runlight 0.2.0 → 0.3.0

data/lib/runlight/accounts/accounts.rb

@@ -13,8 +13,8 @@ module Runlight
     # stats and changes nothing.
     #
     # A user is a Hash with the TypeScript User's keys: id, email, hash, role ("owner", "admin", "member", or
-    # "viewer"), createdAt, twoFactor (whether sign-in also asks for a code), and recoveryLeft (recovery codes not
-    # yet used). An invite has id, email, role, invitedBy, createdAt, and expiresAt.
+    # "viewer"), createdAt, twoFactor (whether sign-in also asks for a code), recoveryLeft (recovery codes not
+    # yet used), and signedOut (a mark signing out replaces, which every session is signed with, when set). An invite has id, email, role, invitedBy, createdAt, and expiresAt.
     class Accounts
       SESSION_COOKIE = "runlight_session"
       # Thirty days, renewed on every sign-in.
@@ -401,6 +401,13 @@ module Runlight
         Crypto.same_text(sign("#{id}.#{expires}", session_key(user)), signature) ? user : nil
       end
 
+      # Ends every session an account has, in every browser, as signing out does.
+      def end_sessions(id)
+        init
+        @store.db.run("UPDATE rl_users SET signed_out = ? WHERE id = ?", [Hashing.random_id(8), id])
+        nil
+      end
+
       # A long-lived mark for a browser that signed in to an account. With it, failed tries by others
       # against that account cannot lock this browser out; the per-address limit still applies.
       # A new password withdraws it.
@@ -455,7 +462,8 @@ module Runlight
           names = columns.map { |c| (c["name"] || c["NAME"] || "").to_s }
           db.run("ALTER TABLE rl_users ADD COLUMN role #{str.call(20)} NOT NULL DEFAULT 'owner'") unless names.include?("role")
           # Two-factor came later still: the secret (sealed), one being set up, recovery code hashes, and the last code's step.
-          [%w[totp_secret TEXT], %w[totp_pending TEXT], %w[totp_recovery TEXT], %w[totp_step BIGINT]].each do |name, type|
+          # And the mark signing out replaces, later again.
+          [%w[totp_secret TEXT], %w[totp_pending TEXT], %w[totp_recovery TEXT], %w[totp_step BIGINT], %w[signed_out TEXT]].each do |name, type|
             db.run("ALTER TABLE rl_users ADD COLUMN #{name} #{type}") unless names.include?(name)
           end
           db.run(
@@ -486,6 +494,7 @@ module Runlight
           "createdAt" => Js.number(r["created_at"]),
           "twoFactor" => Js.truthy?(r["totp_secret"]),
           "recoveryLeft" => recovery.length,
+          **(Js.truthy?(r["signed_out"]) ? { "signedOut" => r["signed_out"].to_s } : {}),
         }
       end
 
@@ -580,9 +589,10 @@ module Runlight
         { "invite" => invite, "code" => code }
       end
 
-      # What a session is signed with: the password hash, and whether two-factor is on, so changing either ends other sessions.
+      # What a session is signed with: the password hash, whether two-factor is on, and a mark that signing out
+      # replaces, so changing any of them ends other sessions.
       def session_key(user)
-        "#{user["hash"]}#{user["twoFactor"] ? ".2fa" : ""}"
+        "#{user["hash"]}#{user["twoFactor"] ? ".2fa" : ""}#{user["signedOut"] ? ".#{user["signedOut"]}" : ""}"
       end
 
       def sign(body, hash)

data/lib/runlight/accounts/crypto.rb

@@ -132,6 +132,8 @@ module Runlight
         n, r, p = parts[1, 3].map { |part| Js.number(part) }
         whole = ->(v, max) { v.is_a?(Integer) && v >= 1 && v <= max }
         return nil unless whole.call(n, 1 << 20) && n >= 2 && (n & (n - 1)).zero? && whole.call(r, 32) && whole.call(p, 16)
+        # N must also be below 2^(16r), as scrypt itself requires, so a stored hash past that fails to match rather than raises.
+        return nil if Math.log2(n) >= 16 * r
 
         { n: n, r: r, p: p }
       end

data/lib/runlight/accounts/throttle.rb

@@ -192,9 +192,10 @@ module Runlight
         save(id, entry)
       end
 
-      # Expired entries go first, then the oldest that are not blocked, and blocked ones last, so the counts
-      # have a hard ceiling and a flood of made-up names cannot wipe out a real block. Run when a new entry is
-      # made, since only then can there be more.
+      # Expired entries go first, then those with the fewest tries, oldest first, down to nine tenths of the
+      # ceiling so this runs seldom. A flood of made-up names has one try each, so it cannot wipe out a block,
+      # or the count of a name someone is close to blocking. Run when a new entry is made, since only then can
+      # there be more.
       def prune(now)
         entries = []
         @store.settings_starting_with(prefix).each do |row|
@@ -204,23 +205,13 @@ module Runlight
             @store.set_setting(row["key"], nil)
             next
           end
-          entries << { "key" => row["key"], "until" => until_ms, "blocked" => entry.is_a?(Hash) && int(entry["count"]) >= @limit }
-        end
-        size = entries.length
-        return if size <= Accounts::MAX_THROTTLED
-
-        # Oldest first: each entry's window started windowMs before its end.
-        entries = entries.each_with_index.sort_by { |e, i| [e["until"], i] }.map(&:first)
-        [false, true].each do |blocked|
-          entries.each do |e|
-            return if size <= Accounts::MAX_THROTTLED
-
-            if e["blocked"] == blocked
-              @store.set_setting(e["key"], nil)
-              size -= 1
-            end
-          end
+          entries << { "key" => row["key"], "until" => until_ms, "count" => int(entry["count"]) }
         end
+        return if entries.length <= Accounts::MAX_THROTTLED
+
+        # Fewest tries first, and among equals the oldest: each entry's window started windowMs before its end.
+        fewest = entries.each_with_index.sort_by { |e, i| [e["count"], e["until"], i] }.map(&:first)
+        fewest.first(entries.length - (Accounts::MAX_THROTTLED * 0.9).floor).each { |e| @store.set_setting(e["key"], nil) }
       end
     end
   end

data/lib/runlight/accounts/web.rb

@@ -127,6 +127,11 @@ module Runlight
         true
       end
 
+      # The ids of the tokens an account made.
+      def tokens_of(by)
+        @store.settings_starting_with(MADE_BY).select { |row| row["value"] == by }.map { |row| row["key"][MADE_BY.length..] }.to_set
+      end
+
       # Answers an account page or API request at a path under the base, or nil for anything else.
       # context: {"ip" => the connection's address}, optional.
       def handle(request, path, context = {})
@@ -353,6 +358,12 @@ module Runlight
         if path == "/auth.js"
           return Http::Response.new(Pages.auth_js(query.get("lang") || "en"), status: 200, headers: { "content-type" => "application/javascript; charset=utf-8", "cache-control" => "public, max-age=3600" })
         end
+        # A form posted from another site, or a sibling one, could sign someone in to an account that is not theirs or
+        # plant a session, so these pages take forms only from their own. The browser says where a request came from.
+        cross_site = %w[cross-site same-site].include?(request.headers.get("sec-fetch-site") || "")
+        if cross_site && (method == "POST" || path == "/logout") && %w[/setup /login /login/code /invite /logout].include?(path)
+          return html(Pages.login_page(base, { "error" => t.call("oauth.anotherSiteTitle"), "next" => @home_path, "forgot" => @forgot }, lang), 403)
+        end
 
         if path == "/setup"
           return redirect("#{base}/login") if has_account?
@@ -431,7 +442,10 @@ module Runlight
           return signed_in_to(request, user, next_path)
         end
 
-        return redirect("#{base}/login", { "set-cookie" => session_cookie(request, "", 0) }) if path == "/logout"
+        # Signing out ends this browser's session; the account page can end them everywhere.
+        if path == "/logout"
+          return redirect("#{base}/login", { "set-cookie" => session_cookie(request, "", 0) })
+        end
 
         if path == "/invite"
           if method == "GET"
@@ -552,6 +566,12 @@ module Runlight
         return coded("Send JSON", "send_json", 415) if method == "POST" && media_type(request) != "application/json"
         return reply({ "account" => person(user) }) if path == "/api/account" && method == "GET"
 
+        # Ends the account's sessions in every browser, this one too, so a cookie copied before stops working.
+        if path == "/api/account/sign-out-everywhere" && method == "POST"
+          @accounts.end_sessions(user["id"])
+          return reply({ "ok" => true }, 200, { "set-cookie" => session_cookie(request, "", 0) })
+        end
+
         fresh = ->(updated) { { "set-cookie" => session_cookie(request, @accounts.session_for(updated, now), Accounts::SESSION_MS / 1000) } }
         if path == "/api/account/password" && method == "POST"
           input = body(request)
@@ -562,6 +582,8 @@ module Runlight
 
           begin
             updated = @accounts.set_password(user["email"], field(input, "next"), now)
+            # Asked for after a password got out: the tokens and apps the account made could still read on.
+            drop_tokens_of(user["id"]) if input["revokeTokens"] == true
             # The new password ends every other sign-in; this browser gets a fresh one.
             return reply({ "ok" => true }, 200, fresh.call(updated))
           rescue AccountError => e

data/lib/runlight/core.rb

@@ -17,12 +17,13 @@ module Runlight
   #   standalone server does. `site` and `sites` are ignored.
   # - geo: a callable taking an IP and giving { "country", "region", "city" } or nil, a location for an IP when
   #   the platform sends no location headers.
-  # - trustProxy: true (default), false, or one of "x-forwarded-for", "x-real-ip", "cf-connecting-ip". Read the
-  #   client IP from forwarding headers: the last X-Forwarded-For entry, which the nearest proxy wrote, then
-  #   X-Real-IP, then CF-Connecting-IP. Name one of them to read only that header, such as "cf-connecting-ip"
-  #   behind Cloudflare and another proxy. False reads only the connection's address, for an app nothing sits
-  #   in front of. Left unset, it warns once when a request comes straight from a public address with none of
-  #   those headers.
+  # - trustProxy: true, false, or one of "x-forwarded-for", "x-real-ip", "cf-connecting-ip". Read the client IP
+  #   from forwarding headers: the last X-Forwarded-For entry, which the nearest proxy wrote, then X-Real-IP,
+  #   then CF-Connecting-IP. Name one of them to read only that header, such as "cf-connecting-ip" behind
+  #   Cloudflare and another proxy. Left unset, the headers count only on a connection from this computer or a
+  #   private network, where proxies and load balancers connect from, so a client that reaches the app straight
+  #   from the internet cannot choose its own address. True reads them from anywhere, for a CDN that connects
+  #   from public addresses. False reads only the connection's address.
   # - linkPath: where short links on the app's own domain live, as `{linkPath}/{slug}`. Default "/go".
   # - mail: how email reports, invites, and sign-in links are sent. Either a mail service in code (a Transports
   #   config plus `from` and `fromName`), which the dashboard shows and cannot change, or a mailer of the app's
@@ -124,8 +125,10 @@ module Runlight
 
       @geo = options["geo"]
       @trust_proxy = options["trustProxy"].nil? ? true : options["trustProxy"]
-      # True until trustProxy left at its default has been seen answering a public address directly, and warned about once.
-      @warn_direct = options["trustProxy"].nil?
+      # True when trustProxy was left at its default, which believes forwarding headers only from a private address.
+      @trust_private = options["trustProxy"].nil?
+      # True until a public address has sent forwarding headers that the default did not believe, and been warned about once.
+      @warn_direct = @trust_private
       per_minute = options["rateLimit"].nil? ? 120 : options["rateLimit"]
       # false, 0, or anything that is not a positive number means no limit, never a limit of nothing.
       number = per_minute == false ? Float::NAN : Js.number(per_minute)
@@ -781,7 +784,7 @@ module Runlight
     # Cloudflare before nginx) reads only that one. Otherwise it is the connection's address: the
     # context's "ip", or else the request's own remote_address.
     def client_ip(request, context = {})
-      if @trust_proxy != false
+      if trusts?(request, context)
         h = request.headers
         last = lambda do |name|
           value = h.get(name)
@@ -799,16 +802,27 @@ module Runlight
                     end
         return Js.trim(forwarded) if !forwarded.nil? && Js.trim(forwarded) != ""
       end
-      ip = context_ip(context)
-      ip = (ip.nil? ? request.remote_address : ip).to_s
-      # A public address with no forwarding header means nothing sits in front, and then any client
-      # could name its own address in one. Said once, only when trustProxy was left at its default.
-      if @warn_direct && Safefetch.public_address?(ip)
+      connection_ip(request, context).to_s
+    end
+
+    # Whether a request's forwarding headers count. Left at its default, trustProxy believes them only on a
+    # connection from this computer or a private network, or one whose address the app did not pass on, since a
+    # client reaching the server straight from the internet could write them itself.
+    def trusts?(request, context = {})
+      return false if @trust_proxy == false
+
+      ip = connection_ip(request, context)
+      return true if !@trust_private || ip.nil? || ip.to_s == "" || !Safefetch.public_address?(ip.to_s)
+
+      # Said once: a CDN that connects from public addresses needs trustProxy set, or its visitors all look alike.
+      h = request.headers
+      if @warn_direct && (h.has?("x-forwarded-for") || h.has?("x-real-ip") || h.has?("cf-connecting-ip"))
         @warn_direct = false
-        warn("Runlight: a request came straight from a public address with no proxy in front, but trustProxy is on by default, so a client could send X-Forwarded-For and choose its own address, getting round the rate limits. Set trust_proxy: false when nothing sits in front of this server, or put a proxy in front that sets the header.")
+        warn("Runlight: a request came from a public address with forwarding headers, which are not believed by default, since a client could write them itself and choose its own address. Behind a CDN that connects from public addresses, such as Cloudflare in front of this server, set trust_proxy to the header it sets (cf-connecting-ip) or to true.")
       end
-      ip
+      false
     end
+    private :trusts?
 
     # Handles one tracker request. Bad input is dropped quietly; only a database that keeps failing raises.
     def collect(request, context = {})
@@ -834,8 +848,11 @@ module Runlight
       # another process writing the SQLite file) gets it a little later, at the time it arrived.
       at = now
       attempt = 1
+      # How far recording the hit got: its visit, and which of its writes went in. A hit tried again after a write
+      # failed skips the ones before it, so a visit's counts never take the same hit twice.
+      done = {}
       begin
-        record(payload, request, context, at)
+        record(payload, request, context, at, done)
       rescue StandardError => e
         raise if attempt >= 3 || !busy?(e)
 
@@ -872,7 +889,7 @@ module Runlight
     def link_domain_response(request, context = {})
       url = Http::Url.new(request.url)
       # A forwarded host only counts behind a proxy that sets it; otherwise any client could pick one.
-      given = forwarded_host(request) || request.headers.get("host") || url.host
+      given = forwarded_host(request, context) || request.headers.get("host") || url.host
       host = Sources.strip_www(Js.trim(given.split(",", -1).first.to_s).split(":", -1).first.to_s)
       return nil unless link_domain_set.key?(host)
 
@@ -899,7 +916,7 @@ module Runlight
     def redirect(request, slug, domain, context = {})
       init
       url = Http::Url.new(request.url)
-      host = Sources.strip_www((forwarded_host(request) || request.headers.get("host") || url.host).split(":", -1).first.to_s)
+      host = Sources.strip_www((forwarded_host(request, context) || request.headers.get("host") || url.host).split(":", -1).first.to_s)
       link = @store.link_by_slug(slug)
       # The app's own link path answers for every link, so a link whose domain
       # was removed keeps working; a link domain answers only for its own links.
@@ -1290,8 +1307,16 @@ module Runlight
 
       today = @store.salt(day, Hashing.random_salt)
       yesterday = @store.salt_if_exists(Dates.add_days(day, -1))
-      drop_old_salts(at)
-      @salts[timezone] = { "day" => day, "today" => today, "yesterday" => yesterday }
+      salts = { "day" => day, "today" => today, "yesterday" => yesterday }
+      # Kept before old salts go, so dropping yesterday's from the store drops it from here too.
+      @salts[timezone] = salts
+      begin
+        drop_old_salts(at)
+      rescue StandardError
+        @salts.delete(timezone)
+        raise
+      end
+      salts
     end
 
     # Deletes every salt no visit can still use. A day's salt counts visitors while it is that day in a
@@ -1319,11 +1344,17 @@ module Runlight
     end
 
     # The host a proxy says the request was for, read only when proxy headers are trusted, as the client's address is.
-    def forwarded_host(request)
-      @trust_proxy == false ? nil : request.headers.get("x-forwarded-host")
+    def forwarded_host(request, context = {})
+      trusts?(request, context) ? request.headers.get("x-forwarded-host") : nil
     end
 
-    def record(payload, request, context, at)
+    # The connection's own address: the context's "ip", or else the request's remote_address, or nil.
+    def connection_ip(request, context)
+      ip = context_ip(context)
+      ip.nil? ? request.remote_address : ip
+    end
+
+    def record(payload, request, context, at, done = {})
       # Managed sites load from the database in init(), so it must come first.
       init
       url = payload["url"]
@@ -1331,19 +1362,19 @@ module Runlight
       return if site.nil?
 
       if payload["kind"] == "engagement"
-        engagement(site, payload, at)
+        engagement(site, payload, at, done)
         return
       end
 
       page = Sources.parse_page(url)
-      session = nil
+      session = done["session"]
       reopen = true
       if payload["kind"] == "event" && payload["pageviewId"] != ""
         pageview = @store.pageview(site["id"], payload["pageviewId"])
         # An event joins its page's visit unless that visit began longer ago than reports look for its rows
         # (a tab left open for days); it then starts a visit of its own, as any later activity would.
         if !pageview.nil? && at - pageview["startedAt"] < Store::SqlStore::EVENT_TAIL_MS
-          session = { "id" => pageview["session"], "visitor" => pageview["visitor"] }
+          session ||= { "id" => pageview["session"], "visitor" => pageview["visitor"] }
           # A visit idle past the 30 minutes stays ended: the event counts in it without reopening it.
           reopen = at - pageview["lastAt"] <= SESSION_IDLE_MS
           if at - pageview["startedAt"] > 3_600_000
@@ -1359,8 +1390,12 @@ module Runlight
       session ||= session_for(site, request, context, page, payload["referrer"], at, {
         "screenWidth" => payload["screenWidth"], "screen" => screen, "language" => payload["language"],
       })
+      done["session"] = session
 
-      @store.touch_session(session["id"], at, payload["kind"], page["path"], reopen)
+      unless done["touched"]
+        @store.touch_session(session["id"], at, payload["kind"], page["path"], reopen)
+        done["touched"] = true
+      end
       @store.insert_event({
         "site" => site["id"],
         "ts" => at,
@@ -1401,7 +1436,7 @@ module Runlight
         "mobile" => request.headers.get("sec-ch-ua-mobile"),
         "platform" => request.headers.get("sec-ch-ua-platform"),
       }, client["screenWidth"])
-      location = Geo.locate(request.headers, ip, @geo, Js.truthy?(@trust_proxy))
+      location = Geo.locate(request.headers, ip, @geo, trusts?(request, context))
       row = {
         "id" => session["id"],
         "site" => site["id"],
@@ -1434,14 +1469,17 @@ module Runlight
       domains
     end
 
-    def engagement(site, payload, at)
+    def engagement(site, payload, at, done = {})
       return if payload["engagedMs"] <= 0
 
       pageview = @store.pageview(site["id"], payload["pageviewId"])
       # Reports look for a visit's rows only so long after it began, so later time on it is let go.
       return if pageview.nil? || at - pageview["startedAt"] >= Store::SqlStore::EVENT_TAIL_MS
 
-      @store.add_engagement(pageview["session"], payload["engagedMs"])
+      unless done["engaged"]
+        @store.add_engagement(pageview["session"], payload["engagedMs"])
+        done["engaged"] = true
+      end
       # Only a visit that began more than an hour ago can belong to a day that is already added up.
       if at - pageview["startedAt"] > 3_600_000
         @store.touched_old_visit(site["id"], pageview["startedAt"].to_i, at - ROLLUP_DELAY_MS + 3_600_000)

data/lib/runlight/http/fetcher.rb

@@ -27,7 +27,7 @@ module Runlight
       REDIRECTS = [301, 302, 303, 307, 308].freeze
       TIMED_OUT = "The operation was aborted due to timeout"
       # Sent only to the origin they were given to.
-      CREDENTIALS = %w[authorization cookie proxy-authorization x-api-key].freeze
+      CREDENTIALS = %w[authorization cookie proxy-authorization x-api-key apikey].freeze
 
       def fetch(url, init = {})
         deadline = monotonic + ((init["timeoutMs"] || 30_000).to_i / 1000.0)

data/lib/runlight/importers/client.rb

@@ -14,11 +14,9 @@ module Runlight
       ISO_DATE = /\A([+-]\d{6}|\d{4})(?:-(\d{2})(?:-(\d{2}))?)?(?:T(\d{2}):(\d{2})(?::(\d{2})(?:\.(\d{1,9}))?)?(Z|[+-]\d{2}:\d{2})?)?\z/i
       private_constant :ISO_DATE
 
-      # sleep: a callable that waits this many milliseconds. owner: true for a service at an address the owner
-      # typed (a self-hosted Umami), fetched only on the public internet, as Safefetch.owner_fetch allows.
-      def initialize(fetcher = nil, sleep = nil, owner: false)
+      # sleep: a callable that waits this many milliseconds.
+      def initialize(fetcher = nil, sleep = nil)
         @fetcher = fetcher || Http::NetFetcher.new
-        @owner = owner
         @sleep = sleep || ->(ms) { Kernel.sleep(ms / 1000.0) if ms.positive? }
       end
 
@@ -26,7 +24,9 @@ module Runlight
         @sleep.call(ms)
       end
 
-      # Fetches JSON, decoded. `init` may hold "headers", "method", and "body".
+      # Fetches JSON, decoded. `init` may hold "headers", "method", and "body". The address can come from whoever
+      # runs an import (a self-hosted Umami), so every service, a hosted one too, is asked only at public https
+      # addresses, with no redirect followed, which would carry the key somewhere else, as public_fetch allows.
       def get_json(url, init = {})
         attempt = 1
         loop do
@@ -35,7 +35,7 @@ module Runlight
           options["method"] = init["method"] unless init["method"].nil?
           options["body"] = init["body"] unless init["body"].nil?
           begin
-            response = @owner ? Safefetch.owner_fetch(url, options, @fetcher) : @fetcher.fetch(url, options)
+            response = Safefetch.public_fetch(url, options.merge("redirects" => 0), @fetcher)
           rescue PrivateAddressError, Http::BodyTooLong
             # An address off the public internet, or an answer past the cap, is the same on every try.
             host = Http::Url.new(url).host

data/lib/runlight/importers/index.rb

@@ -25,8 +25,9 @@ module Runlight
         raise ImportError.new("Runlight cannot import from #{source}", "import_source", { "source" => source }) if name.nil?
 
         runlight.init
-        # Umami is at an address the owner typed; the others are their services' own.
-        client = Client.new(runlight.fetcher, owner: source == "umami")
+        # Umami is at an address the owner typed, and the others are their services' own; each is asked only on the
+        # public internet.
+        client = Client.new(runlight.fetcher)
         importer = Importers.const_get(name).new(client, -> { runlight.now })
         known = lambda do |source_id, slug = nil, url = nil|
           return true unless runlight.store.link_by_id(Write.imported_link_id(source, Js.string(source_id))).nil?

data/lib/runlight/importers/visits.rb

@@ -36,7 +36,7 @@ module Runlight
       # The websites an Umami account can see, to pick which one becomes this site's history: a list of
       # { "id", "name", "domain" }.
       def umami_websites(credentials, fetcher = nil)
-        http = Client.new(fetcher, owner: true)
+        http = Client.new(fetcher)
         login = Umami.umami_sign_in(http, credentials)
         headers = { "authorization" => "Bearer #{Client.str(login["token"])}" }
         out = []
@@ -74,7 +74,7 @@ module Runlight
         raise ImportError.new("Unknown site", "unknown_site") if site.nil?
         raise ImportError.new("Pick the Umami website to import", "import_website") unless website.match?(/\A[A-Za-z0-9-]{1,64}\z/)
 
-        http = Client.new(runlight.fetcher, owner: true)
+        http = Client.new(runlight.fetcher)
 
         saved = !cursor.nil? && cursor != "" ? Json.decode(cursor) : nil
         login = Umami.umami_sign_in(http, credentials, saved.nil? ? nil : saved["token"])

data/lib/runlight/payload.rb

@@ -55,9 +55,8 @@ module Runlight
         else
           next
         end
-        # Assigning out["__proto__"] in JavaScript sets the prototype, which a string cannot be, so
-        # nothing is kept; it still counts.
-        out[k] = text if k != "__proto__"
+        # A prop named __proto__ is kept like any other, as the SDK keeps it in an object with no prototype.
+        out[k] = text
         count += 1
       end
       return nil if count.zero?
@@ -67,6 +66,20 @@ module Runlight
 
     # An object's entries in JavaScript's order: keys that are array indexes first, ascending, then the
     # rest in the order they were added.
+    # The events the tracker sends on its own for a link that was followed, each with the link as `url`.
+    LINK_EVENTS = ["Outbound link", "File download"].freeze
+    private_constant :LINK_EVENTS
+
+    # An automatic link event's `url` without its query string or fragment, as page paths are kept, since tokens and
+    # email addresses ride in them. Done here rather than in the tracker, which has no bytes to spare, and so a
+    # tracker cached from before is held to it too.
+    def link_props(name, given)
+      return given if given.nil? || !LINK_EVENTS.include?(name) || !given.key?("url")
+
+      given["url"] = given["url"].sub(/[?#].*\z/m, "")
+      given
+    end
+
     def entries(object)
       indexes = []
       names = []
@@ -124,13 +137,13 @@ module Runlight
         "screenHeight" => int(get.call("h"), 0, 20_000),
         "language" => str(get.call("l"), 35),
         "name" => name,
-        "props" => kind == "event" ? props(get.call("p")) : nil,
+        "props" => kind == "event" ? link_props(name, props(get.call("p"))) : nil,
         "pageviewId" => pageview_id,
         "engagedMs" => kind == "engagement" ? int(get.call("e"), 0, MAX_ENGAGED_MS) || 0 : 0,
         "scroll" => int(get.call("d"), 0, 100),
       }
     end
 
-    private_class_method :str, :int, :props, :entries, :parse
+    private_class_method :str, :int, :props, :link_props, :entries, :parse
   end
 end

data/lib/runlight/routes.rb

@@ -31,6 +31,8 @@ module Runlight
   # - accountOf: a callable taking the Request and returning the account it comes from, or nil (internal, for the
   #   standalone server).
   # - tokenMade: a callable taking a token row and who made it, returning whether that is allowed (internal).
+  # - tokensOf: a callable taking an account id, returning the ids of the tokens it made, so a member sees and
+  #   revokes only their own (internal).
   class Routes
     COOKIE = "runlight_token"
     IMPLEMENTATION = { "library" => "runlight", "language" => "ruby" }.freeze
@@ -169,6 +171,7 @@ module Runlight
       @sign_out = options["signOut"].nil? ? (web ? "#{@base}/logout" : nil) : options["signOut"].to_s
       @account_of = options["accountOf"] || (web ? ->(r) { web.account_of(r) } : nil)
       @token_made = options["tokenMade"] || (web ? ->(row, by) { web.token_made(row, by) } : nil)
+      @tokens_of = options["tokensOf"] || (web ? ->(by) { web.tokens_of(by) } : nil)
       authorize = options["authorize"]
       oauth = {
         "runlight" => runlight,
@@ -471,12 +474,14 @@ module Runlight
         n.is_a?(Float) ? (n.finite? ? n.to_i : 0) : n.to_i
       end
 
-      # The controls a member cannot change: the mail service and its keys, the assistant's settings, and deleting a site.
+      # The controls a member cannot change: the mail service and its keys, the assistant's settings, a site's agents key,
+      # and deleting a site.
       def admin_only?(path, method)
         (path == "/api/mail" && %w[PUT DELETE].include?(method)) ||
           (path == "/api/assistant" && %w[PUT DELETE].include?(method)) ||
           (path == "/api/assistant/limits" && method == "PUT") ||
           (path == "/api/assistant/models" && method == "POST") ||
+          (path == "/api/observe-key/new" && method == "POST") ||
           (path.match?(%r{\A/api/sites/[^/]+\z}) && method == "DELETE")
       end
 
@@ -1481,13 +1486,23 @@ module Runlight
       nil
     end
 
+    # The tokens the account behind a request made: none when nothing notes who made what.
+    def own_tokens(request)
+      by = @account_of&.call(request)
+      !by.nil? && by != "" && @tokens_of ? @tokens_of.call(by) : Set.new
+    end
+
     def tokens_api(request, path)
       @rl.init
       view = lambda do |t|
         { "id" => t["id"], "name" => t["name"], "site" => t["site"], "scope" => t["scope"], "hint" => t["hint"],
           "createdAt" => t["createdAt"], "lastUsedAt" => t["lastUsedAt"] }
       end
-      return json({ "tokens" => store.tokens.map(&view) }) if path == "/api/tokens" && request.method == "GET"
+      # A member makes tokens like anyone who manages sites, but sees and revokes only the ones they made.
+      mine = @members.key?(request) ? own_tokens(request) : nil
+      if path == "/api/tokens" && request.method == "GET"
+        return json({ "tokens" => store.tokens.select { |t| mine.nil? || mine.include?(t["id"]) }.map(&view) })
+      end
 
       if path == "/api/tokens" && request.method == "POST"
         body = read_json(request)
@@ -1517,6 +1532,8 @@ module Runlight
         return json({ "token" => view.call(row), "secret" => secret }, 201)
       end
       if (match = path.match(%r{\A/api/tokens/([a-f0-9]{24})\z})) && request.method == "DELETE"
+        return coded("Unknown token", "unknown_token", 404) if mine && !mine.include?(match[1])
+
         return store.delete_token(match[1]) ? json({ "ok" => true }) : coded("Unknown token", "unknown_token", 404)
       end
 
@@ -1898,7 +1915,7 @@ module Runlight
       end
       return chat(request, url) if path == "/api/assistant/chat" && method == "POST"
 
-      # Only the owner manages tokens: an API token cannot make or revoke one.
+      # Only people at the dashboard manage tokens, a member only their own: an API token cannot make or revoke one.
       if path == "/api/tokens" || path.start_with?("/api/tokens/")
         access = can_read(request)
         return denied(access) if access != true
@@ -2456,8 +2473,10 @@ module Runlight
         return json({ "site" => site["id"], "funnels" => store.funnels(site["id"]) }) if params.get("definitions") == "1"
         # One funnel at a time, so a page of funnels never takes every database connection at once.
         rows = store.funnels(site["id"]).map do |funnel|
-          counts = store.funnel_counts(query, funnel)
-          funnel.merge("steps" => funnel["steps"].each_with_index.map { |step, i| step.merge("visits" => counts[i]) })
+          counted = store.funnel_counts(query, funnel)
+          counts = counted["counts"]
+          row = funnel.merge("steps" => funnel["steps"].each_with_index.map { |step, i| step.merge("visits" => counts[i]) })
+          counted["sampled"] ? row.merge("sampled" => store.funnel_visits) : row
         end
         return json({ "site" => site["id"], "range" => range_out, "funnels" => rows })
       end