.truthy?(params.get("end"))
-        options["through"] = { "step" => Js.number(through[1]), "value" => through[2] } unless through.nil?
+        # Pages as they are recorded, percent-encoded, as filters take them: /café is /caf%C3%A9.
+        options["start"] = Sources.recorded_path(params.get("start")) || params.get("start") if Js.truthy?(params.get("start"))
+        options["end"] = Sources.recorded_path(params.get("end")) || params.get("end") if Js.truthy?(params.get("end"))
+        options["through"] = { "step" => Js.number(through[1]), "value" => Sources.recorded_path(through[2]) || through[2] } unless through.nil?
         answer = { "site" => site["id"], "range" => range_out }.merge(Journeys.journeys(read["rows"], options)) { |_key, mine, _theirs| mine }
         answer["sampled"] = Store::SqlStore::JOURNEY_VISITS if read["sampled"]
         return json(answer)
       end
 
       if path == "/api/funnels"
+        return json({ "site" => site["id"], "funnels" => store.funnels(site["id"]) }) if params.get("definitions") == "1"
         # One funnel at a time, so a page of funnels never takes every database connection at once.
         rows = store.funnels(site["id"]).map do |funnel|
           counts = store.funnel_counts(query, funnel)
@@ -2459,8 +2474,8 @@ module Runlight
         return coded("Bad property name", "property_bad", 400) if !asked.nil? && !safe.call(asked)
 
         key = asked || keys.find { |k| safe.call(k["key"].to_s) }&.[]("key")
-        count = limit(params.get("limit"), 100)
-        rows = !key.nil? && key != "" ? store.event_prop_values(query, event, key, whole(count)) : []
+        count = whole_param(params.get("limit"), 100, 1000)
+        rows = !key.nil? && key != "" ? store.event_prop_values(query, event, key, count) : []
         return json({ "site" => site["id"], "range" => range_out, "event" => event, "keys" => keys, "key" => key, "rows" => rows })
       end
 
@@ -2468,10 +2483,13 @@ module Runlight
         dimension = params.get("dimension") || ""
         return coded("Unknown dimension \"#{dimension}\"", "unknown_dimension", 400, { "dimension" => dimension }) unless Query.dimension?(dimension)
 
-        count = limit(params.get("limit"), 10)
-        page = Js.number(params.get("page"))
-        page = [1, (page.is_a?(Float) && page.nan?) || page.zero? ? 1 : page].max
-        rows = store.breakdown(query, dimension, whole(count), whole((page - 1) * count))
+        count = whole_param(params.get("limit"), 10, 1000)
+        page = whole_param(params.get("page"), 1, 100_000)
+        if dimension == "hostname" && params.get("suggestions") == "1" && params.get("format") != "csv"
+          return json({ "site" => site["id"], "range" => range_out, "dimension" => dimension, "rows" => store.hostname_suggestions(query, [count, 50].min) })
+        end
+
+        rows = store.breakdown(query, dimension, count, (page - 1) * count)
         if params.get("format") == "csv"
           return download("#{site["id"]}-#{dimension}-#{range["fromDate"]}-#{range["toDate"]}.csv",
                           rows_csv(rows, { "timezone" => site["timezone"], "dimension" => dimension }), "text/csv; charset=utf-8")
@@ -2556,7 +2574,7 @@ module Runlight
       # The relay page the picker opens with its choice in the fragment, which never reaches a server. Its
       # script hands the choice to the dashboard tab on this origin that started the pick, and nothing else.
       if path == "/pick-return" && method == "GET"
-        translator = Messages.translator(accepted_language(request))
+        translator = Messages.translator(Messages.accepted_language(request))
         t = translator["t"]
         return small_page(
           translator["lang"],
@@ -2642,7 +2660,7 @@ module Runlight
         rl.init
         found = redeem_embed(url.search_params.get("ticket") || "")
         if found.nil?
-          translator = Messages.translator(accepted_language(request))
+          translator = Messages.translator(Messages.accepted_language(request))
           t = translator["t"]
           return small_page(translator["lang"], "<h1>#{escape_html(t.call("embed.goneTitle"))}</h1><p>#{escape_html(t.call("embed.gone"))}</p>", 404)
         end
@@ -2662,7 +2680,7 @@ module Runlight
         id = share_page[1]
         share = id.match?(SHARE_ID) ? store.share_by_id(id) : nil
         if share.nil?
-          translator = Messages.translator(accepted_language(request))
+          translator = Messages.translator(Messages.accepted_language(request))
           t = translator["t"]
           return small_page(translator["lang"], "<h1>#{escape_html(t.call("share.goneTitle"))}</h1><p>#{escape_html(t.call("share.gone"))}</p>", 404)
         end

data/lib/runlight/server/config.rb

@@ -199,7 +199,7 @@ module Runlight
         settings["geo"] = geo unless geo.nil?
         unless code.nil?
           settings["setupCode"] = code
-          settings["setupWhere"] = "in the file setup.txt in Runlight's data folder (<code>runlight setup</code> prints it too)"
+          settings["setupWhere"] = true
         end
         Standalone.new(settings.merge(Options.normalize(options)))
       end

data/lib/runlight/server/standalone.rb

@@ -54,8 +54,8 @@ module Runlight
       # - url: the dashboard's public address, such as https://stats.example.com. It can never become a link
       #   domain, short links never answer on it, and emails link to it whatever Host header a request carries.
       # - trustProxy, geo, geoCredit, now, fetcher: as the Core's and the routes' options of those names.
-      # - setupCode: the one-time code that unlocks /setup while no account exists; setupWhere says where it is
-      #   written down, for the page that asks for it.
+      # - setupCode: the one-time code that unlocks /setup while no account exists; setupWhere (true) says it is
+      #   written in setup.txt, for the page that asks for it.
       # - cronSecret: a bearer secret for POST /api/check, for a scheduler that calls it over HTTP.
       # - observeKey: one key for every site's AI agent reports.
       def initialize(options)
@@ -160,8 +160,7 @@ module Runlight
       end
 
       # The Rack entry point: answers the request, then does the work left after answering (a retention change's
-      # deletions) once the server has sent the answer. Bodies past the limits the Node server keeps get a 413, and
-      # X-Forwarded-Proto names the scheme, as the Node server reads them.
+      # deletions) once the server has sent the answer. Bodies past the limits the Node server keeps get a 413.
       def call(env)
         limit = Http::Request.limit_for("#{env["SCRIPT_NAME"]}#{env["PATH_INFO"]}")
         method = env["REQUEST_METHOD"].to_s.upcase
@@ -172,10 +171,6 @@ module Runlight
           env["rack.input"] = StringIO.new(text)
         end
         request = Http::Request.from_rack(env)
-        proto = request.headers.get("x-forwarded-proto").to_s.split(",")[0].to_s.strip.downcase
-        if %w[http https].include?(proto) && !request.url.start_with?("#{proto}://")
-          request = request.with(url: request.url.sub(%r{\Ahttps?://}, "#{proto}://"))
-        end
         status, headers, body = handle(request, { "ip" => request.remote_address }).to_rack
         body = [] if method == "HEAD"
         [status, headers, Finished.new(body, -> { idle })]

data/lib/runlight/store/sql.rb

@@ -70,6 +70,11 @@ module Runlight
         a.b <=> b.b
       end
 
+      # The events table, through the kind and time index on SQLite, which otherwise may read a site's whole history.
+      def event_kind_table(dialect)
+        dialect == "sqlite" ? "rl_events e INDEXED BY rl_events_site_kind_ts" : "rl_events e"
+      end
+
       # Runs a query over pieces of a list and joins the answers, in order.
       def in_pieces(items, size)
         out = []
@@ -117,6 +122,8 @@ module Runlight
           # MySQL takes an index that leads with the site as a way to read all of a site's rows, even where a
           # range of time would read far fewer, so there an index for looking a value up leads with that value.
           "CREATE INDEX IF NOT EXISTS rl_sessions_visitor ON rl_sessions (#{my ? "visitor, site" : "site, visitor"}, last_at)",
+          # Keep exact visitor counts in index order without loading every session row.
+          *(dialect == "sqlite" ? ["CREATE INDEX IF NOT EXISTS rl_sessions_visit_visitors ON rl_sessions (site, visitor, started_at) WHERE pageviews > 0 OR events > 0"] : []),
           "CREATE TABLE IF NOT EXISTS rl_events (
       id #{id}, site #{site} NOT NULL, ts BIGINT NOT NULL, kind #{str.(20)} NOT NULL,
       visitor #{text.(100)}, session #{text.(100)}, pageview #{text.(100)},
@@ -129,6 +136,7 @@ module Runlight
           # Page and event filters find the visits they pick through these, rather than reading every row in the range.
           # MySQL indexes the first 255 characters of a path, which is enough to find it.
           "CREATE INDEX IF NOT EXISTS rl_events_site_path ON rl_events (#{my ? "path(255), site" : "site, path"}, ts)",
+          *(dialect == "sqlite" ? ["CREATE INDEX IF NOT EXISTS rl_events_hostname_suggest ON rl_events (site, hostname, ts, session) WHERE kind = 'pageview'"] : []),
           # MySQL has no partial index, so its index of event names holds the kind too.
           if my
             "CREATE INDEX IF NOT EXISTS rl_events_site_name ON rl_events (name, site, kind, ts)"
@@ -273,6 +281,11 @@ module Runlight
         Js.number(value)
       end
 
+      # Text cut to at most `max` characters, as a VARCHAR(max) holds it, never through the middle of one.
+      def clip(text, max)
+        text.is_a?(String) && text.length > max ? text[0, max] : text
+      end
+
       # String(value ?? "") for text a driver read, as valid UTF-8.
       def string(value)
         value.nil? ? "" : Js.scrub(value.to_s)