nixamp 0.16.0 → 0.17.0

package/src/sources.ts

@@ -6,6 +6,7 @@
  * list; what needs care is telling the four apart, and telling an .m3u that
  * lists tracks from an HLS playlist that *is* one track.
  */
+import { closeSync, openSync, readSync } from "node:fs";
 
 /** http and https only. ffmpeg speaks more, but these are what a link is. */
 export function isRemote(source: string): boolean {
@@ -155,3 +156,102 @@ export function playsInBrowser(source: string): boolean {
   const dot = path.lastIndexOf(".");
   return dot > 0 && WEB_READY.has(path.slice(dot));
 }
+
+/**
+ * Transport streams, which is what a raw `.ts` file off a capture card, a
+ * satellite receiver or an IPTV recorder is.
+ *
+ * `.m2ts`, `.mts` and the rest name nothing else, so the extension is answer
+ * enough. `.ts` is the awkward one: it is also every TypeScript file in every
+ * repository on the machine, and this program is written in them. So a `.ts`
+ * is never taken on its name -- it is opened and asked, which costs one read
+ * of two kilobytes and is the only honest way to tell 4K television from a
+ * module.
+ */
+const TRANSPORT_NAMES = new Set([".m2ts", ".mts", ".m2t", ".trp", ".tp", ".mpegts"]);
+
+/** A `.ts`, which may be a transport stream and may be a TypeScript file. */
+export function isAmbiguousTransportName(path: string): boolean {
+  return /\.ts$/i.test(isRemote(path) ? new URL(path).pathname : path);
+}
+
+/** An extension that means a transport stream and nothing else. */
+export function isTransportName(path: string): boolean {
+  const file = isRemote(path) ? new URL(path).pathname : path;
+  const dot = file.lastIndexOf(".");
+  return dot > 0 && TRANSPORT_NAMES.has(file.slice(dot).toLowerCase());
+}
+
+/** How many bytes are read to decide. Three packets at the widest spacing, and room to find the first. */
+const SNIFF = 2048;
+/**
+ * Packet sizes in the wild: 188 is MPEG-TS, 192 is what Blu-ray and a lot of
+ * recorders write (a four-byte arrival timestamp in front of each packet), 204
+ * is 188 with Reed-Solomon parity from a DVB card.
+ */
+const STRIDES = [188, 192, 204];
+
+/**
+ * Whether these bytes are a transport stream: a 0x47 sync byte at the start of
+ * every packet.
+ *
+ * Three in a row at the same spacing, because one 0x47 in a file is the letter
+ * G. The first packet may not be at byte zero -- a recording cut mid-stream
+ * starts mid-packet -- so every offset within one packet is tried.
+ */
+export function sniffTransportStream(head: Buffer): boolean {
+  for (const stride of STRIDES) {
+    for (let start = 0; start < stride; start++) {
+      if (start + stride * 2 >= head.length) break;
+      if (head[start] !== 0x47) continue;
+      if (head[start + stride] === 0x47 && head[start + stride * 2] === 0x47) return true;
+    }
+  }
+  return false;
+}
+
+/**
+ * Whether the file at this path is a transport stream.
+ *
+ * Remembered, because the answer is asked once per snapshot per track and a
+ * library listing must not turn into a read per file per frame. A file that
+ * changes under us is a file being written, and a stale answer about it is a
+ * track that plays rather than a listing that stalls.
+ */
+const sniffed = new Map<string, boolean>();
+const SNIFF_REMEMBERED = 5000;
+
+export function looksLikeTransportStream(path: string): boolean {
+  if (isRemote(path)) return false;
+  const remembered = sniffed.get(path);
+  if (remembered !== undefined) return remembered;
+  let answer = false;
+  let fd: number | null = null;
+  try {
+    fd = openSync(path, "r");
+    const head = Buffer.alloc(SNIFF);
+    const read = readSync(fd, head, 0, SNIFF, 0);
+    answer = sniffTransportStream(head.subarray(0, read));
+  } catch {
+    answer = false;
+  } finally {
+    if (fd !== null) {
+      try {
+        closeSync(fd);
+      } catch {
+        // Closing a file that could not be opened is not a failure.
+      }
+    }
+  }
+  // A cap rather than a cache with eviction: a library of a million files
+  // must not be a million remembered answers, and forgetting costs one read.
+  if (sniffed.size >= SNIFF_REMEMBERED) sniffed.clear();
+  sniffed.set(path, answer);
+  return answer;
+}
+
+/** Whether this path is a transport stream, by name where the name is certain and by its bytes where it is not. */
+export function isTransportStream(path: string): boolean {
+  if (isTransportName(path)) return true;
+  return isAmbiguousTransportName(path) && looksLikeTransportStream(path);
+}

package/src/tickets.ts

@@ -0,0 +1,195 @@
+/**
+ * Tickets: a paid pass to one room.
+ *
+ * The same x402 machinery the crawler paywall runs on, pointed at a single
+ * event instead of at a whole server. A ticket is a signed token with an
+ * expiry and nothing else -- no table, no seat map, no order row -- which is
+ * what makes it usable from a client on another origin that holds no database.
+ *
+ * Three things are deliberate:
+ *
+ * - The signing secret is per event, derived from the deployment's secret and
+ *   the event id. A ticket to Friday is therefore not a ticket to Saturday,
+ *   and no revocation list is needed to make that true.
+ * - The money goes to the event's own `payTo`, so the performer is paid
+ *   directly and nixamp is never in the middle of it.
+ * - A free event has no till at all: `sell` refuses rather than quoting 0.00,
+ *   because a 402 nobody can satisfy is worse than an open door.
+ */
+import { createHash } from "node:crypto";
+import { createGateway, mintPass } from "@profullstack/x402-gateway";
+import {
+  canPerformEvent,
+  isTicketed,
+  type LiveEvent,
+} from "./live-events.ts";
+
+/** Where a ticket rides. Same shape as the crawl pass, different name. */
+export const TICKET_HEADER = "x-nixamp-ticket";
+
+export interface TicketOptions {
+  /** A scoped CoinPay key with payments:create. Without it nothing sells. */
+  coinpayKey: string;
+  /** Pass signing secret. Defaults to the CoinPay key, as the gateway does. */
+  secret?: string;
+  /** The origin a buyer is quoted, which has to be one they can reach. */
+  site: string;
+  /** Injected by tests. */
+  fetch?: typeof fetch;
+}
+
+export interface TicketOffer {
+  ticketed: boolean;
+  priceCents: number;
+  currency: string;
+  minutes: number;
+  header: string;
+  buy: string;
+  /** The x402 body, for a client that pays rather than reads. */
+  offer: unknown;
+}
+
+/** The ticket a request presents: its own header, or the query for a browser. */
+export function ticketFrom(
+  headers: Record<string, string | string[] | undefined>,
+  url?: URL,
+): string {
+  const raw = headers[TICKET_HEADER];
+  const header = Array.isArray(raw) ? raw[0] : raw;
+  if (header && header.trim()) return header.trim();
+  return url?.searchParams.get("ticket")?.trim() ?? "";
+}
+
+/**
+ * Whether this person still has to buy something before the room opens.
+ *
+ * Everyone on the stage is already in: an artist who had to buy a ticket to
+ * their own show would be a bug with a refund attached. So is the person who
+ * is holding a valid one.
+ */
+export function needsTicket(
+  event: LiveEvent,
+  accountId: string | undefined,
+  hasTicket: boolean,
+): boolean {
+  if (!isTicketed(event)) return false;
+  if (canPerformEvent(event, accountId)) return false;
+  return !hasTicket;
+}
+
+export class Tickets {
+  private readonly built = new Map<string, ReturnType<typeof createGateway>>();
+
+  constructor(private readonly options: TicketOptions) {}
+
+  /** Whether tickets can actually be sold here, as opposed to merely priced. */
+  get enabled(): boolean {
+    return Boolean(this.options.coinpayKey);
+  }
+
+  /**
+   * The secret one event's tickets are signed with. Derived rather than
+   * stored: it has to be the same on every process that serves the event, and
+   * different for every event.
+   */
+  private secretFor(event: LiveEvent): string {
+    const base = this.options.secret || this.options.coinpayKey || "nixamp-tickets";
+    return createHash("sha256").update(`${base}:ticket:${event.id}`).digest("hex");
+  }
+
+  private gatewayFor(event: LiveEvent) {
+    const site = this.options.site.replace(/\/$/, "");
+    const key = `${site}|${event.id}|${event.ticketPriceCents}|${event.ticketCurrency}|${event.ticketMinutes}|${event.payTo ?? ""}`;
+    const known = this.built.get(key);
+    if (known) return known;
+    const gateway = createGateway({
+      siteUrl: site,
+      siteName: event.title,
+      payTo: event.payTo ?? "",
+      priceCents: event.ticketPriceCents,
+      currency: event.ticketCurrency,
+      passMinutes: event.ticketMinutes,
+      coinpay: { apiKey: this.options.coinpayKey },
+      secret: this.secretFor(event),
+      header: TICKET_HEADER,
+      path: `/live/${event.slug}/tickets`,
+      // Nothing here is about who is asking: a ticket is a ticket whatever
+      // the user agent says it is.
+      isPaidAgent: () => true,
+      benefits: [`Watch ${event.title} live, and the replay for ${event.ticketMinutes} minutes.`],
+      ...(this.options.fetch ? { fetch: this.options.fetch } : {}),
+    });
+    // Bounded, so a directory of thousands of events cannot grow a gateway
+    // per event and keep them all.
+    if (this.built.size > 200) this.built.clear();
+    this.built.set(key, gateway);
+    return gateway;
+  }
+
+  /** What a ticket costs and how to buy one, without answering a request. */
+  offer(event: LiveEvent): TicketOffer {
+    const site = this.options.site.replace(/\/$/, "");
+    return {
+      ticketed: isTicketed(event),
+      priceCents: event.ticketPriceCents,
+      currency: event.ticketCurrency,
+      minutes: event.ticketMinutes,
+      header: TICKET_HEADER,
+      buy: `${site}/live/${event.slug}/tickets`,
+      offer: isTicketed(event) ? this.gatewayFor(event).offer(1) : { x402Version: 2, accepts: [] },
+    };
+  }
+
+  /**
+   * A ticket nobody paid for: the guest list.
+   *
+   * Every venue has one, and a show that cannot comp the press, the support
+   * act's friends or a refunded buyer is a show whose only answer to a
+   * problem is "pay again". It is the same signed token a sale produces, so
+   * nothing downstream has to know which kind it is holding.
+   */
+  async mint(event: LiveEvent, minutes = event.ticketMinutes): Promise<string> {
+    const now = Math.floor(Date.now() / 1000);
+    const pass = await mintPass({
+      secret: this.secretFor(event),
+      ref: `comp:${event.id}`,
+      expiresAt: now + Math.max(1, Math.floor(minutes)) * 60,
+      now,
+    });
+    return pass.token;
+  }
+
+  /** Whether this token is a ticket this deployment minted for this event. */
+  async holds(event: LiveEvent, token: string): Promise<boolean> {
+    if (!token || !isTicketed(event)) return false;
+    return this.gatewayFor(event).verifyPass(token);
+  }
+
+  /**
+   * Sell one. Handed the buyer's request, because the payment proof travels
+   * in its headers; answers 402 with the offer, or 200 with the ticket.
+   */
+  async sell(event: LiveEvent, request: Request): Promise<Response> {
+    if (!isTicketed(event)) {
+      return Response.json({ error: "this event is free; no ticket is needed" }, { status: 409 });
+    }
+    if (!this.enabled) {
+      return Response.json({ error: "ticket sales are not switched on here" }, { status: 503 });
+    }
+    return this.gatewayFor(event).sell(request);
+  }
+}
+
+/** Read a Tickets configuration out of the environment. */
+export function ticketsFromEnv(
+  site: string,
+  env: NodeJS.ProcessEnv = process.env,
+): TicketOptions | null {
+  const coinpayKey = env["COINPAY_X402_KEY"] ?? "";
+  if (!coinpayKey) return null;
+  return {
+    coinpayKey,
+    site,
+    ...(env["NIXAMP_TICKET_SECRET"] ? { secret: env["NIXAMP_TICKET_SECRET"] } : {}),
+  };
+}

package/src/tokens.ts

@@ -28,8 +28,13 @@ export const TOKEN_PREFIX = "nxa_";
 /** How long a sign-in lasts. Long, because signing in on a television is work. */
 export const SESSION_DAYS = 90;
 
-/** A session ends; a token a person made for a script does not, unless asked. */
-export type TokenKind = "session" | "cli";
+/**
+ * A session ends; a token a person made for a script does not, unless asked;
+ * and one another site holds on your behalf is an `oauth` token, which is the
+ * same thing with a client's name on it so it can be listed and withdrawn as
+ * "bittorrented.com" rather than as an anonymous string.
+ */
+export type TokenKind = "session" | "cli" | "oauth";
 
 export interface TokenRecord {
   id: string;
@@ -113,7 +118,7 @@ function toRecord(row: Record<string, unknown>): TokenRecord {
   return {
     id: String(row["id"] ?? ""),
     name: String(row["name"] ?? ""),
-    kind: row["kind"] === "cli" ? "cli" : "session",
+    kind: row["kind"] === "cli" || row["kind"] === "oauth" ? (row["kind"] as TokenKind) : "session",
     createdAt: asTime(row["created_at"]) ?? 0,
     expiresAt: asTime(row["expires_at"]),
     lastUsedAt: asTime(row["last_used_at"]),
@@ -233,6 +238,48 @@ export class Tokens {
     return rows.length > 0;
   }
 
+  /**
+   * One token, by its id, whatever kind it is.
+   *
+   * `revoke` is scoped to the owner because it answers a person deleting
+   * their own token. This one is for the server withdrawing a token it
+   * issued -- an access token whose refresh token was just rotated, or the
+   * whole family behind a code somebody replayed -- where there is no owner
+   * doing the asking.
+   */
+  async revokeById(id: string): Promise<boolean> {
+    await this.ensure();
+    const { rows } = await this.db.query(`DELETE FROM ${TABLE} WHERE id = $1 RETURNING id`, [id]);
+    return rows.length > 0;
+  }
+
+  /**
+   * The record behind a token, without counting it as a use.
+   *
+   * `verify` is the hot path and stamps last_used_at; this answers the same
+   * question for a caller that needs the row itself -- which client holds
+   * this, and what it was granted -- and leaves the timestamp alone.
+   */
+  async inspect(value: string): Promise<(TokenRecord & { account: Account }) | null> {
+    const parts = splitToken(value);
+    if (parts === null) return null;
+    await this.ensure();
+    const { rows } = await this.db.query(
+      `SELECT id, user_id, email, kind, name, secret_hash, created_at, expires_at, last_used_at
+         FROM ${TABLE} WHERE id = $1`,
+      [parts.id],
+    );
+    const row = rows[0];
+    if (!row) return null;
+    if (!sameHash(String(row["secret_hash"] ?? ""), hashSecret(parts.secret))) return null;
+    const expiresAt = asTime(row["expires_at"]);
+    if (expiresAt !== null && expiresAt <= this.now()) return null;
+    return {
+      ...toRecord(row),
+      account: { id: String(row["user_id"] ?? ""), email: String(row["email"] ?? "") },
+    };
+  }
+
   /** Signing out of one place should not sign you out of the build server. */
   async revokeToken(value: string): Promise<boolean> {
     const parts = splitToken(value);