nixamp 0.56.0 → 0.57.1

package/src/oauth.ts

@@ -16,7 +16,7 @@
  * address, and both are asked. Without that check, anyone who can add an
  * unverified address at a provider could claim somebody else's nixamp account.
  */
-import { randomBytes } from "node:crypto";
+import { createHash, randomBytes } from "node:crypto";
 import type { Account } from "./accounts.ts";
 import type { DeviceGrants } from "./device.ts";
 import type { Queryable } from "./follows.ts";
@@ -33,6 +33,8 @@ export interface Provider {
   scope: string;
   /** Turn the provider's access token into an address it stands behind. */
   identify(accessToken: string, send: typeof fetch): Promise<Identity | null>;
+  /** OAuth 2.1: the round trip carries a PKCE S256 challenge and the exchange its verifier. */
+  pkce?: boolean;
 }
 
 /** Who the provider says this is. `subject` is stable when an address is not. */
@@ -40,6 +42,43 @@ export interface Identity {
   provider: string;
   subject: string;
   email: string;
+  /**
+   * Whether the provider verified the address. Absent means yes (GitHub and
+   * Google are only asked for verified ones). An unverified one never links
+   * to an existing account and is never the new account's address.
+   */
+  verified?: boolean;
+}
+
+/**
+ * CoinPay (coinpayportal.com), the house identity: OAuth 2.1, authorization
+ * code with PKCE S256 and a client secret. CoinPay does not verify the
+ * address it reports, so a CoinPay identity is matched by its `sub` only.
+ */
+export function coinpayProvider(clientId: string, clientSecret: string, base = "https://coinpayportal.com"): Provider {
+  return {
+    id: "coinpay",
+    name: "CoinPay",
+    clientId,
+    clientSecret,
+    authorizeUrl: `${base}/api/oauth/authorize`,
+    tokenUrl: `${base}/api/oauth/token`,
+    scope: "openid profile email",
+    pkce: true,
+    async identify(accessToken, send) {
+      const who = await readJson(await send(`${base}/api/oauth/userinfo`, { headers: { authorization: `Bearer ${accessToken}`, ...AGENT } }));
+      const subject = typeof who["sub"] === "string" ? who["sub"] : "";
+      if (!subject) return null;
+      const email = typeof who["email"] === "string" ? who["email"].toLowerCase() : "";
+      return { provider: "coinpay", subject, email, verified: who["email_verified"] === true };
+    },
+  };
+}
+
+/** A PKCE pair: the verifier kept here, the S256 challenge sent with the browser. */
+export function pkcePair(): { verifier: string; challenge: string } {
+  const verifier = randomBytes(32).toString("base64url");
+  return { verifier, challenge: createHash("sha256").update(verifier).digest("base64url") };
 }
 
 const AGENT = { "user-agent": "nixamp" };
@@ -114,6 +153,9 @@ export function providersFrom(env: Record<string, string | undefined>): Provider
   if (env["GOOGLE_CLIENT_ID"] && env["GOOGLE_CLIENT_SECRET"]) {
     found.push(googleProvider(env["GOOGLE_CLIENT_ID"], env["GOOGLE_CLIENT_SECRET"]));
   }
+  if (env["COINPAY_OAUTH_CLIENT_ID"] && env["COINPAY_OAUTH_CLIENT_SECRET"]) {
+    found.push(coinpayProvider(env["COINPAY_OAUTH_CLIENT_ID"], env["COINPAY_OAUTH_CLIENT_SECRET"], env["COINPAY_OAUTH_BASE"] || undefined));
+  }
   return found;
 }
 
@@ -122,13 +164,17 @@ export function redirectUri(site: string, provider: Provider): string {
 }
 
 /** Where to send the browser. `state` is the only thing standing between this and CSRF. */
-export function authorizeUrl(provider: Provider, site: string, state: string): string {
+export function authorizeUrl(provider: Provider, site: string, state: string, challenge = ""): string {
   const url = new URL(provider.authorizeUrl);
   url.searchParams.set("client_id", provider.clientId);
   url.searchParams.set("redirect_uri", redirectUri(site, provider));
   url.searchParams.set("response_type", "code");
   url.searchParams.set("scope", provider.scope);
   url.searchParams.set("state", state);
+  if (challenge) {
+    url.searchParams.set("code_challenge", challenge);
+    url.searchParams.set("code_challenge_method", "S256");
+  }
   return url.toString();
 }
 
@@ -138,6 +184,7 @@ export async function exchangeCode(
   code: string,
   site: string,
   send: typeof fetch = fetch,
+  verifier = "",
 ): Promise<string> {
   const answer = await send(provider.tokenUrl, {
     method: "POST",
@@ -154,6 +201,7 @@ export async function exchangeCode(
       code,
       redirect_uri: redirectUri(site, provider),
       grant_type: "authorization_code",
+      ...(verifier ? { code_verifier: verifier } : {}),
     }).toString(),
   });
   const body = await readJson(answer);
@@ -208,7 +256,13 @@ export class Identities {
   }
 
   async resolve(identity: Identity): Promise<Account | null> {
-    if (!identity.subject || !identity.email) return null;
+    if (!identity.subject) return null;
+    // An address the provider did not verify (CoinPay's) is a hint, not a
+    // claim: the account is found by subject alone, and a new one gets an
+    // address nobody can own, so purchases kept by email are never reached
+    // through it.
+    if (identity.verified === false) return this.resolveUnverified(identity);
+    if (!identity.email) return null;
     await this.ensure();
 
     // Already linked. The subject is what is matched, not the address: people
@@ -256,6 +310,37 @@ export class Identities {
     );
     return account;
   }
+
+  /** The account linked to this subject, or a new one whose address is `<provider>-<subject>@<provider>.invalid`. */
+  private async resolveUnverified(identity: Identity): Promise<Account | null> {
+    await this.ensure();
+    const { rows } = await this.db.query(`SELECT user_id, email FROM ${TABLE} WHERE provider = $1 AND subject = $2`, [identity.provider, identity.subject]);
+    const linked = rows[0];
+    const placeholder = `${identity.provider}-${identity.subject.replace(/[^A-Za-z0-9._-]/g, "").slice(0, 60)}@${identity.provider}.invalid`;
+    if (linked) {
+      const id = String(linked["user_id"] ?? "");
+      return id ? { id, email: String(linked["email"] ?? "") || placeholder } : null;
+    }
+    const existing = await this.users.getUserByEmail(placeholder);
+    const account = existing?.id
+      ? { id: existing.id, email: existing.email ?? placeholder }
+      : await (async () => {
+          const made = await this.users.createUser({
+            email: placeholder,
+            password: null,
+            emailVerified: false,
+            profile: { signedUpWith: identity.provider, ...(identity.email ? { providerEmail: identity.email } : {}) },
+          });
+          return { id: String(made.id ?? ""), email: made.email ?? placeholder };
+        })();
+    if (!account.id) return null;
+    await this.db.query(
+      `INSERT INTO ${TABLE} (provider, subject, user_id, email) VALUES ($1, $2, $3, $4)
+       ON CONFLICT (provider, subject) DO NOTHING`,
+      [identity.provider, identity.subject, account.id, placeholder],
+    );
+    return account;
+  }
 }
 
 // --- the sign-in surface ----------------------------------------------------
@@ -273,6 +358,33 @@ export interface Pending {
   /** Set when this round trip is approving a terminal rather than a browser. */
   userCode: string;
   createdAt: number;
+  /** The PKCE verifier, for a provider that takes one. */
+  verifier?: string;
+  /** Where the browser goes once signed in (a path here, or an allowed site); "/" by default. */
+  redirect?: string;
+}
+
+/** The sites a sign-in may return to: NIXAMP_SIGNIN_RETURN_HOSTS, else the ones that send people here. */
+export function signInReturnHosts(env: Record<string, string | undefined> = process.env): string[] {
+  const set = (env["NIXAMP_SIGNIN_RETURN_HOSTS"] ?? "").split(",").map((one) => one.trim().toLowerCase()).filter(Boolean);
+  return set.length ? set : ["live.streaming", "live.streaming.pit.world", "bittorrented.com", "backtoschool.help"];
+}
+
+/**
+ * Where a sign-in may send the browser afterwards: a path on this site, or a
+ * page on one of the sites that send people here to sign in (live.streaming).
+ * Anything else is "/", so a sign-in link cannot be made to bounce elsewhere.
+ */
+export function safeRedirect(value: unknown, allowedHosts: string[] = []): string {
+  if (typeof value !== "string" || value === "") return "/";
+  if (value.startsWith("/") && !value.startsWith("//") && !value.startsWith("/\\")) return value.slice(0, 500);
+  try {
+    const url = new URL(value);
+    if (url.protocol === "https:" && allowedHosts.includes(url.hostname)) return url.href.slice(0, 500);
+  } catch {
+    // not a URL
+  }
+  return "/";
 }
 
 /** A state is only ever open for the length of one sign-in. */
@@ -298,11 +410,12 @@ export class SignIn {
   }
 
   /** Start a round trip, and answer the URL the browser should go to. */
-  begin(provider: Provider, userCode = ""): string {
+  begin(provider: Provider, userCode = "", redirect = "/"): string {
     this.sweep();
     const state = randomBytes(24).toString("base64url");
-    this.states.set(state, { provider: provider.id, userCode, createdAt: this.now() });
-    return authorizeUrl(provider, this.site, state);
+    const pair = provider.pkce ? pkcePair() : null;
+    this.states.set(state, { provider: provider.id, userCode, createdAt: this.now(), redirect, ...(pair ? { verifier: pair.verifier } : {}) });
+    return authorizeUrl(provider, this.site, state, pair?.challenge ?? "");
   }
 
   /** Redeem a state exactly once, so a replayed callback finds nothing. */

package/src/playlist-input.ts

@@ -39,7 +39,16 @@ export interface PlaylistInput {
    * `next` answers a file to play (an advert, an ident) or null for no break
    * this time. The break is outside the rotation and the station's history.
    */
-  breaks?: { everySeconds: number | (() => number); next: () => Promise<string | null> };
+  breaks?: {
+    everySeconds: number | (() => number);
+    next: () => Promise<string | null>;
+    /**
+     * Seconds of airtime since the last break when this stream opens, asked
+     * once per open: a station that slept with nobody listening carries its
+     * clock across, so breaks come every so often of time on the air.
+     */
+    sinceBreak?: () => number;
+  };
   /** Told when an entry is passed over because it would not play. */
   onFailure?: (event: { at: number; file: string; reason: string }) => void;
 }
@@ -51,12 +60,26 @@ export interface PlaylistInput {
  */
 export const MAX_FAILURES_IN_A_ROW = 5;
 
+/** An entry that started: where it sits in the stream and in its pass. */
+interface Entry {
+  at: number;
+  file: string;
+  start: number;
+  position: number;
+  list: readonly string[];
+  /** The pass's order and how far into it the next entry is, for resumePoint. */
+  order: readonly number[];
+  step: number;
+  /** Where the break clock stood when it started. */
+  lastBreak: number;
+}
+
 /** Decode each file independently; feed one persistent muxer a fixed stream
  * profile and continuous timestamps. A concat demuxer cannot decode a list
  * whose input codecs differ. Only one entry is encoded at a time, with pipe
  * backpressure bounding read-ahead independently of the directory's size. */
 export class PlaylistInputStream {
-  private entries: { at: number; file: string; start: number; position: number; list: readonly string[] }[] = [];
+  private entries: Entry[] = [];
   error: Error | null = null;
   complete = false;
   /**
@@ -68,7 +91,7 @@ export class PlaylistInputStream {
   constructor(private readonly options: PlaylistInput) {}
 
   /** Every entry that has started, in the order it started, with where it sits in the stream. */
-  get history(): ReadonlyArray<{ at: number; file: string; start: number; position: number; list: readonly string[] }> {
+  get history(): ReadonlyArray<Entry> {
     return this.entries;
   }
 
@@ -84,6 +107,22 @@ export class PlaylistInputStream {
       : { at: this.options.at, position: this.options.position, list: this.options.files };
   }
 
+  /**
+   * Where to pick up after this point of the stream, for a station that
+   * sleeps with nobody listening: the file that is on ("" in a break), the
+   * rest of this pass in the order it was going to play, and the seconds
+   * of airtime since the last break.
+   */
+  resumePoint(seconds: number): { file: string; upcoming: string[]; sinceBreak: number } | null {
+    const entry = this.entries.findLast(one => seconds >= one.start) ?? this.entries[0];
+    if (!entry) return null;
+    return {
+      file: entry.at >= 0 ? entry.file : "",
+      upcoming: entry.order.slice(entry.step).map((index) => entry.list[index]).filter((one): one is string => typeof one === "string"),
+      sinceBreak: entry.at < 0 ? 0 : Math.max(0, seconds - entry.lastBreak),
+    };
+  }
+
   /** The decoder for the entry that is on, so skip() can end it early. */
   private stopCurrent: (() => void) | null = null;
   private skipping = false;
@@ -114,7 +153,9 @@ export class PlaylistInputStream {
       let step = Math.min(Math.max(0, o.at), order.length);
       let played = 0;
       let last = "";
-      let lastBreak = 0;
+      // Counted back from 0 by however long it had been, so a clock carried
+      // across a sleep comes due when it would have on the air.
+      let lastBreak = -Math.max(0, o.breaks?.sinceBreak?.() ?? 0);
       // A film cut for a break, to be picked up where it stopped.
       let resume: { at: number; file: string; position: number } | null = null;
       for (;;) {
@@ -179,7 +220,7 @@ export class PlaylistInputStream {
             const room = o.video && !isBreak && o.breaks && every > 0 ? every - (offset - lastBreak) : Infinity;
             const cut = room >= 1 && full - room > 5;
             const duration = cut ? room : full;
-            this.entries.push({ at, file, start: offset, position, list: files });
+            this.entries.push({ at, file, start: offset, position, list: files, order, step, lastBreak });
             const hasVideo = Boolean(codecs.video);
             const extra = o.video && !hasVideo
               ? ["-f", "lavfi", "-i", `color=c=black:s=${width}x${height}:r=30`]

package/src/server.ts

@@ -55,6 +55,8 @@ import {
   devicePage,
   exchangeCode,
   providersFrom,
+  safeRedirect,
+  signInReturnHosts,
   signInFailedPage,
   SignIn,
 } from "./oauth.ts";
@@ -122,7 +124,7 @@ import { Porkbun, isIPv4, isIPv6, type DnsZone } from "./dns.ts";
 import { NameError, Names } from "./names.ts";
 import { AcmeIssuer, Certs } from "./certs.ts";
 import { claimName, fetchCert, humanizeSource, labelFor, readCertFiles, writeCertFiles } from "./naming.ts";
-import { forbiddenLibrary, readConfig, readLibrary, writeConfig } from "./library.ts";
+import { forbiddenLibrary, readConfig, readLibrary, stationIdleSeconds, writeConfig } from "./library.ts";
 import { createThrottle, presentedCredential, type Throttle } from "@profullstack/throttle";
 import { Durable } from "./durable.ts";
 import { notifyAll, resendEmail, webPush, type Notification } from "./notify.ts";
@@ -4927,7 +4929,9 @@ export function createHandler(engine: Engine, options: HandlerOptions) {
         // A terminal can link straight here with the code it is showing, which
         // is one hop shorter than the page for somebody who followed the link.
         const grant = signIn.device.find(url.searchParams.get("device") ?? "");
-        response.writeHead(302, { location: signIn.begin(provider, grant?.userCode ?? "") });
+        // Back where the visit was going: a page here, or a site that sends people here to sign in.
+        const redirect = safeRedirect(url.searchParams.get("redirect"), signInReturnHosts());
+        response.writeHead(302, { location: signIn.begin(provider, grant?.userCode ?? "", redirect) });
         response.end();
         return;
       }
@@ -4945,10 +4949,10 @@ export function createHandler(engine: Engine, options: HandlerOptions) {
         return;
       }
 
-      const access = await exchangeCode(provider, code, signIn.site).catch(() => "");
+      const access = await exchangeCode(provider, code, signIn.site, fetch, pending.verifier ?? "").catch(() => "");
       const identity = access ? await provider.identify(access, fetch).catch(() => null) : null;
       if (identity === null) {
-        html(response, 401, signInFailedPage(`${provider.name} did not confirm a verified email address.`));
+        html(response, 401, signInFailedPage(provider.pkce ? `${provider.name} did not finish the sign-in. Try it again.` : `${provider.name} did not confirm a verified email address.`));
         return;
       }
 
@@ -4971,7 +4975,7 @@ export function createHandler(engine: Engine, options: HandlerOptions) {
 
       response.writeHead(302, {
         "set-cookie": sessionCookie(result.token, secure),
-        location: "/",
+        location: pending.redirect || "/",
       });
       response.end();
       return;
@@ -5940,6 +5944,12 @@ export function createHandler(engine: Engine, options: HandlerOptions) {
         return;
       }
 
+      // A station asleep with nobody listening is woken by whoever asks for
+      // its channel here too, and they are held for its first bytes.
+      if ((action === "hls" || action === undefined) && request.method === "GET" && !channels.has(id) && stationOfChannel(id) && options.stations?.runner.isSleeping(stationOfChannel(id))) {
+        await options.stations.runner.awake(stationOfChannel(id));
+      }
+
       // The same channel as HLS: a playlist of short files, which is what
       // Safari on an iPhone plays live -- it will not take the endless MP4
       // below, and spun on it a few times before giving up. Packaged on
@@ -7455,6 +7465,8 @@ export async function serve(argv: string[], version = "0.1.0"): Promise<void> {
     onRestart: (id) => stationUsage.restarted(id),
     onFailure: (id) => stationUsage.failed(id),
     artistOf: (file) => trackFor(engine, file)?.artist ?? "",
+    // Nobody listening for this long and a station sleeps until somebody does.
+    idleSeconds: () => stationIdleSeconds(process.env, readConfig()),
     store: stationStore,
     channels,
     pull: async (channelId, name, files, known) =>
@@ -7729,6 +7741,7 @@ export async function serve(argv: string[], version = "0.1.0"): Promise<void> {
     });
   }
   stationRunner.restore();
+  stationRunner.watchIdle();
   // Where each film has got to, written down every so often, so a restart
   // picks it up from about there rather than from the start. Only when it
   // has changed: a server carrying nothing but live television writes

package/src/station-routes.ts

@@ -114,14 +114,16 @@ function nowPlayingFile(ctx: StationContext, station: Station): string {
 
 export function publicView(ctx: StationContext, station: Station): PublicStation {
   const state = ctx.runner.observed(station.id);
-  const file = state === "live" || state === "recovering" ? nowPlayingFile(ctx, station) : "";
+  // Asleep, what it will wake on: the first listener hears that next.
+  const asleep = ctx.runner.isSleeping?.(station.id) ?? false;
+  const file = asleep ? ctx.runner.nextUp(station.id) : state === "live" || state === "recovering" ? nowPlayingFile(ctx, station) : "";
   // The tags the player read when it put this file on, else the library's.
   const track = file ? (ctx.channels.tagsOf(channelOf(station.id), file) ?? ctx.trackFor(file)) : null;
   // What the channel is carrying wins over the flag: a station made by hand
   // from films streams video whether or not anyone said so.
   const video = station.video || ctx.channels.kindOf(channelOf(station.id)) === "video";
   // How far into the song (or film) on the air, by the encoder's clock, and how long it is.
-  const position = file ? ctx.channels.info(channelOf(station.id))?.position : undefined;
+  const position = file && !asleep ? ctx.channels.info(channelOf(station.id))?.position : undefined;
   const duration = file && ctx.durationOf ? ctx.durationOf(file) : 0;
   const progress = typeof position === "number" && duration > 0 ? { position: Math.round(Math.min(position, duration) * 10) / 10, duration: Math.round(duration * 10) / 10 } : null;
   return {
@@ -161,11 +163,13 @@ export function guideEntries(ctx: StationContext): Array<PublicStation & { page:
   return [...names].map(([slug, one]) => ({ ...publicView(ctx, one), page: links(ctx, one, base).page, m3u: links(ctx, one, base).m3u, group: guideGroup(one), radio: `${radioBase}/radio/${slug}` }));
 }
 
-export function ownerView(ctx: StationContext, station: Station): OwnerStation & { links: ReturnType<typeof links>; nowPlaying: string } {
+export function ownerView(ctx: StationContext, station: Station): OwnerStation & { links: ReturnType<typeof links>; nowPlaying: string; sleeping: boolean } {
   const { failures, idempotencyKey: _key, ...rest } = station;
   return {
     ...rest,
     state: ctx.runner.observed(station.id),
+    // On the air with nobody listening: no encoder until somebody does.
+    sleeping: ctx.runner.isSleeping?.(station.id) ?? false,
     excluded: Object.entries(failures).filter(([, count]) => count >= 3).map(([file]) => file),
     listeners: ctx.runner.listeners(station.id),
     error: ctx.runner.error(station.id),
@@ -348,18 +352,31 @@ export async function handleStations(
       return true;
     }
     const channelId = channelOf(station.id);
-    if (!ctx.channels.has(channelId)) {
-      ctx.json(response, 503, { error: "the station is not on the air", code: "not_live", state: ctx.runner.observed(station.id) });
+    // Asleep, a HEAD is told what it would get without waking it.
+    if (method === "HEAD" && ctx.runner.isSleeping?.(station.id)) {
+      response.writeHead(200, { ...ctx.headers, "content-type": station.video ? "video/mp4" : "audio/mpeg", "cache-control": "no-store" });
+      response.end();
       return true;
     }
     // Admitted only within the station's and the server's limits, and the
-    // month's allowance; refused with what to do about it.
+    // month's allowance; refused with what to do about it. Before waking it:
+    // a listener turned away is no reason to start the encoder.
     const refused = method === "GET" && ctx.usage && ctx.limits ? ctx.usage.admit(station.id, ctx.limits) : null;
     if (refused) {
       response.writeHead(refused.status, { ...ctx.headers, "content-type": "application/json; charset=utf-8", "retry-after": String(refused.retryAfter) });
       response.end(JSON.stringify({ error: refused.error, code: refused.code, retryAfter: refused.retryAfter }));
       return true;
     }
+    // The first listener wakes a sleeping station, and is held until it
+    // starts sending, so they hear it begin rather than a stream that ends.
+    let closed = false;
+    response.once("close", () => { closed = true; });
+    await ctx.runner.awake?.(station.id, undefined, () => closed);
+    if (closed) return true;
+    if (!ctx.channels.has(channelId)) {
+      ctx.json(response, 503, { error: "the station is not on the air", code: "not_live", state: ctx.runner.observed(station.id) });
+      return true;
+    }
     // Signed in at nixamp.com: no breaks, starting a little behind live so
     // they can be left out without a gap. Radio only (Channel.listenWithoutBreaks).
     const pass = url.searchParams.get(PASS_PARAM) ?? "";