@tollwyn/baukasten 0.0.2 → 1.2.3

package/dist/server/legal/en.js

@@ -0,0 +1,251 @@
+import { SESSION_DAYS } from '../accounts.js';
+import { code, heading, lettered, link, list, longDate, mail, note, numbered, paragraph, strong } from './document.js';
+import { FLEET, FLEET_PROCESSORS } from './fleet.js';
+const { cloudflare, hoster, neon, stripe, webServer } = FLEET;
+const BASIS = {
+    contract: 'performance of the contract, Art. 6(1)(b) GDPR',
+    legitimateInterest: 'legitimate interest, Art. 6(1)(f) GDPR'
+};
+const TRANSFER = {
+    adequate: 'a country with adequate protection',
+    dpf: 'certified under the Data Privacy Framework',
+    scc: 'under the EU standard contractual clauses, as recognised by the FDPIC'
+};
+function register(entry) {
+    switch (entry.kind) {
+        case 'none':
+            return 'Sole proprietorship, not entered in the Swiss commercial register.';
+        case 'entered':
+            return `Commercial register: ${entry.uid}.`;
+    }
+}
+const VAT = {
+    none: {
+        imprint: 'Not registered for Swiss VAT; there is no VAT number.',
+        terms: 'We are not registered for Swiss VAT and charge no VAT; you account for any tax due in your country.'
+    }
+};
+const BROWSER = {
+    networkErrorLogging: `${cloudflare.name} also has your browser store an instruction to report failed connections (Network Error Logging). Clearing cookies and site data in your browser removes this instruction too.`
+};
+const EDGE = {
+    worldwideUnderScc: 'in the data centre nearest to you, which can be outside Switzerland and the EU; there the standard contractual clauses of its data processing addendum apply'
+};
+const ACCESS_LOG = {
+    none: 'Our web server keeps no access log'
+};
+const ERROR_LOG = {
+    requestWithoutAddress: 'only a request it cannot pass on to the application it writes to its error log, without your IP address and without parameters or headers'
+};
+const NEW_VERSION = {
+    removed: 'it is also removed whenever a new version starts',
+    stays: 'it stays when a new version starts'
+};
+const STRIPE_ROLE = {
+    controller: 'Stripe also processes data as a controller of its own, for example to prevent fraud and to meet its legal duties; see '
+};
+/** The section of the terms on processing on behalf, which the privacy policy points to. */
+const ON_BEHALF = 'Data we process on your behalf';
+const who = (f) => `${f.operator.name}, ${f.operator.address}`;
+const version = (f) => note(`Version of ${longDate(f.version, 'en')}.`);
+const from = (data) => data.source === undefined ? '' : `, from ${data.source}`;
+export const en = {
+    imprint: (f) => ({
+        title: 'Imprint',
+        blocks: [
+            paragraph(`${f.name} is operated by`),
+            paragraph(strong(f.operator.name)),
+            paragraph(f.operator.address),
+            paragraph(`${register(f.operator.register)} ${VAT[f.operator.vat].imprint}`),
+            paragraph('Email: ', mail(FLEET.mailbox), '. Email is the only support channel; there is no telephone hotline.'),
+            paragraph('The operator named above is responsible for the content of this website.')
+        ]
+    }),
+    privacy: (f) => {
+        const own = f.legal.data;
+        const processor = f.legal.processor;
+        return {
+            title: 'Privacy policy',
+            blocks: [
+                version(f),
+                paragraph(`This policy explains which personal data ${f.name} processes, why, where and for how long. The controller is ${who(f)}, reachable at `, mail(FLEET.mailbox), '. It follows the Swiss Federal Act on Data Protection (FADP) and, where it applies, the EU General Data Protection Regulation (GDPR).'),
+                heading('What we process, why, and on what basis'),
+                list([
+                    strong('Account'),
+                    `: your email address, a salted hash of your password, when you signed up and which version of the terms you accepted, when you confirmed your address, the links we send you by email (with a new address you ask for), your login sessions and hashes of your API keys — to log you in, to answer the requests of your API keys, to send you account emails such as the confirmation of your address and the password reset, and to know which terms apply (${BASIS.contract}). You need an email address to use ${f.name}.`
+                ], ...own.map((data) => [
+                    strong(data.name),
+                    `: ${data.what}${from(data)} — ${data.purpose} (${BASIS[data.basis]}).`
+                ]), [
+                    strong('Payment'),
+                    `: Stripe processes your email address, payment details and billing address, and a tax ID if you give one; we keep your Stripe customer and subscription numbers, the state of your subscription and the amounts and dates of your payments (${BASIS.contract}; for keeping them afterwards, our legitimate interest in meeting Swiss accounting law, Art. 6(1)(f) GDPR).`
+                ], [
+                    strong('Partner links'),
+                    `: when you come to ${f.name} through a link with `,
+                    code('?via=…'),
+                    ', the links of the site carry that partner name on, and when you sign up we store it with your account; software that signs up over the API may send one in the field ',
+                    code('via'),
+                    `. It holds nothing but the partner name, and we use it to know which partners bring customers (${BASIS.legitimateInterest}). We set no cookie for this and store nothing in your browser.`
+                ], [
+                    strong('Security and operations'),
+                    `: our application logs each request (method, path without parameters, status, duration) and events of the service with internal numbers such as that of your account, without IP addresses, email addresses, passwords or keys. ${ACCESS_LOG[webServer.accessLog]}; ${ERROR_LOG[webServer.errorLog.content]}. Our mail relay logs the recipient address and the delivery status of each email we send and keeps them for at most ${FLEET.relayLogDays} days. To limit sign-ups, logins and other attempts, we count them in the memory of the application, never on disk: per IP address, per account, per API key and per email address, this one only as a hash; a count applies for at most one hour and is forgotten at the latest when the application restarts (legitimate interest in a secure and working service, Art. 6(1)(f) GDPR).`
+                ], [
+                    strong('Emails to us'),
+                    ': when you write to us, we keep your message and address to answer you and to keep a record of the exchange (legitimate interest; for customers, performance of the contract).'
+                ]),
+                ...(processor.kind === 'yes'
+                    ? [
+                        paragraph(`For personal data ${processor.data}, which concern ${processor.subjects}, you are the controller, and we process them on your behalf (see “${ON_BEHALF}” in the `, link('terms', '/terms'), ').')
+                    ]
+                    : []),
+                paragraph(strong('Cookies'), ': we set one cookie, only for this site and HttpOnly, Secure and SameSite=Lax: ', code('__Host-session'), ` keeps you logged in, for ${SESSION_DAYS} days or until you log out, and is needed for the web app. You can block cookies in your browser; you can then not log in to the web app, while the API works with keys. ${BROWSER[cloudflare.browser]} We use no advertising or analytics trackers, sell no data, and make no decisions about you by automated means.`),
+                heading('Who receives data, and where'),
+                list([
+                    `${cloudflare.name} (${cloudflare.country.en}; ${TRANSFER[cloudflare.transfer]}) runs in front of ${f.name}: it terminates the encrypted connection, passes requests on and filters attacks. It therefore sees every request, including your IP address, ${EDGE[cloudflare.edge]}. It also stores the encrypted backups of our database (Cloudflare R2, ${cloudflare.backups.where.en}), which it cannot read.`
+                ], [
+                    `Application server: ${hoster.name} (${hoster.country.en}), in its data centres in ${hoster.dataCentres.en}; the server is rented and administered by the operator.`
+                ], [
+                    `Database: ${neon.name} (a ${neon.owner} company, ${neon.country.en}; ${TRANSFER[neon.transfer]}), stored in ${neon.cloud} region ${neon.region}, ${neon.place.en}; access from the provider’s country is possible.`
+                ], [
+                    `Payments: ${stripe.name} (${stripe.country.en}), with transfers to ${stripe.parent.name} (${stripe.parent.country.en}; ${TRANSFER[stripe.parent.transfer]}). ${STRIPE_ROLE[stripe.role]}`,
+                    link(stripe.privacy, `https://${stripe.privacy}`),
+                    '.'
+                ], [
+                    `Email: ${FLEET.mail.name} (${FLEET.mail.country.en}) sends our emails and keeps our mailbox.`
+                ], ...f.legal.recipients.map((recipient) => [
+                    `${recipient.name} (${recipient.place}; ${TRANSFER[recipient.transfer]}): ${recipient.purpose}.`
+                ])),
+                paragraph(`Data may therefore be processed in the countries named above and, for ${cloudflare.name}, in the country of the data centre that answers you. Each recipient outside Switzerland and the EU is named above with the safeguard that covers it.`),
+                heading('How long'),
+                list([
+                    'Your account with its sessions, links and keys stays until you delete it under Account; then it is deleted at once.'
+                ], ...own.map((data) => [strong(data.name), `: ${data.kept}.`]), [
+                    `Our database provider keeps a history for restoring the database to an earlier point in time for at most ${neon.historyDays} days, and our encrypted backups of it are deleted after about ${cloudflare.backups.days} days; deleted data leave both within that time.`
+                ], [
+                    'After deletion only a pseudonymous record of the account remains, without your email address: the partner name, the dates of the account (such as sign-up) and the version of the terms accepted, the Stripe customer and subscription numbers with the last state of the subscription, and the amounts and dates of your payments. We keep them for ten years, as Swiss accounting law requires (Art. 958f CO). Stripe keeps its own records, including your invoices.'
+                ], [
+                    `The application log rotates by size, in ${FLEET.appLog.files} files of ${FLEET.appLog.megabytes} MB, and is overwritten as new entries come in; ${NEW_VERSION[FLEET.appLog.newVersion]}. The error log of the web server rotates by size as well, in ${webServer.errorLog.files} files of ${webServer.errorLog.megabytes} MB, and is overwritten as new entries come in; ${NEW_VERSION[webServer.errorLog.newVersion]}. The mail relay log is kept for at most ${FLEET.relayLogDays} days.`
+                ], [
+                    `The session lasts ${SESSION_DAYS} days or until you log out. The counts per IP address, account, API key and email address apply for at most one hour, are kept in memory only and are forgotten at the latest when the application restarts.`
+                ], [
+                    'Emails to us: as long as the exchange needs it and, for customers, as long as the contract and accounting law require.'
+                ]),
+                heading('Your rights'),
+                paragraph('You may ask what we hold about you and receive it in a common electronic format, have it corrected or deleted, and have its processing restricted. You may object at any time to processing based on our legitimate interest. You can change your email address and delete your account yourself under Account; for everything else write to ', mail(FLEET.mailbox), '. We answer within 30 days. You may complain to the Federal Data Protection and Information Commissioner (FDPIC) or, in the EU, to the data protection authority of your country.'),
+                heading('Changes'),
+                paragraph('The version published here applies. We tell customers about important changes by email.')
+            ]
+        };
+    },
+    terms: (f) => {
+        const processor = f.legal.processor;
+        const processors = [
+            ...FLEET_PROCESSORS,
+            ...f.legal.recipients
+                .filter((recipient) => recipient.role === 'processor')
+                .map((recipient) => recipient.name)
+        ];
+        const sections = [
+            {
+                title: 'For businesses',
+                blocks: [
+                    paragraph(`${f.name} is offered only to businesses, public bodies and the self-employed for their professional activity, not to consumers.`)
+                ]
+            },
+            {
+                title: 'The service',
+                blocks: [
+                    paragraph(`${f.legal.service} We may develop ${f.name} further, but we do not remove its main functions during a paid period.`)
+                ]
+            },
+            {
+                title: 'What we do not guarantee',
+                blocks: [
+                    paragraph(`${f.legal.notGuaranteed} We do not guarantee that ${f.name} is always available: maintenance and outages of our hosting and network providers or of Stripe can delay or interrupt the service.`)
+                ]
+            },
+            {
+                title: 'Account and trial',
+                blocks: [
+                    paragraph(`You need an account with a valid email address. If ${f.name} offers a free trial, its duration and limits are those shown on its pricing page; it ends by itself and costs nothing unless you pay. Keep your password and API keys secret; you are responsible for what is done with them.`)
+                ]
+            },
+            {
+                title: 'Prices and payment',
+                blocks: [
+                    paragraph(`Prices are those shown on the pricing page, in the currency shown there, paid in advance through Stripe. ${VAT[f.operator.vat].terms} A subscription renews for its period until you cancel it in the customer portal; it then ends at the end of the paid period. If you change your plan in the customer portal, Stripe charges or credits the difference pro rata, as shown there; otherwise paid periods and purchases are not refunded, also not when you delete your account, which ends a subscription at once. Unused prepaid credit lapses without refund when you delete your account. If a payment fails, we may suspend what you pay for until it is made. We may change prices with 30 days’ notice by email; you may cancel before the change applies.`)
+                ]
+            },
+            {
+                title: 'Use',
+                blocks: [
+                    paragraph(`${f.legal.use} You may not use ${f.name} to overload or disrupt our service, nor against the law.`)
+                ]
+            },
+            {
+                title: 'Your data',
+                blocks: [
+                    paragraph(`What you put into ${f.name} remains yours. When you delete your account, it is deleted as described in the privacy policy.`)
+                ]
+            },
+            ...(processor.kind === 'yes'
+                ? [
+                    {
+                        title: ON_BEHALF,
+                        blocks: [
+                            paragraph(`For personal data ${processor.data}, which concern ${processor.subjects}, you are the controller and we are your processor (Art. 9 FADP, Art. 28 GDPR). We process these data for as long as your account exists and only to provide ${f.name} to you. We:`),
+                            lettered([
+                                'process them only on your documented instructions, which are these terms and your settings, and tell you if we think an instruction breaks data protection law;'
+                            ], ['bind everyone who has access to them to confidentiality;'], [
+                                'protect them with appropriate technical and organisational measures, among them encrypted connections, hashed passwords and keys, and access limited to the operator;'
+                            ], [
+                                `use as sub-processors only those named in the privacy policy (${processors.join('; ')}), which you approve, and bind them to data protection duties equivalent to these; we announce a new one by email 30 days in advance, and you may object by cancelling before it starts;`
+                            ], [
+                                'help you, as far as we can, to answer requests of data subjects and to meet your duties on security, breach notification and impact assessments;'
+                            ], [
+                                'tell you without undue delay of a breach of security that concerns these data;'
+                            ], [
+                                `delete them when you delete your account, unless the law requires us to keep them; before that you can read or export them through ${processor.retrieve}; copies in the history of the database and in our backups end as the privacy policy describes;`
+                            ], [
+                                'give you the information you need to show that these duties are met, and allow audits by you or an auditor bound to confidentiality, with reasonable notice and at your cost.'
+                            ]),
+                            paragraph('Transfers to the countries named in the privacy policy are made under the safeguards named there.')
+                        ]
+                    }
+                ]
+                : []),
+            {
+                title: 'Liability',
+                blocks: [
+                    paragraph('We are liable without limit for intent and gross negligence. For slight negligence, as far as the law permits, our liability is limited to the fees you paid in the twelve months before the damage, and we are not liable for indirect or consequential damage, lost profit or lost data. During a free trial we are liable only for intent and gross negligence. These limits also apply to the liability for our auxiliaries and subcontractors.')
+                ]
+            },
+            {
+                title: 'Ending',
+                blocks: [
+                    paragraph('You may delete your account at any time under Account. We may end your account with 30 days’ notice by email and then refund fees paid for the time after the end and unused prepaid credit. We may end it at once if you seriously break these terms.')
+                ]
+            },
+            {
+                title: 'Changes to these terms',
+                blocks: [
+                    paragraph('We may change these terms with 30 days’ notice by email. If you do not cancel before the change applies, the new version applies from then on.')
+                ]
+            },
+            {
+                title: 'Law and jurisdiction',
+                blocks: [
+                    paragraph(`Swiss law applies, excluding the UN Convention on Contracts for the International Sale of Goods. The exclusive place of jurisdiction is ${f.operator.jurisdiction}, Switzerland; we may also sue you at your seat.`)
+                ]
+            }
+        ];
+        return {
+            title: 'Terms of service',
+            blocks: [
+                version(f),
+                paragraph(`These terms apply between ${who(f)} (“we”) and the business that uses ${f.name} at ${f.origin}, in the web app or through the API (“you”). You accept them when you sign up, on the website or over the API, and again when you pay in Stripe Checkout. Whoever signs up confirms that they act for a business and may bind it.`),
+                ...numbered(sections)
+            ]
+        };
+    }
+};

package/dist/server/legal/fleet.d.ts

@@ -0,0 +1,114 @@
+export declare const FLEET: {
+    /** The shared mailbox: the sender of every product (MAIL_FROM) and its contact. */
+    readonly mailbox: "hello@tollwyn.com";
+    /** In front of every product: TLS, passing requests on, filtering attacks; and R2. */
+    readonly cloudflare: {
+        readonly name: "Cloudflare, Inc.";
+        readonly country: Readonly<Record<"en" | "de", string>>;
+        readonly transfer: "dpf";
+        readonly role: "processor";
+        /**
+         * What it has the browser keep: no cookie (seen from outside: no Set-Cookie on pages, forms
+         * and the API of a product), but the headers Nel and Report-To, an instruction to report
+         * failed connections. Its bot protection would set __cf_bm, which would then be named here.
+         */
+        readonly browser: "networkErrorLogging";
+        /**
+         * Where it answers a visitor: in its data centre nearest to them, anywhere; outside Switzerland
+         * and the EU under the standard contractual clauses of its data processing addendum.
+         */
+        readonly edge: "worldwideUnderScc";
+        /** The encrypted dumps of each database, in a bucket of R2 with a lifecycle rule. */
+        readonly backups: {
+            readonly where: {
+                readonly en: "in the EU";
+                readonly de: "in der EU";
+            };
+            readonly days: 30;
+        };
+    };
+    /** The server of the products: the seat of the company, and where its data centres are. */
+    readonly hoster: {
+        readonly name: "Hetzner Online GmbH";
+        readonly country: {
+            readonly en: "Germany";
+            readonly de: "Deutschland";
+        };
+        readonly dataCentres: {
+            readonly en: "Germany";
+            readonly de: "Deutschland";
+        };
+        readonly role: "processor";
+    };
+    /** Each product's database: a project of its own. */
+    readonly neon: {
+        readonly name: "Neon, LLC";
+        readonly owner: "Databricks";
+        readonly country: Readonly<Record<"en" | "de", string>>;
+        /** Certified under the Data Privacy Framework through Databricks. */
+        readonly transfer: "dpf";
+        readonly role: "processor";
+        readonly cloud: "Amazon Web Services";
+        /** The region of the cloud, which Neon names aws-eu-central-1. */
+        readonly region: "eu-central-1";
+        readonly place: {
+            readonly en: "Frankfurt, Germany";
+            readonly de: "Frankfurt, Deutschland";
+        };
+        /** The history to restore a database to an earlier point, at most this long. */
+        readonly historyDays: 30;
+    };
+    /** Each product's own Stripe account; Stripe is a controller of its own too. */
+    readonly stripe: {
+        readonly name: "Stripe Payments Europe, Limited";
+        readonly country: {
+            readonly en: "Ireland";
+            readonly de: "Irland";
+        };
+        readonly role: "controller";
+        readonly parent: {
+            readonly name: "Stripe, Inc.";
+            readonly country: Readonly<Record<"en" | "de", string>>;
+            readonly transfer: "dpf";
+        };
+        readonly privacy: "stripe.com/privacy";
+    };
+    /** Sends the mails from the relay on and keeps the mailbox. */
+    readonly mail: {
+        readonly name: "Infomaniak Network SA";
+        readonly country: {
+            readonly en: "Switzerland";
+            readonly de: "Schweiz";
+        };
+        readonly role: "processor";
+    };
+    /**
+     * The log of a product's container rotates by size in this many files of this size, and goes with
+     * the container when a new version starts.
+     */
+    readonly appLog: {
+        readonly files: 3;
+        readonly megabytes: 10;
+        readonly newVersion: "removed";
+    };
+    /**
+     * Caddy keeps no access log. What fails, a request it cannot pass on among it, its default logger
+     * writes into the log of its container, filtered: without headers (the address of the visitor
+     * stood in CF-Connecting-IP and X-Forwarded-For), without the query, the address of Cloudflare
+     * shortened. Docker rotates that log by size; it belongs to the web server, not to a product, and
+     * stays when a product starts a new version.
+     */
+    readonly webServer: {
+        readonly accessLog: "none";
+        readonly errorLog: {
+            readonly content: "requestWithoutAddress";
+            readonly files: 3;
+            readonly megabytes: 20;
+            readonly newVersion: "stays";
+        };
+    };
+    /** The mail relay logs each recipient and the state of each delivery; journald keeps it this long. */
+    readonly relayLogDays: 30;
+};
+/** The providers of the fleet that process data for the operator, which the terms name. */
+export declare const FLEET_PROCESSORS: ("Cloudflare, Inc." | "Hetzner Online GmbH" | "Neon, LLC" | "Infomaniak Network SA")[];

package/dist/server/legal/fleet.js

@@ -0,0 +1,89 @@
+const USA = { en: 'USA', de: 'USA' };
+export const FLEET = {
+    /** The shared mailbox: the sender of every product (MAIL_FROM) and its contact. */
+    mailbox: 'hello@tollwyn.com',
+    /** In front of every product: TLS, passing requests on, filtering attacks; and R2. */
+    cloudflare: {
+        name: 'Cloudflare, Inc.',
+        country: USA,
+        transfer: 'dpf',
+        role: 'processor',
+        /**
+         * What it has the browser keep: no cookie (seen from outside: no Set-Cookie on pages, forms
+         * and the API of a product), but the headers Nel and Report-To, an instruction to report
+         * failed connections. Its bot protection would set __cf_bm, which would then be named here.
+         */
+        browser: 'networkErrorLogging',
+        /**
+         * Where it answers a visitor: in its data centre nearest to them, anywhere; outside Switzerland
+         * and the EU under the standard contractual clauses of its data processing addendum.
+         */
+        edge: 'worldwideUnderScc',
+        /** The encrypted dumps of each database, in a bucket of R2 with a lifecycle rule. */
+        backups: { where: { en: 'in the EU', de: 'in der EU' }, days: 30 }
+    },
+    /** The server of the products: the seat of the company, and where its data centres are. */
+    hoster: {
+        name: 'Hetzner Online GmbH',
+        country: { en: 'Germany', de: 'Deutschland' },
+        dataCentres: { en: 'Germany', de: 'Deutschland' },
+        role: 'processor'
+    },
+    /** Each product's database: a project of its own. */
+    neon: {
+        name: 'Neon, LLC',
+        owner: 'Databricks',
+        country: USA,
+        /** Certified under the Data Privacy Framework through Databricks. */
+        transfer: 'dpf',
+        role: 'processor',
+        cloud: 'Amazon Web Services',
+        /** The region of the cloud, which Neon names aws-eu-central-1. */
+        region: 'eu-central-1',
+        place: { en: 'Frankfurt, Germany', de: 'Frankfurt, Deutschland' },
+        /** The history to restore a database to an earlier point, at most this long. */
+        historyDays: 30
+    },
+    /** Each product's own Stripe account; Stripe is a controller of its own too. */
+    stripe: {
+        name: 'Stripe Payments Europe, Limited',
+        country: { en: 'Ireland', de: 'Irland' },
+        role: 'controller',
+        parent: { name: 'Stripe, Inc.', country: USA, transfer: 'dpf' },
+        privacy: 'stripe.com/privacy'
+    },
+    /** Sends the mails from the relay on and keeps the mailbox. */
+    mail: {
+        name: 'Infomaniak Network SA',
+        country: { en: 'Switzerland', de: 'Schweiz' },
+        role: 'processor'
+    },
+    /**
+     * The log of a product's container rotates by size in this many files of this size, and goes with
+     * the container when a new version starts.
+     */
+    appLog: { files: 3, megabytes: 10, newVersion: 'removed' },
+    /**
+     * Caddy keeps no access log. What fails, a request it cannot pass on among it, its default logger
+     * writes into the log of its container, filtered: without headers (the address of the visitor
+     * stood in CF-Connecting-IP and X-Forwarded-For), without the query, the address of Cloudflare
+     * shortened. Docker rotates that log by size; it belongs to the web server, not to a product, and
+     * stays when a product starts a new version.
+     */
+    webServer: {
+        accessLog: 'none',
+        errorLog: { content: 'requestWithoutAddress', files: 3, megabytes: 20, newVersion: 'stays' }
+    },
+    /** The mail relay logs each recipient and the state of each delivery; journald keeps it this long. */
+    relayLogDays: 30
+};
+/** The providers of the fleet that process data for the operator, which the terms name. */
+export const FLEET_PROCESSORS = [
+    FLEET.cloudflare,
+    FLEET.hoster,
+    FLEET.neon,
+    FLEET.stripe,
+    FLEET.mail
+]
+    .filter((provider) => provider.role === 'processor')
+    .map((provider) => provider.name);

package/dist/server/legal/index.d.ts

@@ -0,0 +1,3 @@
+import type { LegalFacts, LegalPages } from './document.js';
+export type { LegalFacts, LegalPages } from './document.js';
+export declare function legalPages(facts: LegalFacts): LegalPages;

package/dist/server/legal/index.js

@@ -0,0 +1,11 @@
+import { de } from './de.js';
+import { en } from './en.js';
+const TEXTS = { en, de };
+export function legalPages(facts) {
+    const texts = TEXTS[facts.language];
+    return {
+        imprint: texts.imprint(facts),
+        privacy: texts.privacy(facts),
+        terms: texts.terms(facts)
+    };
+}

package/dist/server/limits.d.ts

@@ -0,0 +1,58 @@
+/**
+ * A window counts for an hour at most: the privacy policy of every product says that a count per IP
+ * address applies for at most one hour, and a product counts its own routes with these counters too.
+ */
+export declare const LONGEST_WINDOW_MS: number;
+/** At most `limit` tries per `windowMs`, which is at most LONGEST_WINDOW_MS. */
+export interface Rule {
+    limit: number;
+    windowMs: number;
+}
+export interface Limits {
+    /** Counts one try of `key` under `rule`: 0 when it may go on, else the seconds to wait. */
+    take(key: string, rule: Rule): number;
+    /** Forgets `key`, as after a good login. */
+    reset(key: string): void;
+    size(): number;
+}
+export declare const LIMITS: {
+    /** Sign-ups from one address, on the web and over the API. */
+    readonly signup: {
+        readonly limit: 10;
+        readonly windowMs: number;
+    };
+    /** Logins from one address with one email address; checks of the password of one account. */
+    readonly login: {
+        readonly limit: 10;
+        readonly windowMs: number;
+    };
+    /** Logins from one address, whatever the email address: no spraying of one password. */
+    readonly loginAddress: {
+        readonly limit: 30;
+        readonly windowMs: number;
+    };
+    /** Requests for a new password from one address. */
+    readonly forgotPassword: {
+        readonly limit: 5;
+        readonly windowMs: number;
+    };
+    /** Mails of the accounts to one recipient, whoever asks for them. */
+    readonly mailsTo: {
+        readonly limit: 5;
+        readonly windowMs: number;
+    };
+    /** Changes of the address of one account. */
+    readonly emailChange: {
+        readonly limit: 3;
+        readonly windowMs: number;
+    };
+    /** Requests with one API key. */
+    readonly api: {
+        readonly limit: 120;
+        readonly windowMs: 60000;
+    };
+};
+export declare function createLimits(options: {
+    now: () => number;
+    capacity?: number;
+}): Limits;

package/dist/server/limits.js

@@ -0,0 +1,76 @@
+// Counters in memory, one fixed window per key: one process serves a product, so memory is the right
+// place, and a restart forgets them, which only ever errs towards letting someone in.
+/**
+ * A window counts for an hour at most: the privacy policy of every product says that a count per IP
+ * address applies for at most one hour, and a product counts its own routes with these counters too.
+ */
+export const LONGEST_WINDOW_MS = 60 * 60_000;
+export const LIMITS = {
+    /** Sign-ups from one address, on the web and over the API. */
+    signup: { limit: 10, windowMs: 60 * 60_000 },
+    /** Logins from one address with one email address; checks of the password of one account. */
+    login: { limit: 10, windowMs: 15 * 60_000 },
+    /** Logins from one address, whatever the email address: no spraying of one password. */
+    loginAddress: { limit: 30, windowMs: 15 * 60_000 },
+    /** Requests for a new password from one address. */
+    forgotPassword: { limit: 5, windowMs: 60 * 60_000 },
+    /** Mails of the accounts to one recipient, whoever asks for them. */
+    mailsTo: { limit: 5, windowMs: 60 * 60_000 },
+    /** Changes of the address of one account. */
+    emailChange: { limit: 3, windowMs: 60 * 60_000 },
+    /** Requests with one API key. */
+    api: { limit: 120, windowMs: 60_000 }
+};
+/**
+ * Past this many keys, ended windows go first, then the oldest that refuse nothing. A window that
+ * refuses stays, even past it: whoever floods the counters with keys of their own cannot reset the
+ * one that stops them, and every such window cost its `limit` tries and ends with its time.
+ */
+const CAPACITY = 50_000;
+export function createLimits(options) {
+    const { now } = options;
+    const capacity = options.capacity ?? CAPACITY;
+    const windows = new Map();
+    function current(key, at) {
+        const window = windows.get(key);
+        if (window !== undefined && window.endsAt <= at) {
+            windows.delete(key);
+            return undefined;
+        }
+        return window;
+    }
+    function makeRoom(at) {
+        for (const [key, window] of windows)
+            if (window.endsAt <= at)
+                windows.delete(key);
+        for (const [key, window] of windows) {
+            if (windows.size < capacity)
+                break;
+            if (window.count < window.limit)
+                windows.delete(key);
+        }
+    }
+    return {
+        take(key, rule) {
+            if (rule.windowMs > LONGEST_WINDOW_MS) {
+                throw new Error(`a limit counts for one hour at most (the privacy policy says so): this one counts for ${rule.windowMs} ms`);
+            }
+            const at = now();
+            const window = current(key, at);
+            if (window === undefined) {
+                if (windows.size >= capacity)
+                    makeRoom(at);
+                windows.set(key, { count: 1, limit: rule.limit, endsAt: at + rule.windowMs });
+                return 0;
+            }
+            if (window.count >= rule.limit)
+                return Math.ceil((window.endsAt - at) / 1_000);
+            window.count += 1;
+            return 0;
+        },
+        reset(key) {
+            windows.delete(key);
+        },
+        size: () => windows.size
+    };
+}

package/dist/server/log.d.ts

@@ -0,0 +1,26 @@
+/** The first three keys of every line belong to the log. */
+export type Fields = Record<string, unknown> & {
+    time?: never;
+    level?: never;
+    msg?: never;
+};
+export interface Log {
+    debug: (msg: string, fields?: Fields) => void;
+    info: (msg: string, fields?: Fields) => void;
+    warn: (msg: string, fields?: Fields) => void;
+    error: (msg: string, fields?: Fields) => void;
+}
+export interface DescribedError {
+    name: string;
+    message: string;
+    code?: string | number;
+    errors?: string[];
+}
+/** An error as the log shows it; an AggregateError (pg tries every address) lists its messages. */
+export declare function describeError(error: unknown): DescribedError;
+export declare function createLog(options: {
+    /** LOG_LEVEL; without it the log writes from info on. */
+    level: string | undefined;
+    write: (line: string) => void;
+    now: () => Date;
+}): Log;