runlight 0.2.0 → 0.3.1

data/lib/runlight/routes.rb

@@ -26,11 +26,17 @@ module Runlight
   # - cms: the CMS that adds the script to every page, such as "WordPress", when Runlight runs inside one. The
   #   dashboard then says so in place of the steps to add the script, and pages of the same origin, the CMS's own
   #   admin, may show the whole dashboard in a frame. The WordPress, Drupal, and Craft plugins set it.
+  # - csrf: a callable returning a token the dashboard sends back with every change it makes, in an x-runlight-csrf
+  #   header, and the OAuth consent form in a csrf field, for an authorize that checks where a change comes from, as
+  #   a CMS checks its own forms. Asked for each time the dashboard or the form is shown. The WordPress plugin gives
+  #   a nonce.
   # - origin: the address people open the app at, such as https://example.com.
   # - ownHosts: a callable returning more names the dashboard is reached at.
   # - accountOf: a callable taking the Request and returning the account it comes from, or nil (internal, for the
   #   standalone server).
   # - tokenMade: a callable taking a token row and who made it, returning whether that is allowed (internal).
+  # - tokensOf: a callable taking an account id, returning the ids of the tokens it made, so a member sees and
+  #   revokes only their own (internal).
   class Routes
     COOKIE = "runlight_token"
     IMPLEMENTATION = { "library" => "runlight", "language" => "ruby" }.freeze
@@ -169,6 +175,7 @@ module Runlight
       @sign_out = options["signOut"].nil? ? (web ? "#{@base}/logout" : nil) : options["signOut"].to_s
       @account_of = options["accountOf"] || (web ? ->(r) { web.account_of(r) } : nil)
       @token_made = options["tokenMade"] || (web ? ->(row, by) { web.token_made(row, by) } : nil)
+      @tokens_of = options["tokensOf"] || (web ? ->(by) { web.tokens_of(by) } : nil)
       authorize = options["authorize"]
       oauth = {
         "runlight" => runlight,
@@ -179,6 +186,7 @@ module Runlight
       oauth["signIn"] = @sign_in if !@sign_in.nil? && @sign_in != ""
       oauth["accountOf"] = @account_of unless @account_of.nil?
       oauth["tokenMade"] = @token_made unless @token_made.nil?
+      oauth["csrf"] = options["csrf"] unless options["csrf"].nil?
       @oauth = oauth
     end
 
@@ -384,7 +392,7 @@ module Runlight
       # The dashboard's page, which holds no data: the API it calls checks access. `embed` is the dashboard inside a
       # CMS's admin pages: { "session", "origin" }, its session (empty once its ticket was used or ran out) and the
       # admin origin that frames it.
-      def dashboard(base, share = "", sign_out = "", geo_credit = false, accounts = false, sign_in = "", embed = nil, cms = "")
+      def dashboard(base, share = "", sign_out = "", geo_credit = false, accounts = false, sign_in = "", embed = nil, cms = "", csrf = "")
         b = escape_attr(base)
         hash = build_hash("dashboardHash")
         attributes = (share != "" ? " data-share=\"#{escape_attr(share)}\"" : "") +
@@ -393,6 +401,7 @@ module Runlight
                      (geo_credit ? ' data-geo-credit=""' : "") +
                      (accounts ? ' data-accounts=""' : "") +
                      (cms != "" ? " data-cms=\"#{escape_attr(cms)}\"" : "") +
+                     (csrf != "" ? " data-csrf=\"#{escape_attr(csrf)}\"" : "") +
                      (embed.nil? ? "" : " data-embed=\"#{escape_attr(embed["session"])}\" data-embed-origin=\"#{escape_attr(embed["origin"])}\"")
         "<!doctype html>\n<html lang=\"en\">\n<head>\n<meta charset=\"utf-8\">\n<meta name=\"viewport\" content=\"width=device-width, initial-scale=1\">\n<meta name=\"robots\" content=\"noindex\">\n<title>Runlight</title>\n" \
           "<link rel=\"icon\" href=\"#{Brand.runlight_icon}\">\n" \
@@ -471,12 +480,14 @@ module Runlight
         n.is_a?(Float) ? (n.finite? ? n.to_i : 0) : n.to_i
       end
 
-      # The controls a member cannot change: the mail service and its keys, the assistant's settings, and deleting a site.
+      # The controls a member cannot change: the mail service and its keys, the assistant's settings, a site's agents key,
+      # and deleting a site.
       def admin_only?(path, method)
         (path == "/api/mail" && %w[PUT DELETE].include?(method)) ||
           (path == "/api/assistant" && %w[PUT DELETE].include?(method)) ||
           (path == "/api/assistant/limits" && method == "PUT") ||
           (path == "/api/assistant/models" && method == "POST") ||
+          (path == "/api/observe-key/new" && method == "POST") ||
           (path.match?(%r{\A/api/sites/[^/]+\z}) && method == "DELETE")
       end
 
@@ -1253,7 +1264,7 @@ module Runlight
             "to" => to,
             "subject" => t.call("email.test.subject"),
             "text" => t.call("email.test.body", { "service" => name }),
-            "html" => "<img src=\"https://runlight.sh/icon-192.png\" width=\"48\" height=\"48\" alt=\"Runlight\" style=\"display:block;width:48px;height:48px;margin-bottom:24px;border:0;border-radius:10px\"><p style=\"font-family:sans-serif;font-size:15px\">#{escape_html(t.call("email.test.body", { "service" => name }))}</p>",
+            "html" => "<div role=\"img\" aria-label=\"Runlight\" style=\"width:48px;height:48px;margin-bottom:24px;border-radius:10px;background:#111827;color:#fff;font:700 26px/48px -apple-system,BlinkMacSystemFont,Helvetica,Arial,sans-serif;text-align:center\">R</div><p style=\"font-family:sans-serif;font-size:15px\">#{escape_html(t.call("email.test.body", { "service" => name }))}</p>",
           })
           # Counted once it went out, so a test that failed can be tried again as soon as the setting is fixed.
           @lock.synchronize { @sample_sent[tested] = @rl.now }
@@ -1481,13 +1492,23 @@ module Runlight
       nil
     end
 
+    # The tokens the account behind a request made: none when nothing notes who made what.
+    def own_tokens(request)
+      by = @account_of&.call(request)
+      !by.nil? && by != "" && @tokens_of ? @tokens_of.call(by) : Set.new
+    end
+
     def tokens_api(request, path)
       @rl.init
       view = lambda do |t|
         { "id" => t["id"], "name" => t["name"], "site" => t["site"], "scope" => t["scope"], "hint" => t["hint"],
           "createdAt" => t["createdAt"], "lastUsedAt" => t["lastUsedAt"] }
       end
-      return json({ "tokens" => store.tokens.map(&view) }) if path == "/api/tokens" && request.method == "GET"
+      # A member makes tokens like anyone who manages sites, but sees and revokes only the ones they made.
+      mine = @members.key?(request) ? own_tokens(request) : nil
+      if path == "/api/tokens" && request.method == "GET"
+        return json({ "tokens" => store.tokens.select { |t| mine.nil? || mine.include?(t["id"]) }.map(&view) })
+      end
 
       if path == "/api/tokens" && request.method == "POST"
         body = read_json(request)
@@ -1517,6 +1538,8 @@ module Runlight
         return json({ "token" => view.call(row), "secret" => secret }, 201)
       end
       if (match = path.match(%r{\A/api/tokens/([a-f0-9]{24})\z})) && request.method == "DELETE"
+        return coded("Unknown token", "unknown_token", 404) if mine && !mine.include?(match[1])
+
         return store.delete_token(match[1]) ? json({ "ok" => true }) : coded("Unknown token", "unknown_token", 404)
       end
 
@@ -1898,7 +1921,7 @@ module Runlight
       end
       return chat(request, url) if path == "/api/assistant/chat" && method == "POST"
 
-      # Only the owner manages tokens: an API token cannot make or revoke one.
+      # Only people at the dashboard manage tokens, a member only their own: an API token cannot make or revoke one.
       if path == "/api/tokens" || path.start_with?("/api/tokens/")
         access = can_read(request)
         return denied(access) if access != true
@@ -2456,8 +2479,10 @@ module Runlight
         return json({ "site" => site["id"], "funnels" => store.funnels(site["id"]) }) if params.get("definitions") == "1"
         # One funnel at a time, so a page of funnels never takes every database connection at once.
         rows = store.funnels(site["id"]).map do |funnel|
-          counts = store.funnel_counts(query, funnel)
-          funnel.merge("steps" => funnel["steps"].each_with_index.map { |step, i| step.merge("visits" => counts[i]) })
+          counted = store.funnel_counts(query, funnel)
+          counts = counted["counts"]
+          row = funnel.merge("steps" => funnel["steps"].each_with_index.map { |step, i| step.merge("visits" => counts[i]) })
+          counted["sampled"] ? row.merge("sampled" => store.funnel_visits) : row
         end
         return json({ "site" => site["id"], "range" => range_out, "funnels" => rows })
       end
@@ -2711,7 +2736,7 @@ module Runlight
         # the page explains how to sign in when it is refused.
         # Inside a CMS, its admin, on this same origin, shows the whole dashboard in a frame; nothing else may.
         cms = @options["cms"].to_s
-        return Http::Response.new(dashboard(base, "", @sign_out || "", Js.truthy?(@options["geoCredit"]), !@web.nil?, @sign_in || "", nil, cms), status: 200, headers: {
+        return Http::Response.new(dashboard(base, "", @sign_out || "", Js.truthy?(@options["geoCredit"]), !@web.nil?, @sign_in || "", nil, cms, @options["csrf"].nil? ? "" : @options["csrf"].call.to_s), status: 200, headers: {
           "content-type" => "text/html; charset=utf-8",
           "cache-control" => "no-store",
           "content-security-policy" => cms != "" ? DASHBOARD_CSP.sub("frame-ancestors 'none'", "frame-ancestors 'self'") : DASHBOARD_CSP,

data/lib/runlight/safefetch.rb

@@ -80,22 +80,30 @@ module Runlight
       return false if g.nil?
 
       embedded = ->(hi, lo) { [hi >> 8, hi & 255, lo >> 8, lo & 255] }
-      zero = ->(groups) { groups.all?(&:zero?) }
-      # IPv4 inside IPv6: mapped (::ffff:0:0/96), the old compatible form (::/96), and NAT64 (64:ff9b::/96).
-      if zero.call(g[0, 5]) && (g[5] == 0xffff || g[5].zero?)
-        return g[5].zero? && g[6].zero? && g[7] <= 1 ? false : public_v4?(embedded.call(g[6], g[7]))
-      end
-      return public_v4?(embedded.call(g[6], g[7])) if g[0] == 0x64 && g[1] == 0xff9b && zero.call(g[2, 4])
+      # IPv4 inside IPv6: mapped (::ffff:0:0/96), the old compatible form (::/96), translated (::ffff:0:0:0/96),
+      # and NAT64 (64:ff9b::/96).
+      inside = embedded_v4(g)
+      return g[5].zero? && g[4].zero? && g[6].zero? && g[7] <= 1 ? false : public_v4?(inside) unless inside.nil?
       # 6to4 carries an IPv4 address in its second and third groups.
       return public_v4?(embedded.call(g[1], g[2])) if g[0] == 0x2002
-      return false if (g[0] & 0xfe00) == 0xfc00 || (g[0] & 0xffc0) == 0xfe80 || (g[0] & 0xff00) == 0xff00
-      # Teredo, documentation, and discard prefixes.
-      return false if g[0] == 0x2001 && (g[1].zero? || g[1] == 0xdb8)
-      return false if g[0] == 0x100 && zero.call(g[1, 3])
+      # Only global unicast (2000::/3) is public, which leaves out unique local, link-local, the old site-local,
+      # multicast, discard, and local-use NAT64 (64:ff9b:1::/48), which may carry any address.
+      return false if (g[0] & 0xe000) != 0x2000
+      # The protocol assignments (2001::/23, with Teredo and ORCHID) and the documentation prefixes.
+      return false if g[0] == 0x2001 && (g[1] < 0x200 || g[1] == 0xdb8)
+      return false if (g[0] & 0xfff0) == 0x3ff0
 
       true
     end
 
+    # The IPv4 address inside a mapped, compatible, translated, or NAT64 IPv6 address, or nil.
+    def embedded_v4(g)
+      inside = (g[0, 5].all?(&:zero?) && (g[5] == 0xffff || g[5].zero?)) ||
+               (g[0, 4].all?(&:zero?) && g[4] == 0xffff && g[5].zero?) ||
+               (g[0] == 0x64 && g[1] == 0xff9b && g[2, 4].all?(&:zero?))
+      inside ? [g[6] >> 8, g[6] & 255, g[7] >> 8, g[7] & 255] : nil
+    end
+
     # Names clouds give their metadata services.
     METADATA_NAMES = %w[metadata metadata.google.internal metadata.goog instance-data instance-data.ec2.internal].freeze
 
@@ -105,10 +113,8 @@ module Runlight
     def metadata_address?(ip)
       four = v4(ip)
       g = four.nil? ? v6(ip) : nil
-      # IPv4 inside IPv6, mapped (::ffff:0:0/96), compatible (::/96), or NAT64 (64:ff9b::/96), is read as IPv4.
-      if four.nil? && !g.nil? && ((g[0, 5].all?(&:zero?) && (g[5] == 0xffff || g[5].zero?)) || (g[0] == 0x64 && g[1] == 0xff9b && g[2, 4].all?(&:zero?)))
-        four = [g[6] >> 8, g[6] & 255, g[7] >> 8, g[7] & 255]
-      end
+      # IPv4 inside IPv6, mapped, compatible, translated, or NAT64, is read as IPv4.
+      four = embedded_v4(g) if four.nil? && !g.nil?
       return (four[0] == 169 && four[1] == 254) || four == [100, 100, 100, 200] unless four.nil?
       return false if g.nil?
       return true if (g[0] & 0xffc0) == 0xfe80

data/lib/runlight/server/config.rb

@@ -16,7 +16,8 @@ module Runlight
     #   RUNLIGHT_SECRET       signs sessions and encrypts saved keys (made and kept in DATA_DIR if unset)
     #   RUNLIGHT_TOKEN        also accepted as a bearer token on the API, and makes the first account
     #   RUNLIGHT_URL          the dashboard's public address, which can never become a link domain
-    #   TRUST_PROXY           "false" when no proxy sits in front, so forwarded addresses are ignored
+    #   TRUST_PROXY           unset believes forwarded addresses only from a private network; "false" never,
+    #                         "true" from anywhere, or the one header a CDN sets, such as cf-connecting-ip
     #   RUNLIGHT_GEO          city (the default), country, off, or the path to an MMDB file
     #   CRON_SECRET           lets a scheduler run the check over HTTP, at POST /api/check
     #   RUNLIGHT_OBSERVE_KEY  one key for every site's AI agent reports
@@ -115,7 +116,7 @@ module Runlight
       end
 
       # false with nothing in front, or the one header your proxy sets, such as cf-connecting-ip behind Cloudflare.
-      # Unset stays nil, so the library's default applies and it can warn when nothing sits in front.
+      # Unset stays nil, so the library's default applies: forwarding headers count only from a private address.
       def trust_proxy
         value = (get("TRUST_PROXY") || "").downcase
         return nil if value == ""

data/lib/runlight/store/sql.rb

@@ -27,6 +27,8 @@ module Runlight
 
       # The most visits journeys reads, newest first.
       JOURNEY_VISITS = 20_000
+      # The most visits a funnel is counted over: the newest in the range, so its rows fit in memory over any range.
+      FUNNEL_VISITS = 100_000
 
       # How long after a visit starts its events are looked for: far past any real visit.
       EVENT_TAIL_MS = 2 * 86_400_000

data/lib/runlight/store/sql_store.rb

@@ -25,6 +25,7 @@ module Runlight
     class SqlStore
       BOUNCE_MS = Sql::BOUNCE_MS
       JOURNEY_VISITS = Sql::JOURNEY_VISITS
+      FUNNEL_VISITS = Sql::FUNNEL_VISITS
       EVENT_TAIL_MS = Sql::EVENT_TAIL_MS
       MYSQL_COLLATION = Sql::MYSQL_COLLATION
 
@@ -34,6 +35,8 @@ module Runlight
       attr_reader :db,
                   # What the store's table and index names start with: `rl_` unless it was given another.
                   :prefix
+      # The most visits a funnel is counted over; smaller in tests, to try the cap.
+      attr_accessor :funnel_visits
 
       # `prefix` takes the place of `rl_` at the start of every table and index name, so two apps can each keep
       # Runlight's tables in one database. A database that is already prefixed keeps its own.
@@ -45,6 +48,7 @@ module Runlight
         end
         @db = db
         @prefix = prefix
+        @funnel_visits = FUNNEL_VISITS
         @ready = false
         @checked_all = false
       end
@@ -575,7 +579,18 @@ module Runlight
       # How many visits reached each step, in order, within the same visit. Step
       # one is the first matching row in the range; each later step must come
       # after the step before it. Filters choose which visits enter the funnel.
+      # {"counts" => Array<Integer>, "sampled" => bool}
       def funnel_counts(query, funnel)
+        # Past funnel_visits visits in the range, only the newest are counted: the range starts where the oldest
+        # of them began.
+        scope = Sql.visit_scope(query["filters"], query["site"], query["from"], query["to"], @db.dialect)
+        first = @db.all(
+          "SELECT COUNT(*) AS n, MIN(started_at) AS t FROM (SELECT s.started_at AS started_at FROM rl_sessions s WHERE s.site = ? AND s.started_at >= ? AND s.started_at < ? AND #{Sql::IS_VISIT}#{scope["sql"]}
+         ORDER BY s.started_at DESC, s.id LIMIT #{@funnel_visits + 1}) x",
+          [query["site"], query["from"], query["to"], *scope["params"]],
+        )[0] || {}
+        sampled = Sql.num(first["n"]) > @funnel_visits
+        query = query.merge("from" => [query["from"], Sql.num(first["t"]) + 1].max) if sampled
         # The rows of the picked visits that match any step, in order, read once and walked here: a join from
         # each step to the next is planned badly by Postgres, which cannot guess how many visits go on.
         v = Sql.visit_rows(query["filters"], query["site"], query["from"], query["to"], @db.dialect)
@@ -611,7 +626,7 @@ module Runlight
           reached += 1 if reached < counts.length && Sql.num(row["m#{reached}"]) == 1
         end
         close.call
-        counts
+        { "counts" => counts, "sampled" => sampled }
       end
 
       # Each visit's pageviews in order, at most `per_visit` of them, for journeys.

data/lib/runlight/version.rb

@@ -4,7 +4,7 @@ require "json"
 
 module Runlight
   # The gem's own version, which the release keeps equal to the npm package's.
-  GEM_VERSION = "0.2.0"
+  GEM_VERSION = "0.3.1"
 
   # The SDK's version and the HTTP API's, read from assets/build.json, which
   # scripts/ruby-assets.mts writes from the TypeScript SDK, so the two always

metadata

@@ -1,14 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: runlight
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.3.1
 platform: ruby
 authors:
 - Jon C. Phillips
-autorequire: 
 bindir: exe
 cert_chain: []
-date: 2026-10-18 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activerecord
@@ -33,7 +32,6 @@ dependencies:
 description: 'Mount the Rails engine or the Rack app, add a script tag, and read your
   stats at /runlight. The Ruby port of the runlight npm package: same tables, same
   answers, same dashboard.'
-email: 
 executables:
 - runlight
 extensions: []
@@ -157,7 +155,6 @@ metadata:
   bug_tracker_uri: https://github.com/runlightsh/runlight/issues
   documentation_uri: https://runlight.sh/docs/ruby/
   rubygems_mfa_required: 'true'
-post_install_message: 
 rdoc_options: []
 require_paths:
 - lib
@@ -172,8 +169,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.0.3.1
-signing_key: 
+rubygems_version: 3.6.9
 specification_version: 4
 summary: Privacy friendly web analytics that lives inside your Ruby app.
 test_files: []