runlight 0.2.0 → 0.3.1

data/lib/runlight/accounts/accounts.rb

@@ -13,8 +13,8 @@ module Runlight
     # stats and changes nothing.
     #
     # A user is a Hash with the TypeScript User's keys: id, email, hash, role ("owner", "admin", "member", or
-    # "viewer"), createdAt, twoFactor (whether sign-in also asks for a code), and recoveryLeft (recovery codes not
-    # yet used). An invite has id, email, role, invitedBy, createdAt, and expiresAt.
+    # "viewer"), createdAt, twoFactor (whether sign-in also asks for a code), recoveryLeft (recovery codes not
+    # yet used), and signedOut (a mark signing out replaces, which every session is signed with, when set). An invite has id, email, role, invitedBy, createdAt, and expiresAt.
     class Accounts
       SESSION_COOKIE = "runlight_session"
       # Thirty days, renewed on every sign-in.
@@ -401,6 +401,13 @@ module Runlight
         Crypto.same_text(sign("#{id}.#{expires}", session_key(user)), signature) ? user : nil
       end
 
+      # Ends every session an account has, in every browser, as signing out does.
+      def end_sessions(id)
+        init
+        @store.db.run("UPDATE rl_users SET signed_out = ? WHERE id = ?", [Hashing.random_id(8), id])
+        nil
+      end
+
       # A long-lived mark for a browser that signed in to an account. With it, failed tries by others
       # against that account cannot lock this browser out; the per-address limit still applies.
       # A new password withdraws it.
@@ -455,7 +462,8 @@ module Runlight
           names = columns.map { |c| (c["name"] || c["NAME"] || "").to_s }
           db.run("ALTER TABLE rl_users ADD COLUMN role #{str.call(20)} NOT NULL DEFAULT 'owner'") unless names.include?("role")
           # Two-factor came later still: the secret (sealed), one being set up, recovery code hashes, and the last code's step.
-          [%w[totp_secret TEXT], %w[totp_pending TEXT], %w[totp_recovery TEXT], %w[totp_step BIGINT]].each do |name, type|
+          # And the mark signing out replaces, later again.
+          [%w[totp_secret TEXT], %w[totp_pending TEXT], %w[totp_recovery TEXT], %w[totp_step BIGINT], %w[signed_out TEXT]].each do |name, type|
             db.run("ALTER TABLE rl_users ADD COLUMN #{name} #{type}") unless names.include?(name)
           end
           db.run(
@@ -486,6 +494,7 @@ module Runlight
           "createdAt" => Js.number(r["created_at"]),
           "twoFactor" => Js.truthy?(r["totp_secret"]),
           "recoveryLeft" => recovery.length,
+          **(Js.truthy?(r["signed_out"]) ? { "signedOut" => r["signed_out"].to_s } : {}),
         }
       end
 
@@ -580,9 +589,10 @@ module Runlight
         { "invite" => invite, "code" => code }
       end
 
-      # What a session is signed with: the password hash, and whether two-factor is on, so changing either ends other sessions.
+      # What a session is signed with: the password hash, whether two-factor is on, and a mark that signing out
+      # replaces, so changing any of them ends other sessions.
       def session_key(user)
-        "#{user["hash"]}#{user["twoFactor"] ? ".2fa" : ""}"
+        "#{user["hash"]}#{user["twoFactor"] ? ".2fa" : ""}#{user["signedOut"] ? ".#{user["signedOut"]}" : ""}"
       end
 
       def sign(body, hash)

data/lib/runlight/accounts/crypto.rb

@@ -132,6 +132,8 @@ module Runlight
         n, r, p = parts[1, 3].map { |part| Js.number(part) }
         whole = ->(v, max) { v.is_a?(Integer) && v >= 1 && v <= max }
         return nil unless whole.call(n, 1 << 20) && n >= 2 && (n & (n - 1)).zero? && whole.call(r, 32) && whole.call(p, 16)
+        # N must also be below 2^(16r), as scrypt itself requires, so a stored hash past that fails to match rather than raises.
+        return nil if Math.log2(n) >= 16 * r
 
         { n: n, r: r, p: p }
       end

data/lib/runlight/accounts/throttle.rb

@@ -192,9 +192,10 @@ module Runlight
         save(id, entry)
       end
 
-      # Expired entries go first, then the oldest that are not blocked, and blocked ones last, so the counts
-      # have a hard ceiling and a flood of made-up names cannot wipe out a real block. Run when a new entry is
-      # made, since only then can there be more.
+      # Expired entries go first, then those with the fewest tries, oldest first, down to nine tenths of the
+      # ceiling so this runs seldom. A flood of made-up names has one try each, so it cannot wipe out a block,
+      # or the count of a name someone is close to blocking. Run when a new entry is made, since only then can
+      # there be more.
       def prune(now)
         entries = []
         @store.settings_starting_with(prefix).each do |row|
@@ -204,23 +205,13 @@ module Runlight
             @store.set_setting(row["key"], nil)
             next
           end
-          entries << { "key" => row["key"], "until" => until_ms, "blocked" => entry.is_a?(Hash) && int(entry["count"]) >= @limit }
-        end
-        size = entries.length
-        return if size <= Accounts::MAX_THROTTLED
-
-        # Oldest first: each entry's window started windowMs before its end.
-        entries = entries.each_with_index.sort_by { |e, i| [e["until"], i] }.map(&:first)
-        [false, true].each do |blocked|
-          entries.each do |e|
-            return if size <= Accounts::MAX_THROTTLED
-
-            if e["blocked"] == blocked
-              @store.set_setting(e["key"], nil)
-              size -= 1
-            end
-          end
+          entries << { "key" => row["key"], "until" => until_ms, "count" => int(entry["count"]) }
         end
+        return if entries.length <= Accounts::MAX_THROTTLED
+
+        # Fewest tries first, and among equals the oldest: each entry's window started windowMs before its end.
+        fewest = entries.each_with_index.sort_by { |e, i| [e["count"], e["until"], i] }.map(&:first)
+        fewest.first(entries.length - (Accounts::MAX_THROTTLED * 0.9).floor).each { |e| @store.set_setting(e["key"], nil) }
       end
     end
   end

data/lib/runlight/accounts/web.rb

@@ -127,6 +127,11 @@ module Runlight
         true
       end
 
+      # The ids of the tokens an account made.
+      def tokens_of(by)
+        @store.settings_starting_with(MADE_BY).select { |row| row["value"] == by }.map { |row| row["key"][MADE_BY.length..] }.to_set
+      end
+
       # Answers an account page or API request at a path under the base, or nil for anything else.
       # context: {"ip" => the connection's address}, optional.
       def handle(request, path, context = {})
@@ -293,7 +298,7 @@ module Runlight
             "to" => invite["email"],
             "subject" => "#{invite["invitedBy"]} invited you to Runlight",
             "text" => "#{invite["invitedBy"]} invited you to the Runlight at #{host} as #{what}.\n\nChoose a password to join:\n#{link}\n\nThe link works for seven days.\n",
-            "html" => "<div style=\"font:15px/1.6 -apple-system,BlinkMacSystemFont,'Segoe UI',Helvetica,Arial,sans-serif;color:#111827;max-width:480px\"><img src=\"https://runlight.sh/icon-192.png\" width=\"48\" height=\"48\" alt=\"Runlight\" style=\"display:block;width:48px;height:48px;margin-bottom:24px;border:0;border-radius:10px\"><p>" \
+            "html" => "<div style=\"font:15px/1.6 -apple-system,BlinkMacSystemFont,'Segoe UI',Helvetica,Arial,sans-serif;color:#111827;max-width:480px\"><div role=\"img\" aria-label=\"Runlight\" style=\"width:48px;height:48px;margin-bottom:24px;border-radius:10px;background:#111827;color:#fff;font:700 26px/48px -apple-system,BlinkMacSystemFont,Helvetica,Arial,sans-serif;text-align:center\">R</div><p>" \
                       "#{esc(invite["invitedBy"])} invited you to the Runlight at #{esc(host)} as #{esc(what)}.</p><p><a href=\"#{esc(link)}\" " \
                       "style=\"display:inline-block;padding:10px 18px;border-radius:8px;background:#111827;color:#ffffff;text-decoration:none;font-weight:600\">" \
                       "Choose a password and join</a></p><p style=\"color:#6b7280;font-size:13px\">The link works for seven days. If you were not expecting this, " \
@@ -331,7 +336,7 @@ module Runlight
           "subject" => "Sign in to Runlight",
           "text" => "Someone, most likely you, signed in to Runlight at #{host} with your password while your account was held up by too many failed tries.\n\n" \
                     "Sign in with this link within fifteen minutes:\n#{link}\n\nIf this was not you, change your password, since someone knows it.\n",
-          "html" => "<div style=\"font:15px/1.6 -apple-system,BlinkMacSystemFont,'Segoe UI',Helvetica,Arial,sans-serif;color:#111827;max-width:480px\"><img src=\"https://runlight.sh/icon-192.png\" width=\"48\" height=\"48\" alt=\"Runlight\" style=\"display:block;width:48px;height:48px;margin-bottom:24px;border:0;border-radius:10px\">" \
+          "html" => "<div style=\"font:15px/1.6 -apple-system,BlinkMacSystemFont,'Segoe UI',Helvetica,Arial,sans-serif;color:#111827;max-width:480px\"><div role=\"img\" aria-label=\"Runlight\" style=\"width:48px;height:48px;margin-bottom:24px;border-radius:10px;background:#111827;color:#fff;font:700 26px/48px -apple-system,BlinkMacSystemFont,Helvetica,Arial,sans-serif;text-align:center\">R</div>" \
                     "<p>Someone, most likely you, signed in to Runlight at #{esc(host)} with your password while your account was held up by too many failed tries.</p>" \
                     "<p><a href=\"#{esc(link)}\" style=\"display:inline-block;padding:10px 18px;border-radius:8px;background:#111827;color:#ffffff;" \
                     "text-decoration:none;font-weight:600\">Sign in</a></p><p style=\"color:#6b7280;font-size:13px\">The link works for fifteen minutes. " \
@@ -353,6 +358,12 @@ module Runlight
         if path == "/auth.js"
           return Http::Response.new(Pages.auth_js(query.get("lang") || "en"), status: 200, headers: { "content-type" => "application/javascript; charset=utf-8", "cache-control" => "public, max-age=3600" })
         end
+        # A form posted from another site, or a sibling one, could sign someone in to an account that is not theirs or
+        # plant a session, so these pages take forms only from their own. The browser says where a request came from.
+        cross_site = %w[cross-site same-site].include?(request.headers.get("sec-fetch-site") || "")
+        if cross_site && (method == "POST" || path == "/logout") && %w[/setup /login /login/code /invite /logout].include?(path)
+          return html(Pages.login_page(base, { "error" => t.call("oauth.anotherSiteTitle"), "next" => @home_path, "forgot" => @forgot }, lang), 403)
+        end
 
         if path == "/setup"
           return redirect("#{base}/login") if has_account?
@@ -431,7 +442,10 @@ module Runlight
           return signed_in_to(request, user, next_path)
         end
 
-        return redirect("#{base}/login", { "set-cookie" => session_cookie(request, "", 0) }) if path == "/logout"
+        # Signing out ends this browser's session; the account page can end them everywhere.
+        if path == "/logout"
+          return redirect("#{base}/login", { "set-cookie" => session_cookie(request, "", 0) })
+        end
 
         if path == "/invite"
           if method == "GET"
@@ -552,6 +566,12 @@ module Runlight
         return coded("Send JSON", "send_json", 415) if method == "POST" && media_type(request) != "application/json"
         return reply({ "account" => person(user) }) if path == "/api/account" && method == "GET"
 
+        # Ends the account's sessions in every browser, this one too, so a cookie copied before stops working.
+        if path == "/api/account/sign-out-everywhere" && method == "POST"
+          @accounts.end_sessions(user["id"])
+          return reply({ "ok" => true }, 200, { "set-cookie" => session_cookie(request, "", 0) })
+        end
+
         fresh = ->(updated) { { "set-cookie" => session_cookie(request, @accounts.session_for(updated, now), Accounts::SESSION_MS / 1000) } }
         if path == "/api/account/password" && method == "POST"
           input = body(request)
@@ -562,6 +582,8 @@ module Runlight
 
           begin
             updated = @accounts.set_password(user["email"], field(input, "next"), now)
+            # Asked for after a password got out: the tokens and apps the account made could still read on.
+            drop_tokens_of(user["id"]) if input["revokeTokens"] == true
             # The new password ends every other sign-in; this browser gets a fresh one.
             return reply({ "ok" => true }, 200, fresh.call(updated))
           rescue AccountError => e

data/lib/runlight/core.rb

@@ -17,12 +17,13 @@ module Runlight
   #   standalone server does. `site` and `sites` are ignored.
   # - geo: a callable taking an IP and giving { "country", "region", "city" } or nil, a location for an IP when
   #   the platform sends no location headers.
-  # - trustProxy: true (default), false, or one of "x-forwarded-for", "x-real-ip", "cf-connecting-ip". Read the
-  #   client IP from forwarding headers: the last X-Forwarded-For entry, which the nearest proxy wrote, then
-  #   X-Real-IP, then CF-Connecting-IP. Name one of them to read only that header, such as "cf-connecting-ip"
-  #   behind Cloudflare and another proxy. False reads only the connection's address, for an app nothing sits
-  #   in front of. Left unset, it warns once when a request comes straight from a public address with none of
-  #   those headers.
+  # - trustProxy: true, false, or one of "x-forwarded-for", "x-real-ip", "cf-connecting-ip". Read the client IP
+  #   from forwarding headers: the last X-Forwarded-For entry, which the nearest proxy wrote, then X-Real-IP,
+  #   then CF-Connecting-IP. Name one of them to read only that header, such as "cf-connecting-ip" behind
+  #   Cloudflare and another proxy. Left unset, the headers count only on a connection from this computer or a
+  #   private network, where proxies and load balancers connect from, so a client that reaches the app straight
+  #   from the internet cannot choose its own address. True reads them from anywhere, for a CDN that connects
+  #   from public addresses. False reads only the connection's address.
   # - linkPath: where short links on the app's own domain live, as `{linkPath}/{slug}`. Default "/go".
   # - mail: how email reports, invites, and sign-in links are sent. Either a mail service in code (a Transports
   #   config plus `from` and `fromName`), which the dashboard shows and cannot change, or a mailer of the app's
@@ -124,8 +125,10 @@ module Runlight
 
       @geo = options["geo"]
       @trust_proxy = options["trustProxy"].nil? ? true : options["trustProxy"]
-      # True until trustProxy left at its default has been seen answering a public address directly, and warned about once.
-      @warn_direct = options["trustProxy"].nil?
+      # True when trustProxy was left at its default, which believes forwarding headers only from a private address.
+      @trust_private = options["trustProxy"].nil?
+      # True until a public address has sent forwarding headers that the default did not believe, and been warned about once.
+      @warn_direct = @trust_private
       per_minute = options["rateLimit"].nil? ? 120 : options["rateLimit"]
       # false, 0, or anything that is not a positive number means no limit, never a limit of nothing.
       number = per_minute == false ? Float::NAN : Js.number(per_minute)
@@ -781,7 +784,7 @@ module Runlight
     # Cloudflare before nginx) reads only that one. Otherwise it is the connection's address: the
     # context's "ip", or else the request's own remote_address.
     def client_ip(request, context = {})
-      if @trust_proxy != false
+      if trusts?(request, context)
         h = request.headers
         last = lambda do |name|
           value = h.get(name)
@@ -799,16 +802,27 @@ module Runlight
                     end
         return Js.trim(forwarded) if !forwarded.nil? && Js.trim(forwarded) != ""
       end
-      ip = context_ip(context)
-      ip = (ip.nil? ? request.remote_address : ip).to_s
-      # A public address with no forwarding header means nothing sits in front, and then any client
-      # could name its own address in one. Said once, only when trustProxy was left at its default.
-      if @warn_direct && Safefetch.public_address?(ip)
+      connection_ip(request, context).to_s
+    end
+
+    # Whether a request's forwarding headers count. Left at its default, trustProxy believes them only on a
+    # connection from this computer or a private network, or one whose address the app did not pass on, since a
+    # client reaching the server straight from the internet could write them itself.
+    def trusts?(request, context = {})
+      return false if @trust_proxy == false
+
+      ip = connection_ip(request, context)
+      return true if !@trust_private || ip.nil? || ip.to_s == "" || !Safefetch.public_address?(ip.to_s)
+
+      # Said once: a CDN that connects from public addresses needs trustProxy set, or its visitors all look alike.
+      h = request.headers
+      if @warn_direct && (h.has?("x-forwarded-for") || h.has?("x-real-ip") || h.has?("cf-connecting-ip"))
         @warn_direct = false
-        warn("Runlight: a request came straight from a public address with no proxy in front, but trustProxy is on by default, so a client could send X-Forwarded-For and choose its own address, getting round the rate limits. Set trust_proxy: false when nothing sits in front of this server, or put a proxy in front that sets the header.")
+        warn("Runlight: a request came from a public address with forwarding headers, which are not believed by default, since a client could write them itself and choose its own address. Behind a CDN that connects from public addresses, such as Cloudflare in front of this server, set trust_proxy to the header it sets (cf-connecting-ip) or to true.")
       end
-      ip
+      false
     end
+    private :trusts?
 
     # Handles one tracker request. Bad input is dropped quietly; only a database that keeps failing raises.
     def collect(request, context = {})
@@ -834,8 +848,11 @@ module Runlight
       # another process writing the SQLite file) gets it a little later, at the time it arrived.
       at = now
       attempt = 1
+      # How far recording the hit got: its visit, and which of its writes went in. A hit tried again after a write
+      # failed skips the ones before it, so a visit's counts never take the same hit twice.
+      done = {}
       begin
-        record(payload, request, context, at)
+        record(payload, request, context, at, done)
       rescue StandardError => e
         raise if attempt >= 3 || !busy?(e)
 
@@ -872,7 +889,7 @@ module Runlight
     def link_domain_response(request, context = {})
       url = Http::Url.new(request.url)
       # A forwarded host only counts behind a proxy that sets it; otherwise any client could pick one.
-      given = forwarded_host(request) || request.headers.get("host") || url.host
+      given = forwarded_host(request, context) || request.headers.get("host") || url.host
       host = Sources.strip_www(Js.trim(given.split(",", -1).first.to_s).split(":", -1).first.to_s)
       return nil unless link_domain_set.key?(host)
 
@@ -899,7 +916,7 @@ module Runlight
     def redirect(request, slug, domain, context = {})
       init
       url = Http::Url.new(request.url)
-      host = Sources.strip_www((forwarded_host(request) || request.headers.get("host") || url.host).split(":", -1).first.to_s)
+      host = Sources.strip_www((forwarded_host(request, context) || request.headers.get("host") || url.host).split(":", -1).first.to_s)
       link = @store.link_by_slug(slug)
       # The app's own link path answers for every link, so a link whose domain
       # was removed keeps working; a link domain answers only for its own links.
@@ -1290,8 +1307,16 @@ module Runlight
 
       today = @store.salt(day, Hashing.random_salt)
       yesterday = @store.salt_if_exists(Dates.add_days(day, -1))
-      drop_old_salts(at)
-      @salts[timezone] = { "day" => day, "today" => today, "yesterday" => yesterday }
+      salts = { "day" => day, "today" => today, "yesterday" => yesterday }
+      # Kept before old salts go, so dropping yesterday's from the store drops it from here too.
+      @salts[timezone] = salts
+      begin
+        drop_old_salts(at)
+      rescue StandardError
+        @salts.delete(timezone)
+        raise
+      end
+      salts
     end
 
     # Deletes every salt no visit can still use. A day's salt counts visitors while it is that day in a
@@ -1319,11 +1344,17 @@ module Runlight
     end
 
     # The host a proxy says the request was for, read only when proxy headers are trusted, as the client's address is.
-    def forwarded_host(request)
-      @trust_proxy == false ? nil : request.headers.get("x-forwarded-host")
+    def forwarded_host(request, context = {})
+      trusts?(request, context) ? request.headers.get("x-forwarded-host") : nil
     end
 
-    def record(payload, request, context, at)
+    # The connection's own address: the context's "ip", or else the request's remote_address, or nil.
+    def connection_ip(request, context)
+      ip = context_ip(context)
+      ip.nil? ? request.remote_address : ip
+    end
+
+    def record(payload, request, context, at, done = {})
       # Managed sites load from the database in init(), so it must come first.
       init
       url = payload["url"]
@@ -1331,19 +1362,19 @@ module Runlight
       return if site.nil?
 
       if payload["kind"] == "engagement"
-        engagement(site, payload, at)
+        engagement(site, payload, at, done)
         return
       end
 
       page = Sources.parse_page(url)
-      session = nil
+      session = done["session"]
       reopen = true
       if payload["kind"] == "event" && payload["pageviewId"] != ""
         pageview = @store.pageview(site["id"], payload["pageviewId"])
         # An event joins its page's visit unless that visit began longer ago than reports look for its rows
         # (a tab left open for days); it then starts a visit of its own, as any later activity would.
         if !pageview.nil? && at - pageview["startedAt"] < Store::SqlStore::EVENT_TAIL_MS
-          session = { "id" => pageview["session"], "visitor" => pageview["visitor"] }
+          session ||= { "id" => pageview["session"], "visitor" => pageview["visitor"] }
           # A visit idle past the 30 minutes stays ended: the event counts in it without reopening it.
           reopen = at - pageview["lastAt"] <= SESSION_IDLE_MS
           if at - pageview["startedAt"] > 3_600_000
@@ -1359,8 +1390,12 @@ module Runlight
       session ||= session_for(site, request, context, page, payload["referrer"], at, {
         "screenWidth" => payload["screenWidth"], "screen" => screen, "language" => payload["language"],
       })
+      done["session"] = session
 
-      @store.touch_session(session["id"], at, payload["kind"], page["path"], reopen)
+      unless done["touched"]
+        @store.touch_session(session["id"], at, payload["kind"], page["path"], reopen)
+        done["touched"] = true
+      end
       @store.insert_event({
         "site" => site["id"],
         "ts" => at,
@@ -1401,7 +1436,7 @@ module Runlight
         "mobile" => request.headers.get("sec-ch-ua-mobile"),
         "platform" => request.headers.get("sec-ch-ua-platform"),
       }, client["screenWidth"])
-      location = Geo.locate(request.headers, ip, @geo, Js.truthy?(@trust_proxy))
+      location = Geo.locate(request.headers, ip, @geo, trusts?(request, context))
       row = {
         "id" => session["id"],
         "site" => site["id"],
@@ -1434,14 +1469,17 @@ module Runlight
       domains
     end
 
-    def engagement(site, payload, at)
+    def engagement(site, payload, at, done = {})
       return if payload["engagedMs"] <= 0
 
       pageview = @store.pageview(site["id"], payload["pageviewId"])
       # Reports look for a visit's rows only so long after it began, so later time on it is let go.
       return if pageview.nil? || at - pageview["startedAt"] >= Store::SqlStore::EVENT_TAIL_MS
 
-      @store.add_engagement(pageview["session"], payload["engagedMs"])
+      unless done["engaged"]
+        @store.add_engagement(pageview["session"], payload["engagedMs"])
+        done["engaged"] = true
+      end
       # Only a visit that began more than an hour ago can belong to a day that is already added up.
       if at - pageview["startedAt"] > 3_600_000
         @store.touched_old_visit(site["id"], pageview["startedAt"].to_i, at - ROLLUP_DELAY_MS + 3_600_000)

data/lib/runlight/dates.rb

@@ -46,6 +46,44 @@ module Runlight
       "systemv/hst10" => "Etc/GMT+10",
       # Names the database dropped and ICU kept.
       "canada/east-saskatchewan" => "America/Regina", "us/pacific-new" => "America/Los_Angeles",
+      # Old names the time zone database keeps as links in its backward file. Debian, and Ubuntu from 26.04, ship
+      # them apart (tzdata-legacy), so a system may not have them; ICU reads them as the links. From tzdata 2026e.
+      "africa/asmera" => "Africa/Asmara", "america/argentina/comodrivadavia" => "America/Argentina/Catamarca",
+      "america/buenos_aires" => "America/Argentina/Buenos_Aires", "america/catamarca" => "America/Argentina/Catamarca",
+      "america/cordoba" => "America/Argentina/Cordoba", "america/fort_wayne" => "America/Indiana/Indianapolis",
+      "america/godthab" => "America/Nuuk", "america/indianapolis" => "America/Indiana/Indianapolis",
+      "america/jujuy" => "America/Argentina/Jujuy", "america/knox_in" => "America/Indiana/Knox",
+      "america/louisville" => "America/Kentucky/Louisville", "america/mendoza" => "America/Argentina/Mendoza",
+      "america/rosario" => "America/Argentina/Cordoba", "antarctica/south_pole" => "Antarctica/McMurdo",
+      "asia/ashkhabad" => "Asia/Ashgabat", "asia/calcutta" => "Asia/Kolkata", "asia/choibalsan" => "Asia/Ulaanbaatar",
+      "asia/chungking" => "Asia/Shanghai", "asia/dacca" => "Asia/Dhaka", "asia/katmandu" => "Asia/Kathmandu",
+      "asia/macao" => "Asia/Macau", "asia/rangoon" => "Asia/Yangon", "asia/saigon" => "Asia/Ho_Chi_Minh",
+      "asia/thimbu" => "Asia/Thimphu", "asia/ujung_pandang" => "Asia/Makassar", "asia/ulan_bator" => "Asia/Ulaanbaatar",
+      "atlantic/faeroe" => "Atlantic/Faroe", "australia/act" => "Australia/Sydney", "australia/lhi" => "Australia/Lord_Howe",
+      "australia/north" => "Australia/Darwin", "australia/nsw" => "Australia/Sydney",
+      "australia/queensland" => "Australia/Brisbane", "australia/south" => "Australia/Adelaide",
+      "australia/tasmania" => "Australia/Hobart", "australia/victoria" => "Australia/Melbourne",
+      "australia/west" => "Australia/Perth", "brazil/acre" => "America/Rio_Branco", "brazil/denoronha" => "America/Noronha",
+      "brazil/east" => "America/Sao_Paulo", "brazil/west" => "America/Manaus", "canada/atlantic" => "America/Halifax",
+      "canada/central" => "America/Winnipeg", "canada/eastern" => "America/Toronto", "canada/mountain" => "America/Edmonton",
+      "canada/newfoundland" => "America/St_Johns", "canada/pacific" => "America/Vancouver",
+      "canada/saskatchewan" => "America/Regina", "canada/yukon" => "America/Whitehorse",
+      "chile/continental" => "America/Santiago", "chile/easterisland" => "Pacific/Easter", "cst6cdt" => "America/Chicago",
+      "cuba" => "America/Havana", "egypt" => "Africa/Cairo", "eire" => "Europe/Dublin", "est5edt" => "America/New_York",
+      "europe/kiev" => "Europe/Kyiv", "europe/uzhgorod" => "Europe/Kyiv", "europe/zaporozhye" => "Europe/Kyiv",
+      "gb" => "Europe/London", "gb-eire" => "Europe/London", "gmt0" => "Etc/GMT", "greenwich" => "Etc/GMT",
+      "hongkong" => "Asia/Hong_Kong", "iceland" => "Atlantic/Reykjavik", "iran" => "Asia/Tehran", "israel" => "Asia/Jerusalem",
+      "jamaica" => "America/Jamaica", "japan" => "Asia/Tokyo", "kwajalein" => "Pacific/Kwajalein", "libya" => "Africa/Tripoli",
+      "mexico/bajanorte" => "America/Tijuana", "mexico/bajasur" => "America/Mazatlan", "mexico/general" => "America/Mexico_City",
+      "mst7mdt" => "America/Denver", "navajo" => "America/Denver", "nz" => "Pacific/Auckland", "nz-chat" => "Pacific/Chatham",
+      "pacific/enderbury" => "Pacific/Kanton", "pacific/ponape" => "Pacific/Pohnpei", "pacific/truk" => "Pacific/Chuuk",
+      "poland" => "Europe/Warsaw", "portugal" => "Europe/Lisbon", "prc" => "Asia/Shanghai", "pst8pdt" => "America/Los_Angeles",
+      "roc" => "Asia/Taipei", "rok" => "Asia/Seoul", "singapore" => "Asia/Singapore", "turkey" => "Europe/Istanbul",
+      "universal" => "Etc/UTC", "us/alaska" => "America/Anchorage", "us/aleutian" => "America/Adak",
+      "us/arizona" => "America/Phoenix", "us/central" => "America/Chicago", "us/east-indiana" => "America/Indiana/Indianapolis",
+      "us/eastern" => "America/New_York", "us/hawaii" => "Pacific/Honolulu", "us/indiana-starke" => "America/Indiana/Knox",
+      "us/michigan" => "America/Detroit", "us/mountain" => "America/Denver", "us/pacific" => "America/Los_Angeles",
+      "us/samoa" => "Pacific/Pago_Pago", "w-su" => "Europe/Moscow", "zulu" => "Etc/UTC",
     }.freeze
 
     OFFSET = /\A([+\-]|−)([01][0-9]|2[0-3])(?::?([0-5][0-9]))?\z/

data/lib/runlight/http/fetcher.rb

@@ -27,7 +27,7 @@ module Runlight
       REDIRECTS = [301, 302, 303, 307, 308].freeze
       TIMED_OUT = "The operation was aborted due to timeout"
       # Sent only to the origin they were given to.
-      CREDENTIALS = %w[authorization cookie proxy-authorization x-api-key].freeze
+      CREDENTIALS = %w[authorization cookie proxy-authorization x-api-key apikey].freeze
 
       def fetch(url, init = {})
         deadline = monotonic + ((init["timeoutMs"] || 30_000).to_i / 1000.0)

data/lib/runlight/importers/client.rb

@@ -14,11 +14,9 @@ module Runlight
       ISO_DATE = /\A([+-]\d{6}|\d{4})(?:-(\d{2})(?:-(\d{2}))?)?(?:T(\d{2}):(\d{2})(?::(\d{2})(?:\.(\d{1,9}))?)?(Z|[+-]\d{2}:\d{2})?)?\z/i
       private_constant :ISO_DATE
 
-      # sleep: a callable that waits this many milliseconds. owner: true for a service at an address the owner
-      # typed (a self-hosted Umami), fetched only on the public internet, as Safefetch.owner_fetch allows.
-      def initialize(fetcher = nil, sleep = nil, owner: false)
+      # sleep: a callable that waits this many milliseconds.
+      def initialize(fetcher = nil, sleep = nil)
         @fetcher = fetcher || Http::NetFetcher.new
-        @owner = owner
         @sleep = sleep || ->(ms) { Kernel.sleep(ms / 1000.0) if ms.positive? }
       end
 
@@ -26,7 +24,9 @@ module Runlight
         @sleep.call(ms)
       end
 
-      # Fetches JSON, decoded. `init` may hold "headers", "method", and "body".
+      # Fetches JSON, decoded. `init` may hold "headers", "method", and "body". The address can come from whoever
+      # runs an import (a self-hosted Umami), so every service, a hosted one too, is asked only at public https
+      # addresses, with no redirect followed, which would carry the key somewhere else, as public_fetch allows.
       def get_json(url, init = {})
         attempt = 1
         loop do
@@ -35,7 +35,7 @@ module Runlight
           options["method"] = init["method"] unless init["method"].nil?
           options["body"] = init["body"] unless init["body"].nil?
           begin
-            response = @owner ? Safefetch.owner_fetch(url, options, @fetcher) : @fetcher.fetch(url, options)
+            response = Safefetch.public_fetch(url, options.merge("redirects" => 0), @fetcher)
           rescue PrivateAddressError, Http::BodyTooLong
             # An address off the public internet, or an answer past the cap, is the same on every try.
             host = Http::Url.new(url).host

data/lib/runlight/importers/index.rb

@@ -25,8 +25,9 @@ module Runlight
         raise ImportError.new("Runlight cannot import from #{source}", "import_source", { "source" => source }) if name.nil?
 
         runlight.init
-        # Umami is at an address the owner typed; the others are their services' own.
-        client = Client.new(runlight.fetcher, owner: source == "umami")
+        # Umami is at an address the owner typed, and the others are their services' own; each is asked only on the
+        # public internet.
+        client = Client.new(runlight.fetcher)
         importer = Importers.const_get(name).new(client, -> { runlight.now })
         known = lambda do |source_id, slug = nil, url = nil|
           return true unless runlight.store.link_by_id(Write.imported_link_id(source, Js.string(source_id))).nil?

data/lib/runlight/importers/visits.rb

@@ -36,7 +36,7 @@ module Runlight
       # The websites an Umami account can see, to pick which one becomes this site's history: a list of
       # { "id", "name", "domain" }.
       def umami_websites(credentials, fetcher = nil)
-        http = Client.new(fetcher, owner: true)
+        http = Client.new(fetcher)
         login = Umami.umami_sign_in(http, credentials)
         headers = { "authorization" => "Bearer #{Client.str(login["token"])}" }
         out = []
@@ -74,7 +74,7 @@ module Runlight
         raise ImportError.new("Unknown site", "unknown_site") if site.nil?
         raise ImportError.new("Pick the Umami website to import", "import_website") unless website.match?(/\A[A-Za-z0-9-]{1,64}\z/)
 
-        http = Client.new(runlight.fetcher, owner: true)
+        http = Client.new(runlight.fetcher)
 
         saved = !cursor.nil? && cursor != "" ? Json.decode(cursor) : nil
         login = Umami.umami_sign_in(http, credentials, saved.nil? ? nil : saved["token"])

data/lib/runlight/oauth.rb

@@ -23,7 +23,8 @@ module Runlight
   #
   # The context the routes pass is a Hash: "runlight", "base", "isOwner" (callable(request) giving a bool), and
   # optionally "signIn" (String), "isReader" (callable(request) giving a bool), "accountOf" (callable(request)
-  # giving an account id or nil), and "tokenMade" (callable(token, by) giving a bool).
+  # giving an account id or nil), "tokenMade" (callable(token, by) giving a bool), and "csrf" (callable giving the
+  # token the consent form sends back in its csrf field).
   module OAuth
     CODE_MS = 5 * 60_000
     # An app stored before client ids were signed, which never finished connecting within a day, is removed.
@@ -206,6 +207,7 @@ module Runlight
           %w[response_type client_id redirect_uri code_challenge code_challenge_method state scope resource].each do |k|
             hidden << "<input type=\"hidden\" name=\"#{k}\" value=\"#{esc(form.get(k))}\">" unless form.get(k).nil?
           end
+          hidden << "<input type=\"hidden\" name=\"csrf\" value=\"#{esc(ctx["csrf"].call.to_s)}\">" if ctx["csrf"]
           # The app names itself, so the page also shows where the answer goes, which it cannot fake.
           sends_to = "<p class=\"note\">#{h.call("oauth.sendsTo", { "host" => "<strong>#{esc(Http::Url.new(redirect).host)}</strong>" })}</p>"
           buttons = "<div class=\"buttons\"><button type=\"submit\" name=\"decision\" value=\"deny\" class=\"ghost\">#{h.call("oauth.deny")}</button>" \

data/lib/runlight/payload.rb

@@ -55,9 +55,8 @@ module Runlight
         else
           next
         end
-        # Assigning out["__proto__"] in JavaScript sets the prototype, which a string cannot be, so
-        # nothing is kept; it still counts.
-        out[k] = text if k != "__proto__"
+        # A prop named __proto__ is kept like any other, as the SDK keeps it in an object with no prototype.
+        out[k] = text
         count += 1
       end
       return nil if count.zero?
@@ -67,6 +66,20 @@ module Runlight
 
     # An object's entries in JavaScript's order: keys that are array indexes first, ascending, then the
     # rest in the order they were added.
+    # The events the tracker sends on its own for a link that was followed, each with the link as `url`.
+    LINK_EVENTS = ["Outbound link", "File download"].freeze
+    private_constant :LINK_EVENTS
+
+    # An automatic link event's `url` without its query string or fragment, as page paths are kept, since tokens and
+    # email addresses ride in them. Done here rather than in the tracker, which has no bytes to spare, and so a
+    # tracker cached from before is held to it too.
+    def link_props(name, given)
+      return given if given.nil? || !LINK_EVENTS.include?(name) || !given.key?("url")
+
+      given["url"] = given["url"].sub(/[?#].*\z/m, "")
+      given
+    end
+
     def entries(object)
       indexes = []
       names = []
@@ -124,13 +137,13 @@ module Runlight
         "screenHeight" => int(get.call("h"), 0, 20_000),
         "language" => str(get.call("l"), 35),
         "name" => name,
-        "props" => kind == "event" ? props(get.call("p")) : nil,
+        "props" => kind == "event" ? link_props(name, props(get.call("p"))) : nil,
         "pageviewId" => pageview_id,
         "engagedMs" => kind == "engagement" ? int(get.call("e"), 0, MAX_ENGAGED_MS) || 0 : 0,
         "scroll" => int(get.call("d"), 0, 100),
       }
     end
 
-    private_class_method :str, :int, :props, :entries, :parse
+    private_class_method :str, :int, :props, :link_props, :entries, :parse
   end
 end

data/lib/runlight/reports.rb

@@ -183,7 +183,7 @@ module Runlight
       u = Http::Url.parse(links["dashboard"])
       where = u.nil? ? links["dashboard"] : u.host + u.pathname.sub(%r{/\z}, "")
       at = t.call("email.at", { "where" => where })
-      mark = "<img src=\"https://runlight.sh/icon-192.png\" width=\"48\" height=\"48\" alt=\"Runlight\" style=\"display:block;width:48px;height:48px;margin-bottom:24px;border:0;border-radius:10px\">"
+      mark = "<div role=\"img\" aria-label=\"Runlight\" style=\"width:48px;height:48px;margin-bottom:24px;border-radius:10px;background:#111827;color:#fff;font:700 26px/48px -apple-system,BlinkMacSystemFont,Helvetica,Arial,sans-serif;text-align:center\">R</div>"
 
       footer = t.call("email.footer", { "frequency" => t.call(monthly ? "email.monthly" : "email.weekly"), "site" => site["name"] })
       at_line = esc(t.call("email.at", { "where" => "\0" }))