nixamp 0.28.45 → 0.30.1

package/dist/server.js

@@ -9,7 +9,9 @@
  * a WebSocket because SSE is plain HTTP: no dependency, and it reconnects on
  * its own when the laptop running the remote goes to sleep.
  */
-import { createReadStream, statSync } from "node:fs";
+import { publishChoice, shouldRecord } from "./publish-choice.js";
+import { protocolArgs } from "./decoder-policy.js";
+import { createReadStream, existsSync, statSync } from "node:fs";
 import { createServer as createHttpServer } from "node:http";
 import { createServer as createHttpsServer } from "node:https";
 import { randomBytes } from "node:crypto";
@@ -51,6 +53,11 @@ import { Directory, ENDED_TTL_MS, parseAnnouncement } from "./directory.js";
 import { ArtCache, coverArtOf, stillFrom } from "./art.js";
 import { PartyLine, telnyxSms } from "./partyline.js";
 import { HlsPackagers, segmentType, withKey } from "./hls.js";
+import { refusedDestination } from "./destinations.js";
+import { handleStations, isStationListenPath } from "./station-routes.js";
+import { STATION_PAGE, STATION_PAGE_CSP, STATION_PAGE_HTML } from "./station-page.js";
+import { StationRunner } from "./station-runner.js";
+import { StationError, StationStore, stationOfChannel } from "./stations.js";
 import { CompressionService } from "./compression/service.js";
 import { handleChannelCompression, handleCompressionApi, handleStaticRelay } from "./compression/routes.js";
 import { DEFAULT_SITE as NICHEDB, Enricher, FIXTURE_TTL_MS } from "./enrich.js";
@@ -65,7 +72,7 @@ import { Porkbun, isIPv4, isIPv6 } from "./dns.js";
 import { NameError, Names } from "./names.js";
 import { AcmeIssuer, Certs } from "./certs.js";
 import { claimName, fetchCert, humanizeSource, labelFor, readCertFiles, writeCertFiles } from "./naming.js";
-import { forbiddenLibrary, readLibrary } from "./library.js";
+import { forbiddenLibrary, readConfig, readLibrary, writeConfig } from "./library.js";
 import { createThrottle, presentedCredential } from "@profullstack/throttle";
 import { Durable } from "./durable.js";
 import { notifyAll, resendEmail, webPush } from "./notify.js";
@@ -873,6 +880,63 @@ export function memberLiveRefusal(channels, account) {
     }
     return "";
 }
+/**
+ * A station's files, chosen by track index (as /api/folders/live takes them)
+ * or by a folder under the library; null when neither was given. Only files
+ * on this machine and inside the library: a station never reaches past it.
+ */
+export function selectStationFiles(engine, body) {
+    const root = engine.snapshot(false).root;
+    if (Array.isArray(body.items)) {
+        const indices = [...new Set(body.items.filter((one) => Number.isInteger(one) && one >= 0))];
+        const files = indices.map((index) => engine.trackPath(index)).filter((one) => typeof one === "string" && !isRemote(one));
+        if (indices.length !== body.items.length || files.length !== indices.length) {
+            throw new StationError("unknown_items", "one or more of those tracks are not files in this library");
+        }
+        return files;
+    }
+    if (typeof body.folder === "string") {
+        const folder = body.folder.replace(/\\/g, "/").replace(/^\/+|\/+$/g, "");
+        if (folder.split("/").includes(".."))
+            throw new StationError("invalid_folder", "a folder inside the library, please");
+        const files = [];
+        const count = engine.snapshot(false).trackCount;
+        for (let index = 0; index < count; index++) {
+            const file = engine.trackPath(index);
+            if (!file || isRemote(file))
+                continue;
+            const served = relative(root, file).replaceAll("\\", "/");
+            if (served.startsWith("../"))
+                continue;
+            if (folder === "" || served.startsWith(`${folder}/`))
+                files.push(file);
+        }
+        if (files.length === 0)
+            throw new StationError("empty_folder", "that folder has no files that play");
+        return files;
+    }
+    return null;
+}
+const tracksByPath = new WeakMap();
+/** What the library knows about one file: its tags, for a now-playing line. */
+export function trackFor(engine, file) {
+    const revision = engine.snapshot(false).revision;
+    let index = tracksByPath.get(engine);
+    if (!index || index.revision !== revision) {
+        const tracks = engine.snapshot().tracks ?? [];
+        const byPath = new Map();
+        tracks.forEach((track, at) => {
+            const path = engine.trackPath(at);
+            // Tags only: a title that is the file's own name is not a tag.
+            const named = track.title && !looksLikeFileName(track.title) ? track.title : "";
+            if (path)
+                byPath.set(path, { title: named, artist: track.artist ?? "", album: track.album ?? "" });
+        });
+        index = { revision, byPath };
+        tracksByPath.set(engine, index);
+    }
+    return index.byPath.get(file) ?? null;
+}
 /** How many times a source that answers nothing is asked, and how far apart. */
 export const PROBE_TRIES = 3;
 export const PROBE_RETRY_MS = 1500;
@@ -941,7 +1005,7 @@ export async function pullChannel(channels, ffprobe, id, name, source, input = [
         ]
         // No picture in it, so none is invented: MP3 is the thing every browser
         // plays and the thing a listener can join halfway through.
-        : ["-vn", "-c:a", "libmp3lame", "-b:a", "192k", "-f", "mp3"];
+        : ["-vn", "-c:a", "libmp3lame", "-b:a", `${known.audioBitrate ?? 192}k`, "-f", "mp3"];
     // A transport stream is read further into before it is decoded, and given
     // the timestamps a recording cut mid-stream does not carry. Ahead of the
     // caller's own input arguments, which are headers for the address itself.
@@ -950,7 +1014,7 @@ export async function pullChannel(channels, ffprobe, id, name, source, input = [
     // MP3's tags name the episode and the show, and "Inspiring Founders" is a
     // card; "ep-0412-final.mp3" is not.
     const tagged = looksLikeFileName(name) && codecs.tags?.title ? codecs.tags.title : name;
-    const channel = channels.pull(id, tagged, source, encode, kind, true, undefined, opening, kind === "video" ? audio : "", { live, position: known.position ?? 0, ...(playlist ? { playlist, playlistAt: known.playlistAt ?? 0 } : {}) }, 
+    const channel = channels.pull(id, tagged, source, encode, kind, true, undefined, opening, kind === "video" ? audio : "", { live, position: known.position ?? 0, ...(playlist ? { playlist, playlistAt: known.playlistAt ?? 0 } : {}), ...(known.rotation ? { rotation: known.rotation } : {}) }, 
     // Known before the first dial: whether the source is a transport stream
     // decides whether it can be read here for a source-boundary relay.
     assumed ? undefined : codecs);
@@ -1469,7 +1533,7 @@ export function createHandler(engine, options) {
                 json(response, 404, { error: "not found" });
                 return;
             }
-            response.writeHead(302, { ...CORS, "set-cookie": keyCookie(offered), location: "/" });
+            response.writeHead(302, { ...CORS, "set-cookie": keyCookie(offered, request.socket.encrypted === true || (options.secureCookies ?? false)), location: "/" });
             response.end();
             return;
         }
@@ -2061,12 +2125,21 @@ export function createHandler(engine, options) {
         // port is open from another device before wondering whether the link is
         // wrong, and it says nothing about the library.
         const eventChannelRequest = Boolean(channelId && await eventForChannel());
+        // Whether this request holds only the listen key. A listener may browse
+        // and hear the library, but where it lives on this machine is the
+        // owner's business: the absolute path names the user account and the disk.
+        let listening = false;
         if (key !== null &&
             path !== "/api/health" &&
             path !== "/api/directory" &&
             !isSignInPath(path) &&
+            // A station's link is its own key, checked by the station.
+            !isStationListenPath(path) &&
+            !STATION_PAGE.test(path) &&
             !eventChannelRequest) {
             let scope = scopeOf(keyFrom(request, url), key, listenKey);
+            // Kept for the routes below that answer a listener with less.
+            const settle = () => { listening = scope === "listen"; };
             // A key is how somebody who was invited proves it. It is not the only way
             // to be allowed in: the person who owns this server is allowed in whether
             // or not they still have the link, and their nixamp.com session says who
@@ -2093,11 +2166,61 @@ export function createHandler(engine, options) {
                 });
                 return;
             }
+            settle();
             if (scope === "listen" && !allowedForListening(path)) {
                 json(response, 403, { error: "this link can listen, not drive" });
                 return;
             }
         }
+        // Whether this request may administer: the control key, an open server,
+        // or the owner's nixamp.com session. Asked by the routes that do not go
+        // through the admin gate further down.
+        const controlOf = async () => {
+            if (key === null)
+                return { allowed: true, account: "" };
+            if (scopeOf(keyFrom(request, url), key, listenKey) === "control")
+                return { allowed: true, account: "" };
+            if (options.owner) {
+                const session = tokenFrom(request.headers) || url.searchParams.get("session") || "";
+                if (session !== "" && (await options.owner.check(false, session)).allowed) {
+                    return { allowed: true, account: (await options.owner.accountFor(session)) || "" };
+                }
+            }
+            return { allowed: false, account: "" };
+        };
+        // The page a station's link opens. The same bytes for every station: it
+        // reads its id and token from its own address.
+        if (options.stations && STATION_PAGE.test(path) && (request.method === "GET" || request.method === "HEAD")) {
+            response.writeHead(200, {
+                "content-type": "text/html; charset=utf-8",
+                "cache-control": "no-cache",
+                "content-security-policy": STATION_PAGE_CSP,
+                "referrer-policy": "no-referrer",
+                "x-content-type-options": "nosniff",
+            });
+            response.end(request.method === "HEAD" ? undefined : STATION_PAGE_HTML);
+            return;
+        }
+        if (options.stations && (path === "/api/v1/stations" || path.startsWith("/api/v1/stations/"))) {
+            const control = await controlOf();
+            const encrypted = request.socket.encrypted === true;
+            const forwarded = behindProxy ? String(request.headers["x-forwarded-proto"] ?? "").split(",")[0]?.trim() : "";
+            const scheme = forwarded === "https" || encrypted ? "https" : "http";
+            await handleStations(request, response, path, url, {
+                store: options.stations.store,
+                runner: options.stations.runner,
+                channels: options.channels,
+                canControl: control.allowed,
+                account: control.account,
+                select: (body) => selectStationFiles(engine, body),
+                trackFor: (file) => trackFor(engine, file),
+                base: `${scheme}://${request.headers.host ?? "localhost"}`,
+                json,
+                readBody,
+                headers: CORS,
+            });
+            return;
+        }
         if (path === "/api/health") {
             json(response, 200, { name: "nixamp", version: options.version, media: options.media });
             return;
@@ -3842,7 +3965,7 @@ export function createHandler(engine, options) {
                     // offering something that always failed.
                     carries: options.carries !== false && Boolean(options.channels),
                 },
-                channels: (options.channels?.list() ?? []).map((one) => ({
+                channels: (options.channels?.list() ?? []).filter((one) => !stationOfChannel(one.id)).map((one) => ({
                     id: one.id,
                     name: one.name,
                     via: one.via,
@@ -4204,11 +4327,32 @@ export function createHandler(engine, options) {
                 json(response, 429, { error: `this server is already carrying ${MAX_ON_DEMAND} channels on demand; try again in a minute` });
                 return;
             }
-            const resolved = known ?? await resolveLink(options.ytdlp ?? null, link, { cookies: options.cookies ?? "" });
+            // A member's link is fetched from inside the owner's network, so it has
+            // to lead somewhere public: the link, every hop of a playlist, and
+            // whatever yt-dlp says the media is. The owner's is theirs to aim.
+            const guard = liveBy && !known ? (one) => refusedDestination(one) : undefined;
+            if (guard) {
+                const refused = await guard(link);
+                if (refused) {
+                    json(response, 403, { error: refused });
+                    return;
+                }
+            }
+            const resolved = known ?? await resolveLink(options.ytdlp ?? null, link, { cookies: options.cookies ?? "", guard });
             if ("error" in resolved) {
-                json(response, 422, { error: resolved.error });
+                json(response, guard && resolved.error.includes("private network") ? 403 : 422, { error: resolved.error });
                 return;
             }
+            if (guard) {
+                const reached = [resolved.media, resolved.audio, ...(resolved.playlist ?? [])].filter((one) => one && /^(https?|rtmps?):\/\//i.test(one));
+                for (const one of [...new Set(reached)].slice(0, 200)) {
+                    const refused = await guard(one);
+                    if (refused) {
+                        json(response, 403, { error: refused });
+                        return;
+                    }
+                }
+            }
             links.set(link, resolved);
             // A channel already on -- put back by a restart, which forgets where
             // it came from -- learns its picture and its line from the link pasted
@@ -4447,7 +4591,8 @@ export function createHandler(engine, options) {
             // on, and the address a channel is pulled from is the one thing about
             // it that is not theirs to have.
             json(response, 200, {
-                channels: options.channels.list().map(({ source: _source, ...shown }) => shown),
+                // Stations answer for themselves, under /api/v1/stations.
+                channels: options.channels.list().filter((one) => !stationOfChannel(one.id)).map(({ source: _source, ...shown }) => shown),
                 listeners: options.channels.listeners,
             });
             return;
@@ -4459,6 +4604,12 @@ export function createHandler(engine, options) {
             const rest = path.slice("/api/channels/".length);
             const [rawId, action, file] = rest.split("/");
             const id = cleanId(rawId);
+            // A station's channel is heard through the station's own link, which
+            // knows whether it is private. Through here, only by its owner.
+            if (stationOfChannel(id) && !(await controlOf()).allowed) {
+                json(response, 404, { error: "nothing is playing on that channel" });
+                return;
+            }
             const event = await eventForChannel();
             if (event) {
                 const account = await options.accounts?.whoIs(tokenFrom(request.headers)) ?? null;
@@ -5068,7 +5219,7 @@ export function createHandler(engine, options) {
             return;
         }
         if (path === "/api/state") {
-            json(response, 200, engine.snapshot());
+            json(response, 200, listening ? { ...engine.snapshot(), root: "" } : engine.snapshot());
             return;
         }
         // Everything the admin view draws, in one request: who is connected, and
@@ -5132,7 +5283,7 @@ export function createHandler(engine, options) {
                 "x-accel-buffering": "no",
             });
             const send = (snapshot) => {
-                response.write(`data: ${JSON.stringify(snapshot)}\n\n`);
+                response.write(`data: ${JSON.stringify(listening ? { ...snapshot, root: "" } : snapshot)}\n\n`);
             };
             const unsubscribe = engine.subscribe(send);
             // A comment line keeps proxies from closing an idle stream.
@@ -5577,6 +5728,7 @@ async function liveAudio(request, response, engine, ffmpeg, ffprobe) {
             // A live source has no beginning to seek from.
             ...(from > 1 && !isRemote(source) ? ["-ss", String(from)] : []),
             "-re",
+            ...protocolArgs(source),
             "-i", source,
             ...(asVideo
                 // Copied where it can be, because a room full of viewers is a room
@@ -5681,6 +5833,7 @@ inputArgs = []) {
         // when they are handed to it for a file on disk.
         ...(isRemote(source) ? ["-reconnect", "1", "-reconnect_streamed", "1", "-reconnect_delay_max", "5"] : []),
         ...inputArgs,
+        ...protocolArgs(source),
         "-i", source,
         ...outputArgs,
         "-",
@@ -5860,6 +6013,15 @@ export async function serve(argv, version = "0.1.0") {
     // still works after a restart -- and a server is restarted to pick up a new
     // version, which is to say often. `--new-key` mints a fresh pair and forgets
     // the old one, which is the way to revoke a link that got out.
+    // Whether this port had keys before this start: a server that has run
+    // here before, whose directory listing (see publishChoice) is kept.
+    const established = existsSync(join(stateDir(), "keys.json")) &&
+        (() => { try {
+            return String(options.port) in JSON.parse(readFileSync(join(stateDir(), "keys.json"), "utf8"));
+        }
+        catch {
+            return false;
+        } })();
     const remembered = options.key ? rememberedKeys(stateDir(), options.port, options.newKey) : null;
     const key = remembered?.key ?? null;
     // Kept whether or not it is published, so `nixamp admin` and the operator
@@ -5890,6 +6052,9 @@ export async function serve(argv, version = "0.1.0") {
     // same ffmpeg that carries the channels. No ffmpeg, no outro, and a show
     // that ends closes its channel as before.
     const outro = new Outro({ ffmpeg: tools.ffmpeg, dir: join(stateDir(), "outro"), onEvent: (message) => console.log(message) });
+    // Made once the channels exist; told of every channel that ends, so a
+    // station that died is brought back and one that was stopped is not.
+    let stationRunner = null;
     const channels = new Channels({
         ffmpeg: tools.ffmpeg,
         ffprobe: tools.ffprobe,
@@ -5899,8 +6064,24 @@ export async function serve(argv, version = "0.1.0") {
         onEnd: (info) => {
             console.log(`  "${info.id}" stopped.`);
             art.forget(info.id);
+            stationRunner?.onChannelEnd(info);
         },
     });
+    const stationStore = new StationStore(StationStore.fileFor(stateDir(), options.port));
+    stationRunner = new StationRunner({
+        store: stationStore,
+        channels,
+        pull: async (channelId, name, files, known) => Boolean(await pullChannel(channels, tools.ffprobe, channelId, name, files[0], [], "", {
+            playlist: files,
+            live: true,
+            rotation: known.rotation,
+            audioBitrate: known.audioBitrate,
+        })),
+        // The library as it is now, or as it was chosen while it is still being read.
+        roots: () => [engine.snapshot(false).root || chosen].filter((one) => one !== ""),
+        log: (line) => console.log(line),
+    });
+    const stations = { store: stationStore, runner: stationRunner };
     // Channels as HLS, on demand, for Safari on a phone: one ffmpeg copying a
     // channel's fragments into short files while somebody is asking for them.
     // What things are, from nichedb.dev, remembered beside the keys so a
@@ -5949,6 +6130,7 @@ export async function serve(argv, version = "0.1.0") {
                 console.log(`  "${one.id}" is already on.`);
         });
     }
+    stationRunner.restore();
     // Where each film has got to, written down every so often, so a restart
     // picks it up from about there rather than from the start. Only when it
     // has changed: a server carrying nothing but live television writes
@@ -6478,6 +6660,7 @@ export async function serve(argv, version = "0.1.0") {
         media: options.media,
         owner,
         channels,
+        stations,
         rememberChannels: remembering,
         catalogs,
         publishUrls: () => publishUrls,
@@ -6887,6 +7070,11 @@ export async function serve(argv, version = "0.1.0") {
      * A declaration rather than an assignment, so it exists from the moment the
      * function is entered -- the port is open well before this line is reached.
      */
+    /** The station behind this channel, when its owner made it public and listed it. */
+    function listedStation(channelId) {
+        const station = stationStore.get(stationOfChannel(channelId));
+        return station && station.visibility === "public" && station.listed ? station : undefined;
+    }
     function makePublisher() {
         if (!publishable_)
             return null;
@@ -6911,10 +7099,20 @@ export async function serve(argv, version = "0.1.0") {
             // which channels are on. A directory row that says "5,717 files,
             // live: CNN" is one somebody can decide about; "5717 tracks" was not.
             playing: () => engine.snapshot(false).playing,
-            channels: () => channels.list().map((one) => one.name),
+            // Stations only when their owner listed them; every other channel as before.
+            channels: () => channels.list().filter((one) => !stationOfChannel(one.id) || listedStation(one.id)).map((one) => one.name),
             // The same with what a link preview needs: the id a join link names
             // a channel by, a picture, a line.
-            lineup: () => channels.list().map((one) => lineupEntry(listen, one)),
+            lineup: () => channels.list()
+                .filter((one) => !stationOfChannel(one.id) || listedStation(one.id))
+                .map((one) => {
+                const entry = lineupEntry(listen, one);
+                const station = listedStation(one.id);
+                // A station is listened to through its own link, never the server's.
+                return station
+                    ? { ...entry, listen: `${publishable_.url}/station/${station.id}?t=${encodeURIComponent(station.listenToken)}` }
+                    : entry;
+            }),
             // From `nixamp login`. The directory will not list a stream it cannot
             // attribute to somebody, because a listing is now a phone code that
             // costs money to answer.
@@ -6959,10 +7157,23 @@ export async function serve(argv, version = "0.1.0") {
         // public at all.
         //
         // Still asked when a person is at the terminal to answer, because that is
-        // somebody who can say no.
-        const wanted = options.publish === "yes" || !process.stdin.isTTY
-            ? true
-            : await confirm(`\n  List this stream at ${DEFAULT_DIRECTORY}/directory so anyone can find it?\n  It publishes ${listen} — listen only, not the controls.`);
+        // somebody who can say no -- and since 0.29 the answer is kept, so a
+        // daemon started later does what the person said, not what it guesses.
+        const recorded = readConfig().publish;
+        const choice = publishChoice(options.publish, recorded, Boolean(process.stdin.isTTY), established);
+        const wanted = choice === "ask"
+            ? await confirm(`\n  List this stream at ${DEFAULT_DIRECTORY}/directory so anyone can find it?\n  It publishes ${listen} — listen only, not the controls.`)
+            : choice === "yes";
+        if (shouldRecord(options.publish, recorded)) {
+            try {
+                writeConfig({ publish: wanted });
+            }
+            catch { /* unwritable state: asked again next time */ }
+        }
+        if (!wanted && options.publish === "ask") {
+            console.log("");
+            console.log(`  Not listed at ${DEFAULT_DIRECTORY}/directory. Start with --publish to list it.`);
+        }
         if (wanted) {
             publisher = makePublisher();
             listing = (await publisher?.start()) ?? null;

package/dist/share.d.ts

@@ -47,7 +47,7 @@ export declare function keysMatch(a: string, b: string): boolean;
 /** Every place a key is accepted from, in the order they are looked for. */
 export declare function keyFrom(request: IncomingMessage, url: URL): string | null;
 /** The Set-Cookie for a browser that just opened the link. */
-export declare function keyCookie(key: string): string;
+export declare function keyCookie(key: string, secure?: boolean): string;
 /** Where an address actually goes, which is not always where you would like. */
 export declare function classify(address: string): "private" | "cgnat" | "public";
 /** Looks like an address, rather than an error page or a rate-limit notice. */

package/dist/share.js

@@ -108,11 +108,12 @@ export function keyFrom(request, url) {
     return null;
 }
 /** The Set-Cookie for a browser that just opened the link. */
-export function keyCookie(key) {
+export function keyCookie(key, secure = false) {
     // HttpOnly because nothing in the page reads it: the browser attaches it to
-    // every same-origin request by itself. No Secure, because the whole point is
-    // a plain-http address on your own network.
-    return `${KEY_COOKIE}=${encodeURIComponent(key)}; Path=/; Max-Age=31536000; SameSite=Lax; HttpOnly`;
+    // every same-origin request by itself. Secure only when the link was opened
+    // over https: a plain-http address on your own network is still a thing,
+    // and a Secure cookie there would never be sent back.
+    return `${KEY_COOKIE}=${encodeURIComponent(key)}; Path=/; Max-Age=31536000; SameSite=Lax; HttpOnly${secure ? "; Secure" : ""}`;
 }
 /**
  * Interfaces that exist for containers and virtual machines. An address on one

package/dist/station-cli.d.ts

@@ -0,0 +1,3 @@
+import { USAGE } from "./station-usage.ts";
+export { USAGE };
+export declare function station(argv: string[]): Promise<number>;