@bkazemi/verily 0.8.0 → 0.9.0

package/dist/instance/index.js

@@ -1,5 +1,5 @@
 import { dialogPath, dialogRoute, lastProved, localSide, routeOf, routes, statusLabel, } from '../core/index.js';
-import { escape } from '../server/escape.js';
+import { html, raw } from '../server/html.js';
 import { card, date, distance, externalCard, marked, page, verdict } from '../server/render.js';
 import { toneOf } from '../marks.js';
 import { version } from '../version.js';
@@ -8,8 +8,11 @@ import { recordStorage } from './store.js';
 import { OwnerAuth } from './auth.js';
 import { sessionCookie, Sites, peek } from './sites.js';
 import { allow, client, limits, prune } from './limits.js';
+import { recheckSites, Registrations } from './register.js';
+import { Dashboard } from './dashboard.js';
+import { OwnerSites } from './owner-sites.js';
 import { own } from './routes.js';
-import { html, safeHeaders, unavailable } from './page.js';
+import { respond, safeHeaders, see, unavailable } from './page.js';
 export { fromEnv } from './env.js';
 export { registry } from './sites.js';
 export { recordStorage } from './store.js';
@@ -18,16 +21,19 @@ export { recordStorage } from './store.js';
  * reaches it either holds the owner key or has no business past it, so it carries one
  * field and no account of what lies behind.
  */
-const signIn = (message = '', status = 200) => html('Sign in', `${message}<form action="/login" method="post"><label>Owner key <input name="key" type="password" autocomplete="current-password" required></label><button>Sign in</button></form>`, status, 'single');
+const signIn = (message, status = 200) => respond('Sign in', html `
+      ${message}
+      <form action="/login" method="post">
+        <label>
+          Owner key
+          <input name="key" type="password" autocomplete="current-password" required>
+        </label>
+        <button>Sign in</button>
+      </form>
+    `, status, 'single');
 const redirect = (cookie) => see('/', [cookie]);
-function see(location, cookies = []) {
-    const headers = new Headers({ ...safeHeaders, Location: location });
-    for (const cookie of cookies)
-        headers.append('Set-Cookie', cookie);
-    return new Response(null, { status: 303, headers });
-}
 /** Every refused handoff looks the same, so nobody can learn which check it failed. */
-const refused = () => html('Link expired', '<p>This link has expired or was already used. Start again from the site that sent you.</p>', 403, 'single');
+const refused = () => respond('Link expired', html `<p>This link has expired or was already used. Start again from the site that sent you.</p>`, 403, 'single');
 /**
  * Whether a request is for one of the library's own management routes, which a site
  * session does not get. Which routes those are is the library's to say.
@@ -102,7 +108,7 @@ function parsed(text) {
  * belongs to, so a page elsewhere cannot have someone sign in to a flow it started.
  */
 const enterScript = `const status=document.getElementById('status');const fail=()=>{status.textContent='This window could not start the sign-in. Close it and try again.'};let taken=false;if(!window.opener)fail();else{window.addEventListener('message',async(event)=>{const d=event.data;if(taken||event.source!==window.opener||!d||d.type!=='verily-enter'||typeof d.flow!=='string'||typeof d.binding!=='string'||typeof d.url!=='string')return;taken=true;let target;try{target=new URL(d.url)}catch{return fail()}if(target.protocol!=='https:')return fail();const response=await fetch('/site/enter',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({flow:d.flow,binding:d.binding,origin:event.origin})}).catch(()=>undefined);if(!response||!response.ok)return fail();location.replace(target.href)});window.opener.postMessage({type:'verily-enter'},'*')}`;
-const enterPage = () => new Response(page('', 'Sign in', '<p id="status">Opening the sign-in page.</p>', 'single', '/site/enter.js'), {
+const enterPage = () => new Response(page('', 'Sign in', html `<p id="status">Opening the sign-in page.</p>`, 'single', '/site/enter.js'), {
     headers: {
         ...safeHeaders,
         'Content-Type': 'text/html; charset=utf-8',
@@ -156,7 +162,7 @@ export async function admit(request, origin) {
         body = await boundedBody(request);
     }
     catch {
-        return html('Request too large', '', 413, 'single');
+        return respond('Request too large', html ``, 413, 'single');
     }
     return new Request(request.url, {
         method: request.method,
@@ -175,6 +181,9 @@ class Server {
     origin;
     auth;
     sites;
+    registrations;
+    dashboard;
+    ownerSites;
     local;
     constructor(options) {
         this.options = options;
@@ -185,7 +194,11 @@ class Server {
         this.store = options.store;
         this.auth = new OwnerAuth(this.store, options.ownerKey);
         this.sites = new Sites(this.store, options.sites ?? new Map());
-        const siteOrigins = [...this.sites.sites.values()].map((site) => site.origin);
+        this.dashboard = new Dashboard(this.store, this.sites, options.providers, origin.host, options.reportUrl);
+        this.ownerSites = new OwnerSites(this.store, this.sites);
+        if (options.registration === 'open')
+            this.registrations = new Registrations(this.store, this.sites, this.origin, options.dns);
+        const ownerOrigin = new URL(options.owner.profileUrl).origin;
         // A site with no user accounts must not have its subject described as one, so the
         // owner's kind is whatever the host gave, absent included.
         this.local = { id: 'site-owner', ...options.owner };
@@ -198,7 +211,7 @@ class Server {
                 : { signingKey: options.signingKey ?? (() => this.signingKey()) }),
             // Whether this origin's DNS names its signing key, and whether a site's names this
             // instance as its verifier. Both go to the resolver the domain method already asks.
-            dns: true,
+            dns: options.dns ?? true,
             // The whole origin is this instance, so the library's routes sit at its root.
             baseUrl: this.origin,
             siteName: options.siteName,
@@ -209,8 +222,9 @@ class Server {
             // Each published proof is re-read every six hours, so one taken down is noticed soon.
             recheckMs: options.recheckMs ?? 6 * 3600000,
             // Every site's origin, since the library checks one list. That a subject's profile
-            // is on its own site's origin is checked when its handoff arrives.
-            profileOrigins: [new URL(options.owner.profileUrl).origin, ...siteOrigins],
+            // is on its own site's origin is checked when its handoff arrives. Asked each time,
+            // since sites registered here come and go while the instance runs.
+            profileOrigins: () => [ownerOrigin, ...[...this.sites.sites.values()].map((s) => s.origin)],
             reportUrl: options.reportUrl,
             // A site session is the more specific: it was opened for this holder moments ago.
             authenticate: async (request) => (await this.sites.open(request))?.session.local ??
@@ -226,8 +240,15 @@ class Server {
                     }
                     : undefined;
             },
-            // A site's holders get the providers that site chose. The owner has no site.
-            providersFor: (local) => this.siteOf(local)?.providers,
+            // A site's holders get the providers that site chose, less any the owner has not
+            // approved it for. A holder whose site is gone gets none, rather than every one. The
+            // owner has no site.
+            providersFor: (local) => {
+                const site = this.siteOf(local);
+                if (!site)
+                    return local.id.includes(':') ? [] : undefined;
+                return this.sites.providers(site, options.providers.map((provider) => provider.id));
+            },
             visibilityFor: (local) => this.siteOf(local)?.visibility,
             finish: ({ id, context, local, result }) => this.sites.finish(id, context, local, result),
         });
@@ -247,6 +268,7 @@ class Server {
         await this.app.service.recheck(this.options.recheckBudget ?? 10);
         await this.auth.prune();
         await prune(this.store);
+        await recheckSites(this.store, this.sites, this.origin, this.options.dns);
     }
     /**
      * Answers one request. `address` is the client's address as the host knows it, which
@@ -256,11 +278,12 @@ class Server {
     async handle(request, address = null) {
         let response;
         try {
+            await this.sites.refresh();
             const admitted = await admit(request, this.origin);
             response = admitted instanceof Response ? admitted : await this.route(admitted, address);
         }
         catch {
-            response = html('Temporarily unavailable', '<p>Try again shortly.</p>', 503, 'single');
+            response = respond('Temporarily unavailable', html `<p>Try again shortly.</p>`, 503, 'single');
         }
         // An approval or disconnect form redirects on to the holder's site, and Chromium holds
         // a form's redirects to form-action. Only a holder that site sent here is told its
@@ -283,7 +306,7 @@ class Server {
                 !request.headers.get('content-type')?.startsWith('application/json'))
                 return unavailable(403);
             if (!(await this.allowed(request, url, address)))
-                return html('Too many requests', '<p>Try again later.</p>', 429, 'single');
+                return respond('Too many requests', html `<p>Try again later.</p>`, 429, 'single');
             return this.enter(request);
         }
         if (request.method === 'POST' &&
@@ -298,11 +321,13 @@ class Server {
         if (request.headers.has('authorization') && dialogPath(url.pathname))
             return shared(await this.dialog(request, url, address), request);
         if (!(await this.allowed(request, url, address)))
-            return html('Too many requests', '<p>Try again later.</p>', 429, 'single');
+            return respond('Too many requests', html `<p>Try again later.</p>`, 429, 'single');
         if (request.method === 'POST' && url.pathname === '/site/session') {
-            const opened = await this.sites.dialog(String((await fields(request)).token ?? ''), request.headers.get('origin'), (local) => this.app.service.validateLocal(local), (site) => allow(this.store, [{ key: `site/${site.id}`, limit: limits.site }]));
+            const opened = await this.sites.dialog(String((await fields(request)).token ?? ''), request.headers.get('origin'), (local) => this.app.service.validateLocal(local), (site) => allow(this.store, [
+                { key: `site/${site.id}`, limit: this.sites.limit(site.id) ?? limits.site },
+            ]));
             return shared(opened === 'limited'
-                ? html('Too many requests', '<p>Try again later.</p>', 429, 'single')
+                ? respond('Too many requests', html `<p>Try again later.</p>`, 429, 'single')
                 : opened
                     ? data({ session: opened.session })
                     : unavailable(), request);
@@ -316,10 +341,10 @@ class Server {
         if (request.method === 'POST') {
             if (url.pathname === '/login') {
                 if (!(await this.auth.allow('login', 10, 15 * 60000)))
-                    return html('Too many requests', '<p>Try again in fifteen minutes.</p>', 429, 'single');
+                    return respond('Too many requests', html `<p>Try again in fifteen minutes.</p>`, 429, 'single');
                 const key = new URLSearchParams(await request.text()).get('key') ?? '';
                 const cookie = await this.auth.login(key);
-                return cookie ? redirect(cookie) : signIn('<p>Incorrect owner key.</p>', 403);
+                return cookie ? redirect(cookie) : signIn(html `<p>Incorrect owner key.</p>`, 403);
             }
             if (url.pathname === '/logout')
                 return redirect(await this.auth.logout(request));
@@ -329,7 +354,37 @@ class Server {
                 return this.disconnect(request);
             if (url.pathname === '/mark')
                 return this.mark(request);
+            if (url.pathname.startsWith('/sites/'))
+                return (await this.auth.authenticated(request))
+                    ? this.ownerSites.change(url.pathname, request)
+                    : unavailable(403);
+            if (url.pathname === '/site/dashboard/login')
+                return this.dashboard.login(request);
+            if (url.pathname === '/site/dashboard/logout')
+                return this.dashboard.logout(request);
+            if (url.pathname === '/site/dashboard/settings')
+                return this.dashboard.settings(request);
+            if (url.pathname === '/site/dashboard/rotate')
+                return this.dashboard.rotate(request);
+            if (url.pathname === '/site/dashboard/previous-key')
+                return this.dashboard.retirePreviousKey(request);
+            if (url.pathname === '/site/dashboard/delete')
+                return this.dashboard.delete(request);
+            if (this.registrations) {
+                if (url.pathname === '/register')
+                    return this.registrations.request(request);
+                if (url.pathname === '/register/check')
+                    return this.registrations.check(request);
+                if (url.pathname === '/register/cancel')
+                    return this.registrations.cancel();
+            }
         }
+        if (request.method === 'GET' && url.pathname === '/site/dashboard')
+            return this.dashboard.page(request);
+        if (request.method === 'GET' && url.pathname === '/sites')
+            return (await this.auth.authenticated(request)) ? this.ownerSites.page() : unavailable();
+        if (request.method === 'GET' && url.pathname === '/register' && this.registrations)
+            return this.registrations.page(request);
         if (request.method === 'GET' && url.pathname === '/site/connections')
             return this.read(request, address);
         if (request.method === 'GET' && url.pathname === '/handoff/request') {
@@ -386,14 +441,27 @@ class Server {
         if (found?.session.operation && found.session.operation.finishedAt === undefined) {
             const { connection, mark } = found.session.operation;
             return mark
-                ? html('Change not finished', `<p>Changing how this account is listed did not finish.</p><form action="/mark" method="post"><input type="hidden" name="connection" value="${escape(connection)}"><input type="hidden" name="as" value="${escape(mark)}"><button>Try again</button></form>`, 200, 'single')
-                : html('Disconnect not finished', `<p>Removing this link did not finish.</p><form action="/disconnect" method="post"><input type="hidden" name="connection" value="${escape(connection)}"><button>Try again</button></form>`, 200, 'single');
+                ? respond('Change not finished', html `
+              <p>Changing how this account is listed did not finish.</p>
+              <form action="/mark" method="post">
+                <input type="hidden" name="connection" value="${connection}">
+                <input type="hidden" name="as" value="${mark}">
+                <button>Try again</button>
+              </form>
+            `, 200, 'single')
+                : respond('Disconnect not finished', html `
+              <p>Removing this link did not finish.</p>
+              <form action="/disconnect" method="post">
+                <input type="hidden" name="connection" value="${connection}">
+                <button>Try again</button>
+              </form>
+            `, 200, 'single');
         }
         if (await this.auth.authenticated(request))
             return this.settings(this.local);
         if (found) {
             const site = this.site(found.session);
-            return html('Session ended', `<p>You are finished here. <a href="${escape(site.origin)}">Return to ${escape(site.name)}</a> to start again.</p>`, 200, 'single');
+            return respond('Session ended', html `<p>You are finished here. <a href="${site.origin}">Return to ${site.name}</a> to start again.</p>`, 200, 'single');
         }
         return signIn();
     }
@@ -409,7 +477,7 @@ class Server {
         // here never reaches the counting a served one gets, and each costs a lookup.
         const turnedAway = async () => (await allow(this.store, [{ key: client(address), limit: limits.client }]))
             ? unavailable()
-            : html('Too many requests', '<p>Try again later.</p>', 429, 'single');
+            : respond('Too many requests', html `<p>Try again later.</p>`, 429, 'single');
         const session = request.headers.get('authorization')?.match(/^Bearer (\S+)$/)?.[1] ?? '';
         const binding = request.headers.get(flowHeader) ?? '';
         const post = request.method === 'POST';
@@ -444,7 +512,7 @@ class Server {
         if (!found || this.site(found.session).origin !== request.headers.get('origin'))
             return turnedAway();
         if (!(await this.allowed(inner, url, address)))
-            return html('Too many requests', '<p>Try again later.</p>', 429, 'single');
+            return respond('Too many requests', html `<p>Try again later.</p>`, 429, 'single');
         const response = await this.app.handle(inner);
         const answer = new Response(response.body, response);
         const set = response.headers
@@ -489,10 +557,10 @@ class Server {
         const asked = this.sites.read(request.headers.get('authorization')?.match(/^Bearer (\S+)$/)?.[1] ?? '');
         if (!(await allow(this.store, [
             asked
-                ? { key: `read/${asked.site.id}`, limit: limits.read }
+                ? { key: `read/${asked.site.id}`, limit: this.sites.limit(asked.site.id) ?? limits.read }
                 : { key: client(address), limit: limits.client },
         ])))
-            return html('Too many requests', '<p>Try again later.</p>', 429, 'single');
+            return respond('Too many requests', html `<p>Try again later.</p>`, 429, 'single');
         if (!asked)
             return unavailable();
         // No prototype, so an id such as `__proto__` is an entry like any other.
@@ -545,7 +613,7 @@ class Server {
         const site = named && this.sites.sites.has(named) ? named : undefined;
         return allow(this.store, [
             holder,
-            ...(site ? [{ key: `site/${site}`, limit: limits.site }] : []),
+            ...(site ? [{ key: `site/${site}`, limit: this.sites.limit(site) ?? limits.site }] : []),
         ]);
     }
     /**
@@ -581,7 +649,7 @@ class Server {
             connection,
             visibility: current.operation.visibility,
             finishedAt: current.operation.finishedAt,
-        }));
+        }, session.signer));
     }
     /**
      * Lists an account another way, or retires it, from a site session, and reports it back
@@ -617,7 +685,7 @@ class Server {
             connection,
             visibility: current.operation.visibility,
             finishedAt: current.operation.finishedAt,
-        }));
+        }, session.signer));
     }
     /**
      * The settings page for whoever is signed in: the owner, or a holder a site sent here.
@@ -630,13 +698,28 @@ class Server {
         const now = Date.now();
         // The copy button's script, on the one page that has something to copy.
         const embeds = !site && connections.some((e) => e.visibility === 'public');
-        return html(site ? 'Your connections' : 'Owner settings', `${card(local.heading, local.value, undefined, subject.reference)}
-      <p class="links"><a class="button" href="/verify">Verify an account</a>${site ? '' : '<a href="/records">Every connection on this instance</a>'}</p>
-      ${connections.length
-            ? `<p class="fine">Renewing a connection extends it and keeps its ID, so anything that shows it goes on working.${site ? '' : ' Only a public connection can be embedded.'}</p>`
-            : '<p>No connections yet. Verify an account to make the first one.</p>'}
-      ${connections.map((e) => this.connection(e, now, site)).join('')}
-      ${site ? `<p><a href="${escape(site.origin)}">Back to ${escape(site.name)}</a></p>` : '<form action="/logout" method="post"><button>Sign out</button></form>'}`, 200, '', embeds ? '/copy.js' : '');
+        return respond(site ? 'Your connections' : 'Owner settings', html `
+        ${card(local.heading, local.value, undefined, subject.reference)}
+        <p class="links">
+          <a class="button" href="/verify">Verify an account</a>${!site &&
+            html `
+              <a href="/records">Every connection on this instance</a>
+              <a href="/sites">Registered sites</a>
+            `}
+        </p>
+        ${connections.length
+            ? html `
+                <p class="fine">
+                  Renewing a connection extends it and keeps its ID, so anything that shows it
+                  goes on working.${site ? '' : ' Only a public connection can be embedded.'}
+                </p>
+              `
+            : html `<p>No connections yet. Verify an account to make the first one.</p>`}
+        ${connections.map((e) => this.connection(e, now, site))}
+        ${site
+            ? html `<p><a href="${site.origin}">Back to ${site.name}</a></p>`
+            : html `<form action="/logout" method="post"><button>Sign out</button></form>`}
+      `, 200, '', embeds ? '/copy.js' : '');
     }
     /**
      * Every record the instance holds, for its operator: each site's subjects, public and
@@ -649,28 +732,45 @@ class Server {
         const count = (visibility) => all.filter((e) => e.visibility === visibility).length;
         const live = (e) => ['Verified', 'Unconfirmed'].includes(statusLabel(e, now));
         const sites = [...new Set(all.map((e) => e.siteName))];
-        return html('All connections', `<p class="fine">${all.length} on this instance: ${count('public')} public, ${count('unlisted')} unlisted.</p>
-      ${sites
-            .map((name) => {
+        return respond('All connections', html `
+        <p class="fine">
+          ${all.length} on this instance: ${count('public')} public, ${count('unlisted')} unlisted.
+        </p>
+        ${sites.map((name) => {
             // Live records first. The sort is stable, so each half keeps the stored order.
             const records = all
                 .filter((e) => e.siteName === name)
                 .sort((a, b) => Number(live(b)) - Number(live(a)));
-            return `<h2>${escape(name)} · ${records.length}</h2>${records
-                .map((e) => {
+            return html `
+            <h2>${name} · ${records.length}</h2>
+            ${records.map((e) => {
                 const state = statusLabel(e, now);
                 const local = e.local.reference && e.local.reference !== e.local.label
                     ? `${e.local.label} · ${e.local.reference}`
                     : e.local.label;
                 // The card the settings page draws, without its controls: this page only reads.
-                return `<div class="connection">${externalCard(cardHeading(e, ` · ${e.visibility}`), e.external, `<span class="state">${verdict(toneOf(e, now), true)}<span>${escape(state)}</span></span>`, e.visibility === 'public'
-                    ? `<p class="evidence"><a href="${escape(e.evidenceUrl)}">Inspect evidence</a></p>`
-                    : '', `<dl><dt>Linked to</dt><dd>${escape(local)}</dd><dt>Connected</dt><dd>${escape(date(e.connectedAt))}</dd></dl>`)}</div>`;
-            })
-                .join('')}`;
-        })
-            .join('')}
-      <p><a href="/">Back to owner settings</a></p>`);
+                return html `
+                <div class="connection">
+                  ${externalCard(cardHeading(e, ` · ${e.visibility}`), e.external, html `
+                      <span class="state">
+                        ${verdict(toneOf(e, now), true)}<span>${state}</span>
+                      </span>
+                    `, e.visibility === 'public' &&
+                    html `<p class="evidence"><a href="${e.evidenceUrl}">Inspect evidence</a></p>`, html `
+                      <dl>
+                        <dt>Linked to</dt>
+                        <dd>${local}</dd>
+                        <dt>Connected</dt>
+                        <dd>${date(e.connectedAt)}</dd>
+                      </dl>
+                    `)}
+                </div>
+              `;
+            })}
+          `;
+        })}
+        <p><a href="/">Back to owner settings</a></p>
+      `);
     }
     /**
      * Asks before an account is retired or a connection is removed, since neither can be
@@ -694,27 +794,44 @@ class Server {
         // What the settings page offers for this record, and nothing it does not.
         if (action === 'retire' ? ['revoked', 'retired'].includes(e.status) : e.status === 'revoked')
             return unavailable();
-        const held = site ? `<input type="hidden" name="connection" value="${escape(e.id)}">` : '';
+        const held = site && html `<input type="hidden" name="connection" value="${e.id}">`;
         const [heading, note, form] = action === 'retire'
             ? [
                 'Retire this account?',
                 retiringNote,
-                `<form action="${site ? '/mark' : `/connections/${escape(e.id)}/mark`}" method="post">${held}<input type="hidden" name="as" value="retired"><button class="danger">Retire</button></form>`,
+                html `
+              <form action="${site ? '/mark' : `/connections/${e.id}/mark`}" method="post">
+                ${held}
+                <input type="hidden" name="as" value="retired">
+                <button class="danger">Retire</button>
+              </form>
+            `,
             ]
             : site
                 ? [
                     'Disconnect this account?',
                     `This removes the link between your ${site.name} account and this one. It cannot be undone. To link them again you would verify the account again.`,
-                    `<form action="/disconnect" method="post">${held}<button class="danger">Disconnect</button></form>`,
+                    html `
+                <form action="/disconnect" method="post">
+                  ${held}
+                  <button class="danger">Disconnect</button>
+                </form>
+              `,
                 ]
                 : [
                     'Revoke this connection?',
                     'This ends the connection, and it will read as revoked wherever it is shown. It cannot be undone. Verifying the account again makes a new connection with a new ID.',
-                    `<form action="/connections/${escape(e.id)}/disconnect" method="post"><button class="danger">Revoke connection</button></form>`,
+                    html `
+                <form action="/connections/${e.id}/disconnect" method="post">
+                  <button class="danger">Revoke connection</button>
+                </form>
+              `,
                 ];
-        return html(heading, `${externalCard(cardHeading(e), e.external)}
-      <p>${escape(note)}</p>
-      <div class="choice">${form}<a class="button secondary" href="/">Cancel</a></div>`, 200, 'single');
+        return respond(heading, html `
+        ${externalCard(cardHeading(e), e.external)}
+        <p>${note}</p>
+        <div class="choice">${form}<a class="button secondary" href="/">Cancel</a></div>
+      `, 200, 'single');
     }
     /** One connection: the account's card, its state, and what can be done with it. */
     connection(e, now, site) {
@@ -747,31 +864,55 @@ class Server {
         // Renewing and changing visibility start a flow on a page of their own, so they are
         // links, drawn as buttons beside the others that act on the connection.
         const goes = [
-            acts ? `<a class="button" href="/renew/${escape(e.id)}">Renew</a>` : '',
-            acts && !retired && site?.visibility?.length !== 1
-                ? `<a class="button" href="/visibility/${escape(e.id)}">Change visibility</a>`
-                : '',
-        ].join('');
+            acts && html `<a class="button" href="/renew/${e.id}">Renew</a>`,
+            acts &&
+                !retired &&
+                site?.visibility?.length !== 1 &&
+                html `<a class="button" href="/visibility/${e.id}">Change visibility</a>`,
+        ].filter((go) => go !== false);
         // How the holder lists the account, which acts on every record of it they have. A
         // site's holder is sent back to the site with the change, as with a disconnect.
-        const listing = open
-            ? `<form action="${site ? '/mark' : `/connections/${escape(e.id)}/mark`}" method="post">${site ? `<input type="hidden" name="connection" value="${escape(e.id)}">` : ''}
-      ${e.mark === 'preferred' ? '' : '<button name="as" value="preferred">Mark as preferred</button>'}
-      ${e.mark === 'unused' ? '' : '<button name="as" value="unused">Mark as unused</button>'}
-      ${e.mark === undefined ? '' : '<button name="as" value="current">Mark as current</button>'}</form>`
-            : '';
+        const listing = open &&
+            html `
+        <form action="${site ? '/mark' : `/connections/${e.id}/mark`}" method="post">
+          ${site && html `<input type="hidden" name="connection" value="${e.id}">`}
+          ${e.mark !== 'preferred' &&
+                html `<button name="as" value="preferred">Mark as preferred</button>`}
+          ${e.mark !== 'unused' && html `<button name="as" value="unused">Mark as unused</button>`}
+          ${e.mark !== undefined && html `<button name="as" value="current">Mark as current</button>`}
+        </form>
+      `;
         // Retiring and removing go by a page that asks first, since neither can be undone.
-        const asks = (action, label, danger = false) => `<form action="/confirm" method="get"><input type="hidden" name="connection" value="${escape(e.id)}"><button${danger ? ' class="danger"' : ''} name="do" value="${action}">${label}</button></form>`;
+        const asks = (action, label, danger = false) => html `
+        <form action="/confirm" method="get">
+          <input type="hidden" name="connection" value="${e.id}">
+          <button${danger && raw(' class="danger"')} name="do" value="${action}">${label}</button>
+        </form>
+      `;
         // Retiring and removing cannot be undone, so they sit together on a line of their own
         // below the rest, where nothing else lines up with them.
-        const ends = e.status === 'revoked'
-            ? ''
-            : `${open ? asks('retire', 'Retire', true) : ''}${asks('remove', site ? 'Disconnect' : 'Revoke', true)}`;
-        const ending = ends && `<div class="ending">${ends}</div>`;
-        return `<div class="connection">${externalCard(cardHeading(e), e.external, `<span class="state">${verdict(toneOf(e, now), true)}<span>${escape(state)}</span></span>`, e.visibility === 'public'
-            ? `<p class="evidence"><a href="${escape(e.evidenceUrl)}">Inspect evidence</a></p>`
-            : '', `<dl>${rows.map(([label, value]) => `<dt>${label}</dt><dd>${escape(value)}</dd>`).join('')}</dl>`, shown && `<p class="fine">${escape(shown)}</p>`, !site && e.visibility === 'public'
-            ? `<p class="fine">Embed on your site</p><pre><code>${escape(embed)}</code></pre>`
-            : '', `${goes || listing ? `<div class="actions">${goes}${listing}</div>` : ''}${ending}`)}</div>`;
+        const ending = e.status !== 'revoked' &&
+            html `
+        <div class="ending">
+          ${open && asks('retire', 'Retire', true)}
+          ${asks('remove', site ? 'Disconnect' : 'Revoke', true)}
+        </div>
+      `;
+        return html `
+      <div class="connection">
+        ${externalCard(cardHeading(e), e.external, html `
+            <span class="state">${verdict(toneOf(e, now), true)}<span>${state}</span></span>
+          `, e.visibility === 'public' &&
+            html `<p class="evidence"><a href="${e.evidenceUrl}">Inspect evidence</a></p>`, html `<dl>${rows.map(([label, value]) => html `<dt>${label}</dt><dd>${value}</dd>`)}</dl>`, shown && html `<p class="fine">${shown}</p>`, !site &&
+            e.visibility === 'public' &&
+            html `
+              <p class="fine">Embed on your site</p>
+              <pre><code>${embed}</code></pre>
+            `, html `
+            ${(goes.length > 0 || listing) && html `<div class="actions">${goes}${listing}</div>`}
+            ${ending}
+          `)}
+      </div>
+    `;
     }
 }

package/dist/instance/limits.d.ts

@@ -1,13 +1,15 @@
 import type { Store } from './store.js';
 /**
  * Requests a minute for one signed-in holder, one client without a session, one site's
- * holders, and one site's backend reading its subjects' connections.
+ * holders, and one site's backend reading its subjects' connections. A site registered
+ * here gets `registered` for each of the last two, unless the owner sets it another.
  */
 export declare const limits: {
     session: number;
     client: number;
     site: number;
     read: number;
+    registered: number;
 };
 /**
  * Counts a request against every bucket it falls in, and refuses it if any is full. All or
@@ -24,7 +26,7 @@ export declare function allow(storage: Store, buckets: {
 export declare const client: (address: string | null) => string;
 /**
  * Deletes every record the handoff and the limits leave behind once it has expired:
- * handoffs that never reached `/handoff/accept`, site sessions, and idle buckets. Each is written
- * with its expiry under its own prefix for exactly this.
+ * handoffs that never reached `/handoff/accept`, site and dashboard sessions, and idle
+ * buckets. Each is written with its expiry under its own prefix for exactly this.
  */
 export declare function prune(storage: Store): Promise<void>;

package/dist/instance/limits.js

@@ -1,9 +1,10 @@
 import { hash } from '../server/service.js';
 /**
  * Requests a minute for one signed-in holder, one client without a session, one site's
- * holders, and one site's backend reading its subjects' connections.
+ * holders, and one site's backend reading its subjects' connections. A site registered
+ * here gets `registered` for each of the last two, unless the owner sets it another.
  */
-export const limits = { session: 60, client: 30, site: 600, read: 600 };
+export const limits = { session: 60, client: 30, site: 600, read: 600, registered: 60 };
 const windowMs = 60000;
 /**
  * Counts a request against every bucket it falls in, and refuses it if any is full. All or
@@ -32,12 +33,12 @@ export async function allow(storage, buckets) {
 export const client = (address) => `client/${hash(address ?? 'unknown')}`;
 /**
  * Deletes every record the handoff and the limits leave behind once it has expired:
- * handoffs that never reached `/handoff/accept`, site sessions, and idle buckets. Each is written
- * with its expiry under its own prefix for exactly this.
+ * handoffs that never reached `/handoff/accept`, site and dashboard sessions, and idle
+ * buckets. Each is written with its expiry under its own prefix for exactly this.
  */
 export async function prune(storage) {
     const now = Date.now();
-    for (const prefix of ['site/state/', 'site/session/', 'rate/']) {
+    for (const prefix of ['site/state/', 'site/session/', 'site/dashboard/', 'rate/']) {
         for (const [key, value] of await storage.list(prefix))
             if (!(value.expiresAt > now))
                 await storage.delete(key);

package/dist/instance/owner-sites.d.ts

@@ -0,0 +1,17 @@
+import { type Sites } from './sites.js';
+import type { Store } from './store.js';
+/**
+ * Where the instance owner oversees the sites registered here: suspends one by hand, sets
+ * its request limit, and approves it for YouTube. Sites in `SITES` are the host's, and are
+ * not listed.
+ */
+export declare class OwnerSites {
+    private readonly store;
+    private readonly sites;
+    constructor(store: Store, sites: Sites);
+    /** Every stored site, with how it stands and the owner's controls over it. */
+    page(): Promise<Response>;
+    /** One of the page's forms, sent to `path`. Every one returns to the page. */
+    change(path: string, request: Request): Promise<Response>;
+    private row;
+}