nixamp 0.53.5 → 0.54.0

package/dist/follow-page.d.ts

@@ -0,0 +1,23 @@
+import type { IncomingMessage, ServerResponse } from "node:http";
+export interface FollowPageContext {
+    /** The signed-in account, or null. */
+    account: () => Promise<{
+        id: string;
+    } | null>;
+    follows: {
+        follow: (follower: string, streamer: string) => Promise<boolean>;
+        unfollow: (follower: string, streamer: string) => Promise<void>;
+        isFollowing: (follower: string, streamer: string) => Promise<boolean>;
+        followerCount: (streamer: string) => Promise<number>;
+    };
+    readBody: (request: IncomingMessage) => Promise<string>;
+}
+export declare const FOLLOW_CSP: string;
+/** What the link says, cleaned: an artist id, a name to show, and an https page to go back to. */
+export declare function followTarget(input: URLSearchParams): {
+    id: string;
+    name: string;
+    back: string;
+} | null;
+/** Answers /follow; false for any other path. */
+export declare function handleFollowPage(request: IncomingMessage, response: ServerResponse, path: string, url: URL, ctx: FollowPageContext): Promise<boolean>;

package/dist/follow-page.js

@@ -0,0 +1,111 @@
+/**
+ * /follow on nixamp.com: follow an artist from a /radio page (radio-pages.ts).
+ *
+ * The /radio pages are on another site (live.streaming.pit.world), where a
+ * nixamp.com session cookie is a third-party cookie and no browser sends it.
+ * So Follow there is a link here, where the session is first-party: this page
+ * says who you are following, and a same-site form (SameSite=Lax keeps a
+ * cross-site POST from carrying the session) follows or unfollows. The follow
+ * is the same follows row as following a streamer, keyed "artist:<name>".
+ *
+ *   GET  /follow?id=artist:<name>&name=<shown>&back=<https page>
+ *   POST /follow   id, name, back, act=follow|unfollow  -> 303 back to the GET
+ */
+import { createHash } from "node:crypto";
+const ID = /^artist:[a-z0-9-]{1,90}$/;
+function escape(text) {
+    return String(text).replace(/[&<>"']/g, (one) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[one]);
+}
+const STYLE = `
+:root{--bg:#080c09;--fg:#e8efe9;--muted:#9aa79d;--card:#0e1410;--line:#1f2a22;--accent:#3ddc84}
+*{box-sizing:border-box}html,body{margin:0;background:var(--bg);color:var(--fg);font:16px/1.5 system-ui,-apple-system,"Segoe UI",sans-serif}
+main{max-width:520px;margin:0 auto;padding:40px 16px}
+.card{background:var(--card);border:1px solid var(--line);border-radius:16px;padding:24px}
+h1{margin:0 0 4px;font-size:1.5rem;overflow-wrap:anywhere}.by{color:var(--muted);margin:0 0 16px}
+button,a.go{display:block;text-align:center;text-decoration:none;margin-top:18px;width:100%;padding:12px;border:0;border-radius:999px;background:var(--accent);color:#06120a;font:inherit;font-weight:800;cursor:pointer}
+button.quiet{background:transparent;color:var(--fg);border:1px solid var(--line)}
+a{color:var(--accent)}a:focus-visible,button:focus-visible{outline:3px solid var(--accent);outline-offset:2px}
+small{display:block;margin-top:18px;color:var(--muted)}
+`;
+const hash = (text) => `'sha256-${createHash("sha256").update(text).digest("base64")}'`;
+export const FOLLOW_CSP = ["default-src 'none'", `style-src ${hash(STYLE)}`, "img-src 'self'", "form-action 'self'", "base-uri 'none'", "frame-ancestors 'none'"].join("; ");
+function page(title, body) {
+    return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">
+<title>${escape(title)} · nixamp</title><meta name="robots" content="noindex"><link rel="icon" href="/favicon.png" type="image/png"><style>${STYLE}</style></head>
+<body><main><div class="card">${body}</div></main></body></html>`;
+}
+function send(response, status, html, method) {
+    response.writeHead(status, { "content-type": "text/html; charset=utf-8", "content-security-policy": FOLLOW_CSP, "cache-control": "no-store", "referrer-policy": "no-referrer", "x-content-type-options": "nosniff" });
+    response.end(method === "HEAD" ? undefined : html);
+}
+/** What the link says, cleaned: an artist id, a name to show, and an https page to go back to. */
+export function followTarget(input) {
+    const id = (input.get("id") ?? "").trim();
+    if (!ID.test(id))
+        return null;
+    const name = (input.get("name") ?? "").replace(/[\u0000-\u001f]/g, " ").trim().slice(0, 120) || id.slice("artist:".length);
+    let back = "";
+    try {
+        const url = new URL(input.get("back") ?? "");
+        if (url.protocol === "https:" && !url.username && !url.password)
+            back = url.href;
+    }
+    catch {
+        back = "";
+    }
+    return { id, name, back };
+}
+/** Answers /follow; false for any other path. */
+export async function handleFollowPage(request, response, path, url, ctx) {
+    if (path !== "/follow")
+        return false;
+    const method = request.method ?? "GET";
+    if (method === "POST") {
+        // Same site only: a form on another site gets no session (SameSite=Lax), and is told so here too.
+        const origin = String(request.headers.origin ?? "");
+        const host = String(request.headers["x-forwarded-host"] ?? request.headers.host ?? "").split(",")[0].trim();
+        if (origin && origin !== "null" && new URL(origin).host !== host) {
+            send(response, 403, page("Not from here", `<h1>Not from here</h1><p class="by">Follow from nixamp.com's own page.</p>`), method);
+            return true;
+        }
+        const form = new URLSearchParams(await ctx.readBody(request));
+        const target = followTarget(form);
+        const me = await ctx.account().catch(() => null);
+        if (target && me) {
+            if (form.get("act") === "unfollow")
+                await ctx.follows.unfollow(me.id, target.id);
+            else
+                await ctx.follows.follow(me.id, target.id);
+        }
+        const again = target ? `/follow?${new URLSearchParams({ id: target.id, name: target.name, ...(target.back ? { back: target.back } : {}) }).toString()}` : "/follow";
+        response.writeHead(303, { location: again, "cache-control": "no-store" });
+        response.end();
+        return true;
+    }
+    if (method !== "GET" && method !== "HEAD") {
+        response.writeHead(405, { allow: "GET, POST" }).end();
+        return true;
+    }
+    const target = followTarget(url.searchParams);
+    if (!target) {
+        send(response, 404, page("Nobody to follow", `<h1>Nobody to follow</h1><p class="by">That link does not name an artist.</p>`), method);
+        return true;
+    }
+    const back = target.back ? `<small><a href="${escape(target.back)}">← Back to ${escape(target.name)}</a></small>` : "";
+    const me = await ctx.account().catch(() => null);
+    if (!me) {
+        send(response, 200, page(`Follow ${target.name}`, `<h1>Follow ${escape(target.name)}</h1>
+<p class="by">Sign in to nixamp.com to follow the artists you hear on the radio.</p>
+<a class="go" href="/radio#music">Sign in to nixamp.com</a>
+<small>Signed in, open this page again (or press Follow on the artist's page) to follow.</small>${back}`), method);
+        return true;
+    }
+    const [following, count] = await Promise.all([ctx.follows.isFollowing(me.id, target.id), ctx.follows.followerCount(target.id).catch(() => 0)]);
+    const hidden = `<input type="hidden" name="id" value="${escape(target.id)}"><input type="hidden" name="name" value="${escape(target.name)}">${target.back ? `<input type="hidden" name="back" value="${escape(target.back)}">` : ""}`;
+    send(response, 200, page(`Follow ${target.name}`, `<h1>${escape(target.name)}</h1>
+<p class="by">${following ? "You follow them." : "Follow them to keep them with your follows on nixamp.com."} ${count} follower${count === 1 ? "" : "s"}.</p>
+<form method="post" action="/follow">${hidden}<input type="hidden" name="act" value="${following ? "unfollow" : "follow"}">
+<button type="submit"${following ? ' class="quiet"' : ""}>${following ? "Unfollow" : `Follow ${escape(target.name)}`}</button></form>
+${back}`), method);
+    return true;
+}

package/dist/radio-pages.d.ts

@@ -0,0 +1,211 @@
+import type { ServerResponse } from "node:http";
+import type { Station } from "./stations.ts";
+/** A station's own paths, as the station link opens them. */
+export declare const RADIO_SUB: RegExp;
+export declare const RADIO_STATION: RegExp;
+export declare const RADIO_ARTIST: RegExp;
+export declare const RADIO_ALBUM: RegExp;
+export declare function isRadioPath(path: string): boolean;
+/**
+ * Public, listed stations by name. Oldest first, so a name stays with the
+ * station that had it; a second "Jazz" is jazz-2.
+ */
+export declare function radioStations(list: Station[]): Map<string, Station>;
+/** A station's /radio name, or "" when it is not public and listed. */
+export declare function radioSlugOf(stations: Map<string, Station>, id: string): string;
+export interface RadioTrack {
+    title: string;
+    seconds: number;
+    n: number;
+    lyrics?: string;
+}
+export interface RadioAlbum {
+    slug: string;
+    title: string;
+    year: number;
+    artist: string;
+    artistName: string;
+    concept: string;
+    complete: boolean;
+    /** The AI label's keys: its cover and its store. */
+    label?: {
+        artist: string;
+        album: string;
+        cover: boolean;
+    };
+    /** A file of this album's with a picture in it (never shown; read for /cover.jpg). */
+    coverFile?: string;
+    tracks: RadioTrack[];
+    stations: string[];
+}
+export interface RadioArtist {
+    slug: string;
+    name: string;
+    label?: {
+        key: string;
+        genre: string;
+        bio: string;
+    };
+    albums: string[];
+    /** Songs with no album in their tags. */
+    singles: RadioTrack[];
+    stations: string[];
+}
+export interface RadioCatalogue {
+    artists: Map<string, RadioArtist>;
+    albums: Map<string, RadioAlbum>;
+}
+export interface LabelView {
+    holder: string;
+    genres: Array<{
+        genre: string;
+        station: string;
+        artists: Array<{
+            key: string;
+            name: string;
+            genre: string;
+            bio: string;
+            albums: Array<{
+                key: string;
+                title: string;
+                year: number;
+                concept: string;
+                cover: boolean;
+                complete: boolean;
+                songs: Array<{
+                    n: number;
+                    title: string;
+                    seconds: number;
+                    lyrics: string;
+                }>;
+            }>;
+        }>;
+    }>;
+}
+export interface FileTags {
+    title: string;
+    artist: string;
+    album: string;
+    year: number;
+    track: number;
+    duration: number;
+    hasArt: boolean;
+}
+export interface CatalogueInput {
+    stations: Map<string, Station>;
+    label?: LabelView;
+    /** The label song at a file (after audioFor), or null. */
+    songAt?: (file: string) => {
+        artistName: string;
+        albumTitle: string;
+    } | null;
+    /** A label music video's song file; the file itself otherwise. */
+    audioFor?: (file: string) => string;
+    /** What the library knows about a file, or null. */
+    tags: (file: string) => FileTags | null;
+}
+export declare function buildCatalogue(input: CatalogueInput): RadioCatalogue;
+/**
+ * Rewrites what a station's routes answer, for /radio/<name>/...: the
+ * station's own addresses become the /radio ones and its token goes. Only
+ * text (JSON, events, a playlist); sound and pictures pass as they are.
+ */
+export declare function rewriteResponse(response: ServerResponse, rewrite: (text: string) => string): void;
+/** The station's addresses and token, as /radio/<name> says them instead. */
+export declare function radioRewriter(station: {
+    id: string;
+    listenToken: string;
+}, slug: string): (text: string) => string;
+/** The live.streaming header every /radio page carries, so a listener can get anywhere from one. */
+export declare const NAV_STYLE = ".radio-nav{display:flex;flex-wrap:wrap;gap:6px 16px;align-items:center;max-width:960px;margin:0 auto;padding:14px 16px;font:600 15px/1.4 system-ui,-apple-system,\"Segoe UI\",sans-serif}\n.radio-nav a{color:inherit;text-decoration:none;opacity:.8}.radio-nav a:hover,.radio-nav a[aria-current=page]{opacity:1;text-decoration:underline}\n.radio-nav .brand{font-weight:800;opacity:1;margin-right:auto}";
+export declare function radioNav(home: string, current?: "live" | "radio" | "label" | "vod" | ""): string;
+/** No script at all: the pages are links and text. */
+export declare const RADIO_CSP: string;
+export interface PageMeta {
+    title: string;
+    description: string;
+    url: string;
+    image?: string;
+    type?: string;
+}
+export interface DirectoryEntry {
+    slug: string;
+    name: string;
+    description: string;
+    state: string;
+    kind: "audio" | "video";
+    group: string;
+    nowPlaying: {
+        title: string;
+        artist: string;
+    } | null;
+}
+export declare function renderDirectory(entries: DirectoryEntry[], base: string, nav: string): string;
+export interface Shop {
+    /** nixamp.com, where the store and accounts are. */
+    site: string;
+    /** buyLink(...) bound to this server. */
+    buy: (kind: "song" | "album" | "artist", artist: string, album?: string, n?: number) => string;
+    prices: {
+        song: number;
+        album: number;
+        artist: number;
+    };
+}
+export declare function followLink(site: string, slug: string, name: string, back: string): string;
+export declare function renderArtist(catalogue: RadioCatalogue, artist: RadioArtist, ctx: {
+    base: string;
+    nav: string;
+    shop: Shop | null;
+    site: string;
+    stationNames: Map<string, string>;
+}): string;
+export declare function renderAlbum(catalogue: RadioCatalogue, album: RadioAlbum, ctx: {
+    base: string;
+    nav: string;
+    shop: Shop | null;
+    site: string;
+    stationNames: Map<string, string>;
+}): string;
+export declare function renderMissing(what: string, base: string, nav: string): string;
+/** A station page's head and header, for the built station app served at /radio/<name>. */
+/** What a station page's head says: a station of ours or a peer's. */
+export interface StationFace {
+    name: string;
+    description?: string;
+    video?: boolean;
+}
+export declare function stationHead(station: StationFace, slug: string, base: string): string;
+/** The built station page (or the inline one) as /radio/<name> serves it: its head, the header, indexable. */
+export declare function asRadioPage(html: string, station: StationFace, slug: string, base: string, nav: string): string;
+/** A station another server lists on this guide (a guide peer), as /radio reaches it. */
+export interface PeerRadio {
+    origin: string;
+    id: string;
+    token: string;
+    name: string;
+    kind: "audio" | "video";
+    group: string;
+    state: string;
+    nowPlaying: {
+        title: string;
+        artist: string;
+    } | null;
+}
+/**
+ * Peer stations by name, after this server's own (which keep theirs). Only a
+ * peer's own station link (its origin, /station/<id>?t=) is taken; the token
+ * stays on this server, which asks the peer for the listener.
+ */
+export declare function radioPeers(own: Iterable<string>, entries: Array<{
+    id?: string;
+    name: string;
+    kind: "audio" | "video";
+    group?: string;
+    state: string;
+    page: string;
+    nowPlaying: {
+        title: string;
+        artist: string;
+    } | null;
+}>): Map<string, PeerRadio>;