@mason-data/cli 0.10.0 → 0.11.0

package/dist/src/cli/commands.js

@@ -327,7 +327,9 @@ const STATUS_USAGE = `usage: mason status [--json]
     readiness (what mason wait waits on), ui (whether this run serves the web page: mason ui), served (this is
     mason serve's run: mason ui --ssh opens its page), sourcesReadOnly (why the page offers no Add or Remove — the
     project's files deployed read-only, MASON_PROJECT_READONLY, which mason add and mason remove refuse too, or a
-    server's sources file it cannot write — or null), next }.
+    server's sources file it cannot write — or null), pageReadOnly (why the page changes nothing: mason serve with
+    MASON_UI_READ_ONLY=1, which refuses every change the page sends — or null), pageSocket (the Unix socket the
+    page is served on too: mason serve with MASON_UI_SOCKET — or null), next }.
     Each table's kept is how it is kept current now (absent for a table the sync does not hold):
     { by: poll, sync: { mode: off } or { mode: poll, every (30s), seconds } (its entry's sync:, else the file's,
     else off), syncedAt (its last whole read or poll), nextAt (when its next poll is due; null: off, or not polled
@@ -368,7 +370,7 @@ export const STATUS = {
     usage: STATUS_USAGE,
     options: { json: { type: "boolean" } },
     json: ["running", "pid", "postgres", "source", "warnings", "folder", "project", "tables", "totals", "engine", "disk", "sessions", "stream", "jsonPaths", "generatedTables", "queries", "slowQueries", "refusedQueries",
-        "refusedTotal", "unsupported", "recentErrors", "readiness", "ui", "served", "sourcesReadOnly",
+        "refusedTotal", "unsupported", "recentErrors", "readiness", "ui", "served", "sourcesReadOnly", "pageReadOnly", "pageSocket",
         "roles", "share", "shareEnded", "lastRun", "lastStop", "hung", "next"],
 };
 export async function status(argv) {
@@ -448,7 +450,8 @@ export async function status(argv) {
             ["Listener", listenerText(run.postgresListener, postgresLink(run.postgresUrl).port)],
             ...shareRows(s.share),
             // the web page (mason ui), without its one-time token: mason ui prints the URL that carries it, and opens it
-            ...(s.ui === true ? [["Web UI", s.served === true ? "from your machine: mason ui --ssh <user@server>" : `${run.control.url}/  (mason ui opens it)`]] : []),
+            ...(s.ui === true ? [["Web UI", (s.served === true ? "from your machine: mason ui --ssh <user@server>" : `${run.control.url}/  (mason ui opens it)`) +
+                        (typeof s.pageSocket === "string" ? `; on this machine, the Unix socket ${s.pageSocket} too` : "")]] : []),
             // the roles file as the listener reads it now (mason user add --role): its roles, or what is wrong with it
             ...(s.roles && s.roles.file !== null
                 ? [["Roles", s.roles.problem !== null ? st.red(`${s.roles.problem} (every statement of a user with a role is refused until it is fixed)`)

package/dist/src/cli/dev.js

@@ -29,6 +29,7 @@ import * as path from "node:path";
 import { choosePgPort, freePort } from "./ports.js";
 import { failed } from "./command.js";
 import { checkSource, connectSource, maskedUrl, readSourceFacts, remoteConfirmation, remoteWarning } from "./preflight.js";
+import { uiReadOnlySetting } from "./ui-read-only.js";
 import { createRunServer, listenOnLoopback, metricsFacts, usageFacts } from "./run-server.js";
 import { readGenerated } from "./generated-files.js";
 import { addedTables, effectiveSync, entryName, replicatedEntries, rereadSources, shownPath, syncWritten } from "./sources.js";
@@ -789,6 +790,10 @@ async function run(o, hosted) {
         version: o.version, startedAt,
         // the web page (mason ui): on loopback alone, so mason serve's is reached through mason ui --ssh
         page: true, served: o.serve !== undefined,
+        // MASON_UI_READ_ONLY=1: a server's page refuses every change it asks for (mason start refuses the setting above)
+        pageReadOnly: o.serve !== undefined && uiReadOnlySetting(process.env) === true,
+        // MASON_UI_SOCKET: the page on a Unix socket too (src/cli/ui-socket.ts), or null
+        pageSocket: o.serve?.socket ?? null,
         demo: cfg.demo === true,
         users: { file: path.join(home, USERS_FILE), apiKey: cfg.apiKey, database, postgresUrl },
         // the roles as the listener holds them: their row filters checked by its catalog (a filter Postgres refuses is a problem)
@@ -824,6 +829,7 @@ async function run(o, hosted) {
             restarts: () => readRestarts(home), jsonPaths: () => sync.kept.status(), generated: () => sync.generated.status() },
     };
     const server = createRunServer(runCtx);
+    o.serve?.page?.(server);
     // a sample is /api/state's facts at its moment (src/cli/run-server.ts usageFacts): one computation of each
     usage.start(() => usageFacts(runCtx));
     await listenOnLoopback(server, setupPort);
@@ -867,6 +873,8 @@ async function run(o, hosted) {
     // the stop is in place BEFORE the ready line: a supervisor or a test signals on reading it, and a SIGTERM that found
     // no handler would end the run with the default action, never recording `running: null`
     let stopping = false;
+    // the run's own stop, for a step of a serve's ready that failed (`ServeHooks.ready`): its words are what lastStop says
+    let stopFor = () => undefined;
     const stopped = new Promise((resolve) => {
         // a crash of the engine's thread: the run exits 1 with its reason in V8's fatal form, which the supervisor reads
         // (src/cli/supervise.ts crashReason), and its config still says it runs, so the supervisor starts it again
@@ -889,7 +897,7 @@ async function run(o, hosted) {
                 resolve(1);
             })();
         };
-        const stop = (signal) => {
+        const stop = (signal, how) => {
             if (stopping)
                 return;
             stopping = true;
@@ -965,14 +973,16 @@ async function run(o, hosted) {
                         (repl.owned ? "" : `; publication ${repl.publication} is its owner's, left as it is`));
                 cfg.running = null;
                 // how it ended, for mason status once it is gone (a kill records nothing: mason stop writes that one)
-                cfg.lastStop = { at: new Date().toISOString(), how: signal === "SIGINT" ? "stopped from its terminal (SIGINT)" : `stopped by mason stop, or a shutdown (${signal})` };
+                cfg.lastStop = { at: new Date().toISOString(), how: how ?? (signal === "SIGINT" ? "stopped from its terminal (SIGINT)" : `stopped by mason stop, or a shutdown (${signal})`) };
                 writeConfig(home, cfg);
                 log.end();
                 resolve(0);
             })();
         };
-        process.on("SIGINT", stop);
-        process.on("SIGTERM", stop);
+        // wrapped: Node calls a signal's listener with (name, number), and the number must never be read as `how`
+        process.on("SIGINT", () => { stop("SIGINT"); });
+        process.on("SIGTERM", () => { stop("SIGTERM"); });
+        stopFor = (how) => { stop("SIGTERM", how); };
     });
     say("");
     say(`  Postgres  ${withPlaceholders(postgresUrl)}  (mason user add <name> makes a user)`);
@@ -985,9 +995,15 @@ async function run(o, hosted) {
     const elsewhere = elsewhereTip(pgTls.listener);
     if (elsewhere)
         say(`  ${elsewhere}`);
+    // before the ready line: what a serve writes when it answers (MASON_UI_RUN_FILE) is there when a supervisor reads it
+    // a step of it that failed stops the run, said in its words, and the ready line is never printed: it did not get ready
+    const notReady = o.serve?.ready({ tables: () => sync.state(), metrics: () => metricsFacts(runCtx), page: { port: setupPort, token } }) ?? null;
+    if (notReady !== null) {
+        stopFor(notReady);
+        return await stopped;
+    }
     say(READY);
     say("");
-    o.serve?.ready({ tables: () => sync.state(), metrics: () => metricsFacts(runCtx) });
     return await stopped;
 }
 /**

package/dist/src/cli/project.js

@@ -21,6 +21,9 @@ import { randomBytes } from "node:crypto";
 import { connectDatabase, databaseSettingRefusal } from "../lib/database-name.js";
 import { changesRetired, pollMsRetired } from "../lib/table-sync.js";
 import { readSource, sourcesTop, writtenDatabase } from "./sources.js";
+import { UI_SOCKET_SETTING } from "./ui-socket.js";
+import { UI_RUN_FILE_SETTING } from "./ui-run-file.js";
+import { UI_READ_ONLY_SETTING, uiReadOnlySetting } from "./ui-read-only.js";
 export const STATE_DIR = ".mason";
 const CONFIG = "config.json";
 /** A project's name: what its commands call it and (with the source's) what its replication slot is named for. Never
@@ -263,5 +266,25 @@ export function startSettingRefusal(p, env, o) {
     if (changes !== null)
         return { code: "refused", ...changes };
     const database = o.serve ? null : databaseSettingRefusal(env, top().shown);
-    return database === null ? null : { code: "refused", ...database };
+    if (database !== null)
+        return { code: "refused", ...database };
+    // a read-only page is a server's (src/cli/ui-read-only.ts): a value not 0 or 1 refuses either start, and 1 mason start's
+    const pageReadOnly = uiReadOnlySetting(env);
+    if (typeof pageReadOnly !== "boolean")
+        return { message: pageReadOnly.problem, code: "refused", fix: `set ${UI_READ_ONLY_SETTING}=1 or ${UI_READ_ONLY_SETTING}=0, or unset it` };
+    if (!o.serve && pageReadOnly) {
+        return { message: `${UI_READ_ONLY_SETTING} is mason serve's setting, and mason start ignores no setting silently`, code: "refused",
+            fix: `unset ${UI_READ_ONLY_SETTING}: mason start's page is yours alone, on this machine` };
+    }
+    // the page's Unix socket is a server's (src/cli/ui-socket.ts): a laptop's page is opened with mason ui
+    if (!o.serve && env[UI_SOCKET_SETTING]) {
+        return { message: `${UI_SOCKET_SETTING} is mason serve's setting, and mason start ignores no setting silently`, code: "refused",
+            fix: `unset ${UI_SOCKET_SETTING}: mason ui opens this run's page` };
+    }
+    // the run's file is a server's supervisor's (src/cli/ui-run-file.ts): a laptop's commands read the project's config
+    if (!o.serve && env[UI_RUN_FILE_SETTING]) {
+        return { message: `${UI_RUN_FILE_SETTING} is mason serve's setting, and mason start ignores no setting silently`, code: "refused",
+            fix: `unset ${UI_RUN_FILE_SETTING}: mason ui opens this run's page, and the mason commands reach the run by themselves` };
+    }
+    return null;
 }

package/dist/src/cli/run-server.js

@@ -28,6 +28,7 @@ import { fileURLToPath } from "node:url";
 import { readBody, sendJson } from "../lib/http-json.js";
 import { projectFingerprint } from "../lib/project-files.js";
 import { guard, newTunnel, SECURITY_HEADERS } from "./security.js";
+import { PAGE_READ_ONLY, PAGE_READ_ONLY_WHY, pageWrite } from "./ui-read-only.js";
 import { maskedUrl } from "./preflight.js";
 import { errorJson, nextJson } from "./command.js";
 import { phaseCounts, readiness, syncTotals, tableSync } from "./readiness.js";
@@ -101,6 +102,11 @@ export function runState(ctx, copies, stream, now = Date.now(), { columns = fals
         // why the page offers no Add or Remove, or null: the project's files deployed read-only (MASON_PROJECT_READONLY), or
         // a server's project folder mounted read-only — a control that can only fail is not offered
         sourcesReadOnly: sourcesReadOnly(ctx, sources.file?.file ?? null),
+        // why the page offers no control that changes anything (MASON_UI_READ_ONLY=1, src/cli/ui-read-only.ts), or null:
+        // every change it would send is refused
+        pageReadOnly: ctx.pageReadOnly === true ? PAGE_READ_ONLY_WHY : null,
+        // the Unix socket the page is served on too (MASON_UI_SOCKET), or null: mason status says it
+        pageSocket: ctx.pageSocket ?? null,
         source: { url: maskedUrl(ctx.source.url), host: ctx.source.host, database: ctx.source.database, remote: ctx.source.remote, demo: ctx.demo === true,
             // `replication` while a table's sync is replication (the run streams), else `poll`: each table's own is its kept
             version: facts.versionText, standby: facts.standby, changes: repl !== null ? "replication" : "poll", name: sources.file?.name ?? null, file: sources.file?.file ?? null,
@@ -556,23 +562,33 @@ export function createRunServer(ctx) {
             res.writeHead(v.status, { "Content-Type": "text/plain; charset=utf-8" }).end(`${v.reason}\n`);
             return;
         }
+        // A READ-ONLY PAGE (MASON_UI_READ_ONLY=1): every change the page asks for is refused by rule, before any route is
+        // read, so a route added later is refused too; the commands' requests (the run's token) are served as before
+        if (ctx.pageReadOnly === true && pageWrite(req.method, req.headers.authorization)) {
+            sendFailure(res, 403, PAGE_READ_ONLY);
+            return;
+        }
         const url = new URL(req.url ?? "/", `http://127.0.0.1:${ctx.port}`);
+        // HEAD IS GET BY RULE, never route by route: routed as a GET, answered with its status and headers, and its body
+        // dropped by Node's own response to a HEAD. It passes nothing GET does not: the guard and the read-only rule above
+        // have judged it as the HEAD it is, and only GET routes are reached, none of which changes anything.
+        const method = req.method === "HEAD" ? "GET" : req.method;
         void (async () => {
             try {
-                const file = req.method === "GET" || req.method === "HEAD" ? page.get(url.pathname) : undefined;
+                const file = method === "GET" ? page.get(url.pathname) : undefined;
                 if (file !== undefined) {
                     res.writeHead(200, { "Content-Type": file.type, "Content-Length": file.body.length, ...(file.immutable ? { "Cache-Control": IMMUTABLE } : {}) })
-                        .end(req.method === "HEAD" ? undefined : file.body);
+                        .end(file.body);
                 }
-                else if (req.method === "GET" && url.pathname === "/api/ping") {
+                else if (method === "GET" && url.pathname === "/api/ping") {
                     // what proves a run is up (src/cli/runs.ts answers): this token answered, by this process
                     sendJson(res, 200, { pid: process.pid });
                 }
-                else if (req.method === "GET" && url.pathname === "/api/state") {
+                else if (method === "GET" && url.pathname === "/api/state") {
                     // lean, as the page polls it; ?columns=1 with each table's columns (mason status --json)
                     sendJson(res, 200, await state(ctx, url.searchParams.get("columns") === "1"));
                 }
-                else if (req.method === "GET" && /^\/api\/tables\/[^/]+\/columns$/.test(url.pathname)) {
+                else if (method === "GET" && /^\/api\/tables\/[^/]+\/columns$/.test(url.pathname)) {
                     // one table's columns, read when the page's Columns… form opens (never with the state, polled every 2 s)
                     let table;
                     try {
@@ -583,18 +599,18 @@ export function createRunServer(ctx) {
                     }
                     sendJson(res, 200, tableColumns(ctx, table));
                 }
-                else if (req.method === "GET" && url.pathname === "/api/slow") {
+                else if (method === "GET" && url.pathname === "/api/slow") {
                     // the last day's slow statements, from the request log (src/duck/requests.ts)
                     sendJson(res, 200, { slow: await ctx.duck.requests.slow(SLOW_MS), slowMs: SLOW_MS });
                 }
-                else if (req.method === "GET" && url.pathname === "/api/refused") {
+                else if (method === "GET" && url.pathname === "/api/refused") {
                     sendJson(res, 200, await ctx.duck.requests.refused());
                 }
-                else if (req.method === "GET" && url.pathname === "/api/unsupported") {
+                else if (method === "GET" && url.pathname === "/api/unsupported") {
                     // the refused statements grouped by the unsupported SQL they used (src/duck/gaps.ts): mason status
                     sendJson(res, 200, await unsupported(ctx, url.searchParams));
                 }
-                else if (req.method === "GET" && url.pathname === "/api/requests") {
+                else if (method === "GET" && url.pathname === "/api/requests") {
                     // the filters, read as mason logs --requests reads its options (src/cli/request-filter.ts)
                     const q = requestFilter(requestFilterText(url.searchParams));
                     if ("message" in q) {
@@ -603,20 +619,20 @@ export function createRunServer(ctx) {
                     }
                     sendJson(res, 200, { ...await ctx.duck.requests.page(q), keptDays: ctx.duck.requests.days });
                 }
-                else if (req.method === "GET" && url.pathname === "/api/queries") {
+                else if (method === "GET" && url.pathname === "/api/queries") {
                     // the last day's and week's statements in one scan of the request log (mason status); asked on its own, never
                     // with /api/state, which the page asks every 2 s
                     // (cached SUMMARY_TTL_MS: up to 30 s old)
                     sendJson(res, 200, { queries: await summary() });
                 }
-                else if (req.method === "GET" && url.pathname === "/api/activity") {
+                else if (method === "GET" && url.pathname === "/api/activity") {
                     // one time range's statements, clients and slowest (the Usage page's), from the request log
                     sendJson(res, 200, await activity(ctx, url.searchParams));
                 }
-                else if (req.method === "GET" && url.pathname === "/api/running") {
+                else if (method === "GET" && url.pathname === "/api/running") {
                     sendJson(res, 200, { running: ctx.listener.running() });
                 }
-                else if (req.method === "POST" && url.pathname === "/api/cancel") {
+                else if (method === "POST" && url.pathname === "/api/cancel") {
                     const body = JSON.parse(await readBody(req, 64 * 1024));
                     const whole = (x) => typeof x === "number" && Number.isInteger(x) && x >= 1;
                     if (!whole(body.session))
@@ -640,7 +656,7 @@ export function createRunServer(ctx) {
                     }
                     sendFailure(res, 409, { message: `session ${r.idle} is running no statement: nothing to cancel`, code: "refused", why: "its statement ended, or it is between two", next: [running] });
                 }
-                else if (req.method === "GET" && url.pathname === "/api/logs") {
+                else if (method === "GET" && url.pathname === "/api/logs") {
                     // the run's last log entries from memory (mason serve has no file to read): { at, text } each, oldest first
                     const lines = Number(url.searchParams.get("lines") ?? Math.min(40, ctx.logs.capacity));
                     if (!Number.isInteger(lines) || lines < 1 || lines > ctx.logs.capacity)
@@ -649,15 +665,15 @@ export function createRunServer(ctx) {
                     const since = sinceText === null ? undefined : timeParam("since", sinceText, Date.now());
                     sendJson(res, 200, { lines: ctx.logs.recent({ lines, ...(since !== undefined ? { since } : {}) }), kept: ctx.logs.capacity });
                 }
-                else if (req.method === "GET" && url.pathname === "/api/events") {
+                else if (method === "GET" && url.pathname === "/api/events") {
                     // the sync's events and the run's restarts, newest last (src/duck/events.ts): mason logs --events, mason status
                     sendJson(res, 200, await events(ctx, url.searchParams));
                 }
-                else if (req.method === "GET" && url.pathname === "/api/usage") {
+                else if (method === "GET" && url.pathname === "/api/usage") {
                     // usage over time, a sample a minute (src/duck/usage.ts): mason usage
                     sendJson(res, 200, await usage(ctx, url.searchParams));
                 }
-                else if (req.method === "POST" && url.pathname === "/api/pick") {
+                else if (method === "POST" && url.pathname === "/api/pick") {
                     const body = JSON.parse(await readBody(req, 64 * 1024));
                     if (typeof body.table !== "string" || typeof body.picked !== "boolean")
                         throw new Refusal(400, "send { table, picked, columns?, key?, sync?, keep? }");
@@ -697,13 +713,13 @@ export function createRunServer(ctx) {
                         sendJson(res, 200, { ...r, state: await state(ctx) });
                     }
                 }
-                else if (req.method === "POST" && url.pathname === "/api/ui/tunnel") {
+                else if (method === "POST" && url.pathname === "/api/ui/tunnel") {
                     await openTunnel(ctx, tunnels, req, res);
                 }
-                else if (req.method === "POST" && url.pathname === "/api/share") {
+                else if (method === "POST" && url.pathname === "/api/share") {
                     await openShare(ctx, req, res);
                 }
-                else if (req.method === "GET" && url.pathname === "/api/share/choices") {
+                else if (method === "GET" && url.pathname === "/api/share/choices") {
                     // what a share with no role named reads, or the roles to choose from: the page asks before it asks the person
                     if (ctx.pageShares === undefined) {
                         sendFailure(res, 409, SERVED_SHARE);
@@ -716,7 +732,7 @@ export function createRunServer(ctx) {
                     }
                     sendJson(res, 200, "failure" in r ? { choices: r.choices } : { choices: [], role: r.role, reads: r.reads });
                 }
-                else if ((req.method === "POST" && /^\/api\/share\/[^/]+\/beat$/.test(url.pathname)) || (req.method === "DELETE" && /^\/api\/share\/[^/]+$/.test(url.pathname))) {
+                else if ((method === "POST" && /^\/api\/share\/[^/]+\/beat$/.test(url.pathname)) || (method === "DELETE" && /^\/api\/share\/[^/]+$/.test(url.pathname))) {
                     // the page's share: a beat holds it, a DELETE is Stop sharing; a share of mason share's is its command's to end
                     if (ctx.pageShares === undefined || ctx.shares === undefined) {
                         sendFailure(res, 409, SERVED_SHARE);
@@ -736,14 +752,14 @@ export function createRunServer(ctx) {
                     }
                     const ended = ctx.shares.ended;
                     const why = ended?.user === user ? `: ${ended.why}` : "";
-                    const ok = req.method === "DELETE" ? await ctx.pageShares.stop(user) : ctx.pageShares.beat(user);
+                    const ok = method === "DELETE" ? await ctx.pageShares.stop(user) : ctx.pageShares.beat(user);
                     if (!ok) {
                         sendFailure(res, 404, { message: `the share ${user} is not open${why === "" ? "" : `; it ended${why}`}`, code: "not_found", fix: "Connect from anywhere opens a new one, with a new address and password" });
                         return;
                     }
                     sendJson(res, 200, { ok: true });
                 }
-                else if (req.method === "POST" && /^\/api\/share\/[^/]+$/.test(url.pathname)) {
+                else if (method === "POST" && /^\/api\/share\/[^/]+$/.test(url.pathname)) {
                     // what the command knows of its tunnel, as it knows it: mason status says it, and the run stops the client
                     const body = tunnelReport(JSON.parse(await readBody(req, 64 * 1024)));
                     if (body === null)
@@ -755,7 +771,7 @@ export function createRunServer(ctx) {
                     }
                     sendJson(res, 200, { ok: true });
                 }
-                else if (req.method === "GET" && url.pathname === "/api/users") {
+                else if (method === "GET" && url.pathname === "/api/users") {
                     // mason user list --json's shape: the users, and whether each connects (and with ?lastUsed=1 when each was last used)
                     const r = listUsers(ctx.users.file, ctx.users.apiKey, postgresLink(ctx.users.postgresUrl), ctx.roles?.() ?? NO_ROLES);
                     if ("message" in r) {
@@ -768,7 +784,7 @@ export function createRunServer(ctx) {
                         : { users: r.users, lastUsedNote: LAST_USED_NOT_ASKED, requestLogDays: ctx.duck.requests.days };
                     sendJson(res, 200, { ...used, urlNote: null, next: nextJson([["mason user add <name>", "a user for a tool: its password and URL, printed once"]]) });
                 }
-                else if (req.method === "POST" && url.pathname === "/api/users") {
+                else if (method === "POST" && url.pathname === "/api/users") {
                     const body = JSON.parse(await readBody(req, 64 * 1024));
                     if (typeof body.name !== "string")
                         throw new Refusal(400, "send { name }: the user's name");
@@ -802,7 +818,7 @@ export function createRunServer(ctx) {
                     ctx.log(`user ${added.user} added${replaced ? " (in place of one the API key's rotation had removed)" : ""}`);
                     sendJson(res, 200, { ...added, next: nextJson(addedNext(added.user, true)) });
                 }
-                else if (req.method === "POST" && /^\/api\/users\/[^/]+\/from$/.test(url.pathname)) {
+                else if (method === "POST" && /^\/api\/users\/[^/]+\/from$/.test(url.pathname)) {
                     // mason user from --json's shape, through its own function: the user's address ranges replaced (null: any address)
                     let name;
                     try {
@@ -823,7 +839,7 @@ export function createRunServer(ctx) {
                         ctx.log(`user ${r.changed.name} connects from ${rangesText(r.changed.from)}`);
                     sendJson(res, 200, { ...r, next: nextJson(fromNext(r.changed.name, r.changed.from)) });
                 }
-                else if (req.method === "POST" && /^\/api\/users\/[^/]+\/(disable|enable)$/.test(url.pathname)) {
+                else if (method === "POST" && /^\/api\/users\/[^/]+\/(disable|enable)$/.test(url.pathname)) {
                     // mason user disable|enable --json's shape, through its own functions: kept, its password unchanged
                     const [, , , encoded, verb] = url.pathname.split("/");
                     let name;
@@ -854,7 +870,7 @@ export function createRunServer(ctx) {
                         sendJson(res, 200, { ...r, next: nextJson(enabledNext(r.enabled.name)) });
                     }
                 }
-                else if (req.method === "DELETE" && url.pathname.startsWith("/api/users/")) {
+                else if (method === "DELETE" && url.pathname.startsWith("/api/users/")) {
                     let name;
                     try {
                         name = decodeURIComponent(url.pathname.slice("/api/users/".length));
@@ -870,7 +886,7 @@ export function createRunServer(ctx) {
                     ctx.log(`user ${r.removed.name} removed`);
                     sendJson(res, 200, { ...r, next: nextJson(REMOVED_NEXT) });
                 }
-                else if (req.method === "POST" && url.pathname === "/api/sync") {
+                else if (method === "POST" && url.pathname === "/api/sync") {
                     const body = JSON.parse(await readBody(req, 64 * 1024));
                     if (!Array.isArray(body.tables) || !body.tables.length || !body.tables.every((x) => typeof x === "string"))
                         throw new Refusal(400, "send { tables: [schema.table, …] }");
@@ -885,7 +901,7 @@ export function createRunServer(ctx) {
                         throw e;
                     }
                 }
-                else if (req.method === "POST" && url.pathname === "/api/remove") {
+                else if (method === "POST" && url.pathname === "/api/remove") {
                     const body = JSON.parse(await readBody(req, 64 * 1024));
                     if (!Array.isArray(body.tables) || !body.tables.length || !body.tables.every((m) => typeof m === "string"))
                         throw new Refusal(400, "send { tables: [name, …] }");

package/dist/src/cli/security.js

@@ -62,6 +62,11 @@ export function newTunnel(port, now = Date.now()) {
 export function setCookieHeader(token, port) {
     return `${cookieName(port)}=${token}; HttpOnly; SameSite=Strict; Path=/`;
 }
+/** Where a trade sends the browser: the same address without its secret, RELATIVE to the one asked (`./` for `/`), so a
+ *  page a reverse proxy serves under a prefix of its own lands back there, never on the proxy's root. */
+export function sameAddress(url) {
+    return `./${url.pathname.slice(url.pathname.lastIndexOf("/") + 1)}${url.search}${url.hash}`;
+}
 /** The Host a browser may send for a loopback port: its two names, that port, and nothing else. */
 const loopbackHosts = (port) => [`127.0.0.1:${port}`, `localhost:${port}`];
 /** A change must come from the page at `hosts`: its Origin is one of them. */
@@ -83,7 +88,7 @@ function throughTunnel(req, tunnels, now) {
     const offered = url.searchParams.get("ticket");
     if (offered !== null && (req.method === "GET" || req.method === "HEAD")) {
         url.searchParams.delete("ticket");
-        const location = url.pathname + (url.search || "") + url.hash;
+        const location = sameAddress(url);
         const t = tunnels.find((x) => x.ticket !== null && now < x.ticketUntil && sameSecret(x.ticket, offered));
         if (t !== undefined) {
             t.ticket = null;
@@ -117,7 +122,7 @@ export function guard(req, port, token, tunnels = [], now = Date.now()) {
         if (!sameSecret(offered, token))
             return { ok: false, status: 403, reason: "the token in the URL is not this run's" };
         url.searchParams.delete("token");
-        return { ok: false, status: 303, location: url.pathname + (url.search || "") + url.hash, setCookie: setCookieHeader(token, port) };
+        return { ok: false, status: 303, location: sameAddress(url), setCookie: setCookieHeader(token, port) };
     }
     const cookie = cookieOf(req.cookie, cookieName(port));
     if (cookie === null || !sameSecret(cookie, token)) {