nixamp 0.57.0 → 0.57.1

package/dist/label-profiles.js

@@ -98,7 +98,7 @@ export function bandMarkdown(band) {
 const MEMBERS_SYSTEM = [
     "You cast the members of a fictional band (or the one person behind a solo act) for an AI record label.",
     "Everyone is invented: never a real person, never a lookalike of one. Give each a full name, their role, and a look described",
-    "precisely enough that an illustrator could draw the same person every time: age range, face, skin tone, hair, build, signature outfit and accessories.",
+    "precisely enough that an illustrator could draw the same person every time. Start every look with their gender and age (\"woman, 24, ...\"), then face, skin tone, hair, build, signature outfit and accessories.",
     "Answer as JSON: {\"members\": [{\"name\": \"\", \"role\": \"\", \"look\": \"at most 300 characters\", \"voice\": \"how they sing or play, at most 150 characters\",",
     "\"personality\": \"at most 150 characters\", \"influences\": \"styles and eras, never named artists, at most 120 characters\", \"bio\": \"one or two sentences\"}]}.",
 ].join(" ");
@@ -143,7 +143,7 @@ export function castLine(members) {
 }
 /** The portrait prompt for a member: the same person every time it is used as a reference. */
 export function portraitPrompt(member, band) {
-    return `Photographic portrait of ${member.look}. ${member.role} in the ${band.genre} band ${band.name}. Head and shoulders, three-quarter view, natural expression, soft studio light, plain dark background, sharp focus, 85mm lens. No text, no logos.`;
+    return `Photographic portrait of ${member.name}: ${member.look}. ${member.role} in the ${band.genre} band ${band.name}. Head and shoulders, three-quarter view, natural expression, soft studio light, plain dark background, sharp focus, 85mm lens. No text, no logos.`;
 }
 /** Writes the member pages and portraits that are missing; returns the members as the pages now say. */
 export async function writeMembers(folder, members, band, draw) {

package/dist/oauth.d.ts

@@ -13,22 +13,41 @@ export interface Provider {
     scope: string;
     /** Turn the provider's access token into an address it stands behind. */
     identify(accessToken: string, send: typeof fetch): Promise<Identity | null>;
+    /** OAuth 2.1: the round trip carries a PKCE S256 challenge and the exchange its verifier. */
+    pkce?: boolean;
 }
 /** Who the provider says this is. `subject` is stable when an address is not. */
 export interface Identity {
     provider: string;
     subject: string;
     email: string;
+    /**
+     * Whether the provider verified the address. Absent means yes (GitHub and
+     * Google are only asked for verified ones). An unverified one never links
+     * to an existing account and is never the new account's address.
+     */
+    verified?: boolean;
 }
+/**
+ * CoinPay (coinpayportal.com), the house identity: OAuth 2.1, authorization
+ * code with PKCE S256 and a client secret. CoinPay does not verify the
+ * address it reports, so a CoinPay identity is matched by its `sub` only.
+ */
+export declare function coinpayProvider(clientId: string, clientSecret: string, base?: string): Provider;
+/** A PKCE pair: the verifier kept here, the S256 challenge sent with the browser. */
+export declare function pkcePair(): {
+    verifier: string;
+    challenge: string;
+};
 export declare function githubProvider(clientId: string, clientSecret: string): Provider;
 export declare function googleProvider(clientId: string, clientSecret: string): Provider;
 /** Whichever providers this deployment has been given both halves of. */
 export declare function providersFrom(env: Record<string, string | undefined>): Provider[];
 export declare function redirectUri(site: string, provider: Provider): string;
 /** Where to send the browser. `state` is the only thing standing between this and CSRF. */
-export declare function authorizeUrl(provider: Provider, site: string, state: string): string;
+export declare function authorizeUrl(provider: Provider, site: string, state: string, challenge?: string): string;
 /** Swap the code for an access token. Empty string means the provider refused. */
-export declare function exchangeCode(provider: Provider, code: string, site: string, send?: typeof fetch): Promise<string>;
+export declare function exchangeCode(provider: Provider, code: string, site: string, send?: typeof fetch, verifier?: string): Promise<string>;
 /** The slice of the auth module's storage adapter that identities need. */
 export interface Users {
     getUserByEmail(email: string): Promise<{
@@ -60,6 +79,8 @@ export declare class Identities {
     constructor(db: Queryable, users: Users);
     private ensure;
     resolve(identity: Identity): Promise<Account | null>;
+    /** The account linked to this subject, or a new one whose address is `<provider>-<subject>@<provider>.invalid`. */
+    private resolveUnverified;
 }
 /**
  * What a round trip to a provider is for.
@@ -74,7 +95,19 @@ export interface Pending {
     /** Set when this round trip is approving a terminal rather than a browser. */
     userCode: string;
     createdAt: number;
+    /** The PKCE verifier, for a provider that takes one. */
+    verifier?: string;
+    /** Where the browser goes once signed in (a path here, or an allowed site); "/" by default. */
+    redirect?: string;
 }
+/** The sites a sign-in may return to: NIXAMP_SIGNIN_RETURN_HOSTS, else the ones that send people here. */
+export declare function signInReturnHosts(env?: Record<string, string | undefined>): string[];
+/**
+ * Where a sign-in may send the browser afterwards: a path on this site, or a
+ * page on one of the sites that send people here to sign in (live.streaming).
+ * Anything else is "/", so a sign-in link cannot be made to bounce elsewhere.
+ */
+export declare function safeRedirect(value: unknown, allowedHosts?: string[]): string;
 /** A state is only ever open for the length of one sign-in. */
 export declare const STATE_TTL_MS = 600000;
 export declare class SignIn {
@@ -91,7 +124,7 @@ export declare class SignIn {
     }[];
     provider(id: unknown): Provider | null;
     /** Start a round trip, and answer the URL the browser should go to. */
-    begin(provider: Provider, userCode?: string): string;
+    begin(provider: Provider, userCode?: string, redirect?: string): string;
     /** Redeem a state exactly once, so a replayed callback finds nothing. */
     claim(state: unknown): Pending | null;
     private sweep;

package/dist/oauth.js

@@ -16,7 +16,37 @@
  * address, and both are asked. Without that check, anyone who can add an
  * unverified address at a provider could claim somebody else's nixamp account.
  */
-import { randomBytes } from "node:crypto";
+import { createHash, randomBytes } from "node:crypto";
+/**
+ * CoinPay (coinpayportal.com), the house identity: OAuth 2.1, authorization
+ * code with PKCE S256 and a client secret. CoinPay does not verify the
+ * address it reports, so a CoinPay identity is matched by its `sub` only.
+ */
+export function coinpayProvider(clientId, clientSecret, base = "https://coinpayportal.com") {
+    return {
+        id: "coinpay",
+        name: "CoinPay",
+        clientId,
+        clientSecret,
+        authorizeUrl: `${base}/api/oauth/authorize`,
+        tokenUrl: `${base}/api/oauth/token`,
+        scope: "openid profile email",
+        pkce: true,
+        async identify(accessToken, send) {
+            const who = await readJson(await send(`${base}/api/oauth/userinfo`, { headers: { authorization: `Bearer ${accessToken}`, ...AGENT } }));
+            const subject = typeof who["sub"] === "string" ? who["sub"] : "";
+            if (!subject)
+                return null;
+            const email = typeof who["email"] === "string" ? who["email"].toLowerCase() : "";
+            return { provider: "coinpay", subject, email, verified: who["email_verified"] === true };
+        },
+    };
+}
+/** A PKCE pair: the verifier kept here, the S256 challenge sent with the browser. */
+export function pkcePair() {
+    const verifier = randomBytes(32).toString("base64url");
+    return { verifier, challenge: createHash("sha256").update(verifier).digest("base64url") };
+}
 const AGENT = { "user-agent": "nixamp" };
 async function readJson(answer) {
     if (!answer.ok)
@@ -86,23 +116,30 @@ export function providersFrom(env) {
     if (env["GOOGLE_CLIENT_ID"] && env["GOOGLE_CLIENT_SECRET"]) {
         found.push(googleProvider(env["GOOGLE_CLIENT_ID"], env["GOOGLE_CLIENT_SECRET"]));
     }
+    if (env["COINPAY_OAUTH_CLIENT_ID"] && env["COINPAY_OAUTH_CLIENT_SECRET"]) {
+        found.push(coinpayProvider(env["COINPAY_OAUTH_CLIENT_ID"], env["COINPAY_OAUTH_CLIENT_SECRET"], env["COINPAY_OAUTH_BASE"] || undefined));
+    }
     return found;
 }
 export function redirectUri(site, provider) {
     return `${site.replace(/\/+$/, "")}/api/v1/${provider.id}/oauth/callback`;
 }
 /** Where to send the browser. `state` is the only thing standing between this and CSRF. */
-export function authorizeUrl(provider, site, state) {
+export function authorizeUrl(provider, site, state, challenge = "") {
     const url = new URL(provider.authorizeUrl);
     url.searchParams.set("client_id", provider.clientId);
     url.searchParams.set("redirect_uri", redirectUri(site, provider));
     url.searchParams.set("response_type", "code");
     url.searchParams.set("scope", provider.scope);
     url.searchParams.set("state", state);
+    if (challenge) {
+        url.searchParams.set("code_challenge", challenge);
+        url.searchParams.set("code_challenge_method", "S256");
+    }
     return url.toString();
 }
 /** Swap the code for an access token. Empty string means the provider refused. */
-export async function exchangeCode(provider, code, site, send = fetch) {
+export async function exchangeCode(provider, code, site, send = fetch, verifier = "") {
     const answer = await send(provider.tokenUrl, {
         method: "POST",
         headers: {
@@ -118,6 +155,7 @@ export async function exchangeCode(provider, code, site, send = fetch) {
             code,
             redirect_uri: redirectUri(site, provider),
             grant_type: "authorization_code",
+            ...(verifier ? { code_verifier: verifier } : {}),
         }).toString(),
     });
     const body = await readJson(answer);
@@ -156,7 +194,15 @@ export class Identities {
         await this.ready;
     }
     async resolve(identity) {
-        if (!identity.subject || !identity.email)
+        if (!identity.subject)
+            return null;
+        // An address the provider did not verify (CoinPay's) is a hint, not a
+        // claim: the account is found by subject alone, and a new one gets an
+        // address nobody can own, so purchases kept by email are never reached
+        // through it.
+        if (identity.verified === false)
+            return this.resolveUnverified(identity);
+        if (!identity.email)
             return null;
         await this.ensure();
         // Already linked. The subject is what is matched, not the address: people
@@ -200,6 +246,59 @@ export class Identities {
        ON CONFLICT (provider, subject) DO UPDATE SET email = EXCLUDED.email`, [identity.provider, identity.subject, account.id, identity.email]);
         return account;
     }
+    /** The account linked to this subject, or a new one whose address is `<provider>-<subject>@<provider>.invalid`. */
+    async resolveUnverified(identity) {
+        await this.ensure();
+        const { rows } = await this.db.query(`SELECT user_id, email FROM ${TABLE} WHERE provider = $1 AND subject = $2`, [identity.provider, identity.subject]);
+        const linked = rows[0];
+        const placeholder = `${identity.provider}-${identity.subject.replace(/[^A-Za-z0-9._-]/g, "").slice(0, 60)}@${identity.provider}.invalid`;
+        if (linked) {
+            const id = String(linked["user_id"] ?? "");
+            return id ? { id, email: String(linked["email"] ?? "") || placeholder } : null;
+        }
+        const existing = await this.users.getUserByEmail(placeholder);
+        const account = existing?.id
+            ? { id: existing.id, email: existing.email ?? placeholder }
+            : await (async () => {
+                const made = await this.users.createUser({
+                    email: placeholder,
+                    password: null,
+                    emailVerified: false,
+                    profile: { signedUpWith: identity.provider, ...(identity.email ? { providerEmail: identity.email } : {}) },
+                });
+                return { id: String(made.id ?? ""), email: made.email ?? placeholder };
+            })();
+        if (!account.id)
+            return null;
+        await this.db.query(`INSERT INTO ${TABLE} (provider, subject, user_id, email) VALUES ($1, $2, $3, $4)
+       ON CONFLICT (provider, subject) DO NOTHING`, [identity.provider, identity.subject, account.id, placeholder]);
+        return account;
+    }
+}
+/** The sites a sign-in may return to: NIXAMP_SIGNIN_RETURN_HOSTS, else the ones that send people here. */
+export function signInReturnHosts(env = process.env) {
+    const set = (env["NIXAMP_SIGNIN_RETURN_HOSTS"] ?? "").split(",").map((one) => one.trim().toLowerCase()).filter(Boolean);
+    return set.length ? set : ["live.streaming", "live.streaming.pit.world", "bittorrented.com", "backtoschool.help"];
+}
+/**
+ * Where a sign-in may send the browser afterwards: a path on this site, or a
+ * page on one of the sites that send people here to sign in (live.streaming).
+ * Anything else is "/", so a sign-in link cannot be made to bounce elsewhere.
+ */
+export function safeRedirect(value, allowedHosts = []) {
+    if (typeof value !== "string" || value === "")
+        return "/";
+    if (value.startsWith("/") && !value.startsWith("//") && !value.startsWith("/\\"))
+        return value.slice(0, 500);
+    try {
+        const url = new URL(value);
+        if (url.protocol === "https:" && allowedHosts.includes(url.hostname))
+            return url.href.slice(0, 500);
+    }
+    catch {
+        // not a URL
+    }
+    return "/";
 }
 /** A state is only ever open for the length of one sign-in. */
 export const STATE_TTL_MS = 600_000;
@@ -223,11 +322,12 @@ export class SignIn {
         return this.providers.find((candidate) => candidate.id === id) ?? null;
     }
     /** Start a round trip, and answer the URL the browser should go to. */
-    begin(provider, userCode = "") {
+    begin(provider, userCode = "", redirect = "/") {
         this.sweep();
         const state = randomBytes(24).toString("base64url");
-        this.states.set(state, { provider: provider.id, userCode, createdAt: this.now() });
-        return authorizeUrl(provider, this.site, state);
+        const pair = provider.pkce ? pkcePair() : null;
+        this.states.set(state, { provider: provider.id, userCode, createdAt: this.now(), redirect, ...(pair ? { verifier: pair.verifier } : {}) });
+        return authorizeUrl(provider, this.site, state, pair?.challenge ?? "");
     }
     /** Redeem a state exactly once, so a replayed callback finds nothing. */
     claim(state) {

package/dist/server.js

@@ -40,7 +40,7 @@ import { NixampLinks, nixampExchange } from "./nixamp-link.js";
 import { handleNixampLinkApi, nixampLinkPath } from "./nixamp-link-api.js";
 import { DeviceGrants } from "./device.js";
 import { BAD_KEY_LIMIT, callerOf, Guard, SIGN_IN_LIMIT } from "./guard.js";
-import { deviceDonePage, devicePage, exchangeCode, providersFrom, signInFailedPage, SignIn, } from "./oauth.js";
+import { deviceDonePage, devicePage, exchangeCode, providersFrom, safeRedirect, signInReturnHosts, signInFailedPage, SignIn, } from "./oauth.js";
 import { AuthorizationServer, BACKTOSCHOOL_CLIENT, SCOPE_NAMES, clientsFrom } from "./oauth-server.js";
 import { handleOAuthApi, oauthApiPath } from "./oauth-api.js";
 import { WatchParties } from "./watch-party.js";
@@ -4509,7 +4509,9 @@ export function createHandler(engine, options) {
                 // A terminal can link straight here with the code it is showing, which
                 // is one hop shorter than the page for somebody who followed the link.
                 const grant = signIn.device.find(url.searchParams.get("device") ?? "");
-                response.writeHead(302, { location: signIn.begin(provider, grant?.userCode ?? "") });
+                // Back where the visit was going: a page here, or a site that sends people here to sign in.
+                const redirect = safeRedirect(url.searchParams.get("redirect"), signInReturnHosts());
+                response.writeHead(302, { location: signIn.begin(provider, grant?.userCode ?? "", redirect) });
                 response.end();
                 return;
             }
@@ -4525,10 +4527,10 @@ export function createHandler(engine, options) {
                 html(response, 400, signInFailedPage(url.searchParams.get("error") ?? "The provider sent no code."));
                 return;
             }
-            const access = await exchangeCode(provider, code, signIn.site).catch(() => "");
+            const access = await exchangeCode(provider, code, signIn.site, fetch, pending.verifier ?? "").catch(() => "");
             const identity = access ? await provider.identify(access, fetch).catch(() => null) : null;
             if (identity === null) {
-                html(response, 401, signInFailedPage(`${provider.name} did not confirm a verified email address.`));
+                html(response, 401, signInFailedPage(provider.pkce ? `${provider.name} did not finish the sign-in. Try it again.` : `${provider.name} did not confirm a verified email address.`));
                 return;
             }
             const result = await accounts.signInWith(identity);
@@ -4548,7 +4550,7 @@ export function createHandler(engine, options) {
             }
             response.writeHead(302, {
                 "set-cookie": sessionCookie(result.token, secure),
-                location: "/",
+                location: pending.redirect || "/",
             });
             response.end();
             return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nixamp",
-  "version": "0.57.0",
+  "version": "0.57.1",
   "description": "It really whips the terminal's ass. A Winamp-shaped audio player for your terminal.",
   "license": "MIT",
   "type": "module",

package/src/label-profiles.ts

@@ -121,7 +121,7 @@ export function bandMarkdown(band: {
 const MEMBERS_SYSTEM = [
   "You cast the members of a fictional band (or the one person behind a solo act) for an AI record label.",
   "Everyone is invented: never a real person, never a lookalike of one. Give each a full name, their role, and a look described",
-  "precisely enough that an illustrator could draw the same person every time: age range, face, skin tone, hair, build, signature outfit and accessories.",
+  "precisely enough that an illustrator could draw the same person every time. Start every look with their gender and age (\"woman, 24, ...\"), then face, skin tone, hair, build, signature outfit and accessories.",
   "Answer as JSON: {\"members\": [{\"name\": \"\", \"role\": \"\", \"look\": \"at most 300 characters\", \"voice\": \"how they sing or play, at most 150 characters\",",
   "\"personality\": \"at most 150 characters\", \"influences\": \"styles and eras, never named artists, at most 120 characters\", \"bio\": \"one or two sentences\"}]}.",
 ].join(" ");
@@ -171,7 +171,7 @@ export function castLine(members: Member[]): string {
 
 /** The portrait prompt for a member: the same person every time it is used as a reference. */
 export function portraitPrompt(member: Member, band: { name: string; genre: string }): string {
-  return `Photographic portrait of ${member.look}. ${member.role} in the ${band.genre} band ${band.name}. Head and shoulders, three-quarter view, natural expression, soft studio light, plain dark background, sharp focus, 85mm lens. No text, no logos.`;
+  return `Photographic portrait of ${member.name}: ${member.look}. ${member.role} in the ${band.genre} band ${band.name}. Head and shoulders, three-quarter view, natural expression, soft studio light, plain dark background, sharp focus, 85mm lens. No text, no logos.`;
 }
 
 /** Writes the member pages and portraits that are missing; returns the members as the pages now say. */

package/src/oauth.ts

@@ -16,7 +16,7 @@
  * address, and both are asked. Without that check, anyone who can add an
  * unverified address at a provider could claim somebody else's nixamp account.
  */
-import { randomBytes } from "node:crypto";
+import { createHash, randomBytes } from "node:crypto";
 import type { Account } from "./accounts.ts";
 import type { DeviceGrants } from "./device.ts";
 import type { Queryable } from "./follows.ts";
@@ -33,6 +33,8 @@ export interface Provider {
   scope: string;
   /** Turn the provider's access token into an address it stands behind. */
   identify(accessToken: string, send: typeof fetch): Promise<Identity | null>;
+  /** OAuth 2.1: the round trip carries a PKCE S256 challenge and the exchange its verifier. */
+  pkce?: boolean;
 }
 
 /** Who the provider says this is. `subject` is stable when an address is not. */
@@ -40,6 +42,43 @@ export interface Identity {
   provider: string;
   subject: string;
   email: string;
+  /**
+   * Whether the provider verified the address. Absent means yes (GitHub and
+   * Google are only asked for verified ones). An unverified one never links
+   * to an existing account and is never the new account's address.
+   */
+  verified?: boolean;
+}
+
+/**
+ * CoinPay (coinpayportal.com), the house identity: OAuth 2.1, authorization
+ * code with PKCE S256 and a client secret. CoinPay does not verify the
+ * address it reports, so a CoinPay identity is matched by its `sub` only.
+ */
+export function coinpayProvider(clientId: string, clientSecret: string, base = "https://coinpayportal.com"): Provider {
+  return {
+    id: "coinpay",
+    name: "CoinPay",
+    clientId,
+    clientSecret,
+    authorizeUrl: `${base}/api/oauth/authorize`,
+    tokenUrl: `${base}/api/oauth/token`,
+    scope: "openid profile email",
+    pkce: true,
+    async identify(accessToken, send) {
+      const who = await readJson(await send(`${base}/api/oauth/userinfo`, { headers: { authorization: `Bearer ${accessToken}`, ...AGENT } }));
+      const subject = typeof who["sub"] === "string" ? who["sub"] : "";
+      if (!subject) return null;
+      const email = typeof who["email"] === "string" ? who["email"].toLowerCase() : "";
+      return { provider: "coinpay", subject, email, verified: who["email_verified"] === true };
+    },
+  };
+}
+
+/** A PKCE pair: the verifier kept here, the S256 challenge sent with the browser. */
+export function pkcePair(): { verifier: string; challenge: string } {
+  const verifier = randomBytes(32).toString("base64url");
+  return { verifier, challenge: createHash("sha256").update(verifier).digest("base64url") };
 }
 
 const AGENT = { "user-agent": "nixamp" };
@@ -114,6 +153,9 @@ export function providersFrom(env: Record<string, string | undefined>): Provider
   if (env["GOOGLE_CLIENT_ID"] && env["GOOGLE_CLIENT_SECRET"]) {
     found.push(googleProvider(env["GOOGLE_CLIENT_ID"], env["GOOGLE_CLIENT_SECRET"]));
   }
+  if (env["COINPAY_OAUTH_CLIENT_ID"] && env["COINPAY_OAUTH_CLIENT_SECRET"]) {
+    found.push(coinpayProvider(env["COINPAY_OAUTH_CLIENT_ID"], env["COINPAY_OAUTH_CLIENT_SECRET"], env["COINPAY_OAUTH_BASE"] || undefined));
+  }
   return found;
 }
 
@@ -122,13 +164,17 @@ export function redirectUri(site: string, provider: Provider): string {
 }
 
 /** Where to send the browser. `state` is the only thing standing between this and CSRF. */
-export function authorizeUrl(provider: Provider, site: string, state: string): string {
+export function authorizeUrl(provider: Provider, site: string, state: string, challenge = ""): string {
   const url = new URL(provider.authorizeUrl);
   url.searchParams.set("client_id", provider.clientId);
   url.searchParams.set("redirect_uri", redirectUri(site, provider));
   url.searchParams.set("response_type", "code");
   url.searchParams.set("scope", provider.scope);
   url.searchParams.set("state", state);
+  if (challenge) {
+    url.searchParams.set("code_challenge", challenge);
+    url.searchParams.set("code_challenge_method", "S256");
+  }
   return url.toString();
 }
 
@@ -138,6 +184,7 @@ export async function exchangeCode(
   code: string,
   site: string,
   send: typeof fetch = fetch,
+  verifier = "",
 ): Promise<string> {
   const answer = await send(provider.tokenUrl, {
     method: "POST",
@@ -154,6 +201,7 @@ export async function exchangeCode(
       code,
       redirect_uri: redirectUri(site, provider),
       grant_type: "authorization_code",
+      ...(verifier ? { code_verifier: verifier } : {}),
     }).toString(),
   });
   const body = await readJson(answer);
@@ -208,7 +256,13 @@ export class Identities {
   }
 
   async resolve(identity: Identity): Promise<Account | null> {
-    if (!identity.subject || !identity.email) return null;
+    if (!identity.subject) return null;
+    // An address the provider did not verify (CoinPay's) is a hint, not a
+    // claim: the account is found by subject alone, and a new one gets an
+    // address nobody can own, so purchases kept by email are never reached
+    // through it.
+    if (identity.verified === false) return this.resolveUnverified(identity);
+    if (!identity.email) return null;
     await this.ensure();
 
     // Already linked. The subject is what is matched, not the address: people
@@ -256,6 +310,37 @@ export class Identities {
     );
     return account;
   }
+
+  /** The account linked to this subject, or a new one whose address is `<provider>-<subject>@<provider>.invalid`. */
+  private async resolveUnverified(identity: Identity): Promise<Account | null> {
+    await this.ensure();
+    const { rows } = await this.db.query(`SELECT user_id, email FROM ${TABLE} WHERE provider = $1 AND subject = $2`, [identity.provider, identity.subject]);
+    const linked = rows[0];
+    const placeholder = `${identity.provider}-${identity.subject.replace(/[^A-Za-z0-9._-]/g, "").slice(0, 60)}@${identity.provider}.invalid`;
+    if (linked) {
+      const id = String(linked["user_id"] ?? "");
+      return id ? { id, email: String(linked["email"] ?? "") || placeholder } : null;
+    }
+    const existing = await this.users.getUserByEmail(placeholder);
+    const account = existing?.id
+      ? { id: existing.id, email: existing.email ?? placeholder }
+      : await (async () => {
+          const made = await this.users.createUser({
+            email: placeholder,
+            password: null,
+            emailVerified: false,
+            profile: { signedUpWith: identity.provider, ...(identity.email ? { providerEmail: identity.email } : {}) },
+          });
+          return { id: String(made.id ?? ""), email: made.email ?? placeholder };
+        })();
+    if (!account.id) return null;
+    await this.db.query(
+      `INSERT INTO ${TABLE} (provider, subject, user_id, email) VALUES ($1, $2, $3, $4)
+       ON CONFLICT (provider, subject) DO NOTHING`,
+      [identity.provider, identity.subject, account.id, placeholder],
+    );
+    return account;
+  }
 }
 
 // --- the sign-in surface ----------------------------------------------------
@@ -273,6 +358,33 @@ export interface Pending {
   /** Set when this round trip is approving a terminal rather than a browser. */
   userCode: string;
   createdAt: number;
+  /** The PKCE verifier, for a provider that takes one. */
+  verifier?: string;
+  /** Where the browser goes once signed in (a path here, or an allowed site); "/" by default. */
+  redirect?: string;
+}
+
+/** The sites a sign-in may return to: NIXAMP_SIGNIN_RETURN_HOSTS, else the ones that send people here. */
+export function signInReturnHosts(env: Record<string, string | undefined> = process.env): string[] {
+  const set = (env["NIXAMP_SIGNIN_RETURN_HOSTS"] ?? "").split(",").map((one) => one.trim().toLowerCase()).filter(Boolean);
+  return set.length ? set : ["live.streaming", "live.streaming.pit.world", "bittorrented.com", "backtoschool.help"];
+}
+
+/**
+ * Where a sign-in may send the browser afterwards: a path on this site, or a
+ * page on one of the sites that send people here to sign in (live.streaming).
+ * Anything else is "/", so a sign-in link cannot be made to bounce elsewhere.
+ */
+export function safeRedirect(value: unknown, allowedHosts: string[] = []): string {
+  if (typeof value !== "string" || value === "") return "/";
+  if (value.startsWith("/") && !value.startsWith("//") && !value.startsWith("/\\")) return value.slice(0, 500);
+  try {
+    const url = new URL(value);
+    if (url.protocol === "https:" && allowedHosts.includes(url.hostname)) return url.href.slice(0, 500);
+  } catch {
+    // not a URL
+  }
+  return "/";
 }
 
 /** A state is only ever open for the length of one sign-in. */
@@ -298,11 +410,12 @@ export class SignIn {
   }
 
   /** Start a round trip, and answer the URL the browser should go to. */
-  begin(provider: Provider, userCode = ""): string {
+  begin(provider: Provider, userCode = "", redirect = "/"): string {
     this.sweep();
     const state = randomBytes(24).toString("base64url");
-    this.states.set(state, { provider: provider.id, userCode, createdAt: this.now() });
-    return authorizeUrl(provider, this.site, state);
+    const pair = provider.pkce ? pkcePair() : null;
+    this.states.set(state, { provider: provider.id, userCode, createdAt: this.now(), redirect, ...(pair ? { verifier: pair.verifier } : {}) });
+    return authorizeUrl(provider, this.site, state, pair?.challenge ?? "");
   }
 
   /** Redeem a state exactly once, so a replayed callback finds nothing. */

package/src/server.ts

@@ -55,6 +55,8 @@ import {
   devicePage,
   exchangeCode,
   providersFrom,
+  safeRedirect,
+  signInReturnHosts,
   signInFailedPage,
   SignIn,
 } from "./oauth.ts";
@@ -4927,7 +4929,9 @@ export function createHandler(engine: Engine, options: HandlerOptions) {
         // A terminal can link straight here with the code it is showing, which
         // is one hop shorter than the page for somebody who followed the link.
         const grant = signIn.device.find(url.searchParams.get("device") ?? "");
-        response.writeHead(302, { location: signIn.begin(provider, grant?.userCode ?? "") });
+        // Back where the visit was going: a page here, or a site that sends people here to sign in.
+        const redirect = safeRedirect(url.searchParams.get("redirect"), signInReturnHosts());
+        response.writeHead(302, { location: signIn.begin(provider, grant?.userCode ?? "", redirect) });
         response.end();
         return;
       }
@@ -4945,10 +4949,10 @@ export function createHandler(engine: Engine, options: HandlerOptions) {
         return;
       }
 
-      const access = await exchangeCode(provider, code, signIn.site).catch(() => "");
+      const access = await exchangeCode(provider, code, signIn.site, fetch, pending.verifier ?? "").catch(() => "");
       const identity = access ? await provider.identify(access, fetch).catch(() => null) : null;
       if (identity === null) {
-        html(response, 401, signInFailedPage(`${provider.name} did not confirm a verified email address.`));
+        html(response, 401, signInFailedPage(provider.pkce ? `${provider.name} did not finish the sign-in. Try it again.` : `${provider.name} did not confirm a verified email address.`));
         return;
       }
 
@@ -4971,7 +4975,7 @@ export function createHandler(engine: Engine, options: HandlerOptions) {
 
       response.writeHead(302, {
         "set-cookie": sessionCookie(result.token, secure),
-        location: "/",
+        location: pending.redirect || "/",
       });
       response.end();
       return;

package/web/dist/assets/{ar-d05d_7Df.js → ar-HteUbQ_m.js}

@@ -1 +1 @@
-import{t as e}from"./main-C-tWhTWo.js";var t={...e,"No parties live right now.":`لا توجد جلسات مباشرة الآن.`,"Could not refresh parties.":`تعذر تحديث الجلسات.`,"Pick a server in the directory, or paste its link here.":`اختر خادمًا من الدليل أو الصق رابطه هنا.`,"Interface language":`لغة الواجهة`,Language:`اللغة`,"Translation language":`لغة الترجمة`,"Original (auto-detect)":`الأصل (اكتشاف تلقائي)`,Play:`تشغيل`,Pause:`إيقاف مؤقت`,Stop:`إيقاف`,Next:`التالي`,Previous:`السابق`,Select:`اختيار`,"Next/Prev":`التالي/السابق`,Quit:`خروج`,"Now Playing":`قيد التشغيل`,"Spectrum Analyser":`محلل الطيف`,Playlist:`قائمة التشغيل`,Files:`الملفات`,"Open files":`فتح ملفات`,"Open folder":`فتح مجلد`,"Add to library":`إضافة إلى المكتبة`,"Replace playlist":`استبدال قائمة التشغيل`,Filter:`تصفية`,Search:`بحث`,"Nothing loaded.":`لم يُحمّل أي محتوى.`,"Empty.":`فارغ.`,"Loading…":`جارٍ التحميل…`,"Connecting…":`جارٍ الاتصال…`,Connected:`متصل`,"Not connected":`غير متصل`,"No source":`لا يوجد مصدر`,Playing:`يعمل`,Stopped:`متوقف`,Volume:`مستوى الصوت`,Seek:`موضع التشغيل`,"Full screen":`ملء الشاشة`,Download:`تنزيل`,Share:`مشاركة`,Copy:`نسخ`,"Copy link":`نسخ الرابط`,Copied:`تم النسخ`,Save:`حفظ`,Cancel:`إلغاء`,Close:`إغلاق`,Remove:`إزالة`,Delete:`حذف`,Edit:`تعديل`,Add:`إضافة`,Send:`إرسال`,Retry:`إعادة المحاولة`,Back:`رجوع`,"Next page":`الصفحة التالية`,"Previous page":`الصفحة السابقة`,"Show more":`عرض المزيد`,Panels:`اللوحات`,"Reset layout":`إعادة ضبط التخطيط`,Show:`إظهار`,Hide:`إخفاء`,Collapse:`طي`,Expand:`توسيع`,"Move up":`نقل لأعلى`,"Move down":`نقل لأسفل`,Install:`تثبيت`,"TV mode":`وضع التلفاز`,On:`مفعّل`,Off:`معطّل`,Account:`الحساب`,"Sign in":`تسجيل الدخول`,"Sign out":`تسجيل الخروج`,"Create account":`إنشاء حساب`,Email:`البريد الإلكتروني`,Password:`كلمة المرور`,"Forgot password?":`نسيت كلمة المرور؟`,"Welcome back":`مرحبًا بعودتك`,Profile:`الملف الشخصي`,Handle:`اسم المستخدم`,"Your servers":`خوادمك`,Server:`الخادم`,Connect:`اتصال`,Disconnect:`قطع الاتصال`,Directory:`الدليل`,Favourites:`المفضلة`,Follow:`متابعة`,Unfollow:`إلغاء المتابعة`,Notifications:`الإشعارات`,"Phone number":`رقم الهاتف`,"Save number":`حفظ الرقم`,Transcript:`النص المفرغ`,Captions:`الترجمة النصية`,"Translate audio":`ترجمة الصوت`,"Audio language":`لغة الصوت`,"Audio options":`خيارات الصوت`,"Keep background sound":`الاحتفاظ بأصوات الخلفية`,"Background level":`مستوى صوت الخلفية`,"Speaker voices":`أصوات المتحدثين`,"Any voice":`أي صوت`,"Male voice":`صوت رجالي`,"Female voice":`صوت نسائي`,"Original audio.":`الصوت الأصلي.`,"Buy translated audio":`شراء الصوت المترجم`,"Audio credit":`رصيد الصوت`,"Buy pass":`شراء تصريح`,Pass:`تصريح`,"Pay with":`الدفع باستخدام`,"Check payment":`التحقق من الدفع`,"Open checkout":`الانتقال للدفع`,"Free sessions":`جلسات مجانية`,"Usage rates and expiry":`الأسعار ومدة الصلاحية`,Catalogs:`الكتالوجات`,"Add catalog":`إضافة كتالوج`,"Catalog name":`اسم الكتالوج`,Link:`الرابط`,"Play link":`تشغيل الرابط`,"Go live":`بدء بث مباشر`,Publish:`نشر`,Listen:`استماع`,"Live now":`مباشر الآن`,Upcoming:`قريبًا`,Parties:`حفلات المشاهدة`,"Join party":`الانضمام للحفلة`,"Invite code":`رمز الدعوة`,Invite:`دعوة`,Chat:`الدردشة`,"Chat message":`رسالة دردشة`,People:`الأشخاص`,Speaker:`متحدث`,Speakers:`المتحدثون`,Listener:`مستمع`,Moderator:`مشرف`,"Raise hand":`رفع اليد`,"Hand raises":`الأيدي المرفوعة`,Questions:`الأسئلة`,Resources:`الموارد`,Replay:`إعادة العرض`,Schedule:`الجدول`,Event:`الفعالية`,Host:`المضيف`,About:`حول`,Stage:`المنصة`,Title:`العنوان`,Description:`الوصف`,Topic:`الموضوع`,Public:`عام`,"Anyone with the link":`أي شخص لديه الرابط`,"Invited people":`الأشخاص المدعوون`,"Who can join":`من يمكنه الانضمام`,"Date and time":`التاريخ والوقت`,"Expected length":`المدة المتوقعة`,Repeat:`تكرار`,"Does not repeat":`لا يتكرر`,"Every day":`كل يوم`,"Every week":`كل أسبوع`,Homepage:`الموقع الإلكتروني`,"Host name":`اسم المضيف`,"Profile photo URL":`رابط صورة الملف الشخصي`,"Broadcast link":`رابط البث`,"Edit event":`تعديل الفعالية`,"Save changes":`حفظ التغييرات`,"Create live":`إنشاء بث مباشر`,"Schedule class":`جدولة درس`,"Start class":`بدء الدرس`,"End event":`إنهاء الفعالية`,"End session":`إنهاء الجلسة`,"Session ended":`انتهت الجلسة`,"Event ended":`انتهت الفعالية`,Cancelled:`ملغاة`,"Replay available":`إعادة العرض متاحة`,Join:`انضمام`,"Create invite":`إنشاء دعوة`,"Invite as":`الدعوة بصفة`,"Watch now":`شاهد الآن`,"Start a room":`إنشاء غرفة`,"Recent replays":`إعادات العرض الأخيرة`,"Your account":`حسابك`,"Write with AI":`الكتابة بالذكاء الاصطناعي`,"Suggested title":`العنوان المقترح`,"Suggested description":`الوصف المقترح`,"Suggested topic":`الموضوع المقترح`,"Use these details":`استخدام هذه التفاصيل`,"Learn something live.":`تعلّم شيئًا مباشرة.`,"Screen share":`مشاركة الشاشة`,"Upload and broadcast":`رفع وبث`,Help:`مساعدة`,"Reload Player":`إعادة تحميل المشغل`,"Copy Bundled CLI Path":`نسخ مسار أداة سطر الأوامر المضمنة`,"Developer tools":`أدوات المطور`,Undo:`تراجع`,Redo:`إعادة`,Cut:`قص`,Paste:`لصق`,"Select all":`تحديد الكل`,Status:`الحالة`,"Activity log":`سجل النشاط`,Admin:`الإدارة`,"Playback controls":`عناصر التحكم بالتشغيل`,"Tracks and folders":`المقاطع والمجلدات`,"Original-language captions.":`ترجمة نصية باللغة الأصلية.`,"Skip to playback controls":`الانتقال إلى عناصر التحكم بالتشغيل`,"Skip to playlist":`الانتقال إلى قائمة التشغيل`,"Skip to transcript and translated audio":`الانتقال إلى النص المفرغ والصوت المترجم`};export{t as default};
+import{t as e}from"./main-yTRNIxIl.js";var t={...e,"No parties live right now.":`لا توجد جلسات مباشرة الآن.`,"Could not refresh parties.":`تعذر تحديث الجلسات.`,"Pick a server in the directory, or paste its link here.":`اختر خادمًا من الدليل أو الصق رابطه هنا.`,"Interface language":`لغة الواجهة`,Language:`اللغة`,"Translation language":`لغة الترجمة`,"Original (auto-detect)":`الأصل (اكتشاف تلقائي)`,Play:`تشغيل`,Pause:`إيقاف مؤقت`,Stop:`إيقاف`,Next:`التالي`,Previous:`السابق`,Select:`اختيار`,"Next/Prev":`التالي/السابق`,Quit:`خروج`,"Now Playing":`قيد التشغيل`,"Spectrum Analyser":`محلل الطيف`,Playlist:`قائمة التشغيل`,Files:`الملفات`,"Open files":`فتح ملفات`,"Open folder":`فتح مجلد`,"Add to library":`إضافة إلى المكتبة`,"Replace playlist":`استبدال قائمة التشغيل`,Filter:`تصفية`,Search:`بحث`,"Nothing loaded.":`لم يُحمّل أي محتوى.`,"Empty.":`فارغ.`,"Loading…":`جارٍ التحميل…`,"Connecting…":`جارٍ الاتصال…`,Connected:`متصل`,"Not connected":`غير متصل`,"No source":`لا يوجد مصدر`,Playing:`يعمل`,Stopped:`متوقف`,Volume:`مستوى الصوت`,Seek:`موضع التشغيل`,"Full screen":`ملء الشاشة`,Download:`تنزيل`,Share:`مشاركة`,Copy:`نسخ`,"Copy link":`نسخ الرابط`,Copied:`تم النسخ`,Save:`حفظ`,Cancel:`إلغاء`,Close:`إغلاق`,Remove:`إزالة`,Delete:`حذف`,Edit:`تعديل`,Add:`إضافة`,Send:`إرسال`,Retry:`إعادة المحاولة`,Back:`رجوع`,"Next page":`الصفحة التالية`,"Previous page":`الصفحة السابقة`,"Show more":`عرض المزيد`,Panels:`اللوحات`,"Reset layout":`إعادة ضبط التخطيط`,Show:`إظهار`,Hide:`إخفاء`,Collapse:`طي`,Expand:`توسيع`,"Move up":`نقل لأعلى`,"Move down":`نقل لأسفل`,Install:`تثبيت`,"TV mode":`وضع التلفاز`,On:`مفعّل`,Off:`معطّل`,Account:`الحساب`,"Sign in":`تسجيل الدخول`,"Sign out":`تسجيل الخروج`,"Create account":`إنشاء حساب`,Email:`البريد الإلكتروني`,Password:`كلمة المرور`,"Forgot password?":`نسيت كلمة المرور؟`,"Welcome back":`مرحبًا بعودتك`,Profile:`الملف الشخصي`,Handle:`اسم المستخدم`,"Your servers":`خوادمك`,Server:`الخادم`,Connect:`اتصال`,Disconnect:`قطع الاتصال`,Directory:`الدليل`,Favourites:`المفضلة`,Follow:`متابعة`,Unfollow:`إلغاء المتابعة`,Notifications:`الإشعارات`,"Phone number":`رقم الهاتف`,"Save number":`حفظ الرقم`,Transcript:`النص المفرغ`,Captions:`الترجمة النصية`,"Translate audio":`ترجمة الصوت`,"Audio language":`لغة الصوت`,"Audio options":`خيارات الصوت`,"Keep background sound":`الاحتفاظ بأصوات الخلفية`,"Background level":`مستوى صوت الخلفية`,"Speaker voices":`أصوات المتحدثين`,"Any voice":`أي صوت`,"Male voice":`صوت رجالي`,"Female voice":`صوت نسائي`,"Original audio.":`الصوت الأصلي.`,"Buy translated audio":`شراء الصوت المترجم`,"Audio credit":`رصيد الصوت`,"Buy pass":`شراء تصريح`,Pass:`تصريح`,"Pay with":`الدفع باستخدام`,"Check payment":`التحقق من الدفع`,"Open checkout":`الانتقال للدفع`,"Free sessions":`جلسات مجانية`,"Usage rates and expiry":`الأسعار ومدة الصلاحية`,Catalogs:`الكتالوجات`,"Add catalog":`إضافة كتالوج`,"Catalog name":`اسم الكتالوج`,Link:`الرابط`,"Play link":`تشغيل الرابط`,"Go live":`بدء بث مباشر`,Publish:`نشر`,Listen:`استماع`,"Live now":`مباشر الآن`,Upcoming:`قريبًا`,Parties:`حفلات المشاهدة`,"Join party":`الانضمام للحفلة`,"Invite code":`رمز الدعوة`,Invite:`دعوة`,Chat:`الدردشة`,"Chat message":`رسالة دردشة`,People:`الأشخاص`,Speaker:`متحدث`,Speakers:`المتحدثون`,Listener:`مستمع`,Moderator:`مشرف`,"Raise hand":`رفع اليد`,"Hand raises":`الأيدي المرفوعة`,Questions:`الأسئلة`,Resources:`الموارد`,Replay:`إعادة العرض`,Schedule:`الجدول`,Event:`الفعالية`,Host:`المضيف`,About:`حول`,Stage:`المنصة`,Title:`العنوان`,Description:`الوصف`,Topic:`الموضوع`,Public:`عام`,"Anyone with the link":`أي شخص لديه الرابط`,"Invited people":`الأشخاص المدعوون`,"Who can join":`من يمكنه الانضمام`,"Date and time":`التاريخ والوقت`,"Expected length":`المدة المتوقعة`,Repeat:`تكرار`,"Does not repeat":`لا يتكرر`,"Every day":`كل يوم`,"Every week":`كل أسبوع`,Homepage:`الموقع الإلكتروني`,"Host name":`اسم المضيف`,"Profile photo URL":`رابط صورة الملف الشخصي`,"Broadcast link":`رابط البث`,"Edit event":`تعديل الفعالية`,"Save changes":`حفظ التغييرات`,"Create live":`إنشاء بث مباشر`,"Schedule class":`جدولة درس`,"Start class":`بدء الدرس`,"End event":`إنهاء الفعالية`,"End session":`إنهاء الجلسة`,"Session ended":`انتهت الجلسة`,"Event ended":`انتهت الفعالية`,Cancelled:`ملغاة`,"Replay available":`إعادة العرض متاحة`,Join:`انضمام`,"Create invite":`إنشاء دعوة`,"Invite as":`الدعوة بصفة`,"Watch now":`شاهد الآن`,"Start a room":`إنشاء غرفة`,"Recent replays":`إعادات العرض الأخيرة`,"Your account":`حسابك`,"Write with AI":`الكتابة بالذكاء الاصطناعي`,"Suggested title":`العنوان المقترح`,"Suggested description":`الوصف المقترح`,"Suggested topic":`الموضوع المقترح`,"Use these details":`استخدام هذه التفاصيل`,"Learn something live.":`تعلّم شيئًا مباشرة.`,"Screen share":`مشاركة الشاشة`,"Upload and broadcast":`رفع وبث`,Help:`مساعدة`,"Reload Player":`إعادة تحميل المشغل`,"Copy Bundled CLI Path":`نسخ مسار أداة سطر الأوامر المضمنة`,"Developer tools":`أدوات المطور`,Undo:`تراجع`,Redo:`إعادة`,Cut:`قص`,Paste:`لصق`,"Select all":`تحديد الكل`,Status:`الحالة`,"Activity log":`سجل النشاط`,Admin:`الإدارة`,"Playback controls":`عناصر التحكم بالتشغيل`,"Tracks and folders":`المقاطع والمجلدات`,"Original-language captions.":`ترجمة نصية باللغة الأصلية.`,"Skip to playback controls":`الانتقال إلى عناصر التحكم بالتشغيل`,"Skip to playlist":`الانتقال إلى قائمة التشغيل`,"Skip to transcript and translated audio":`الانتقال إلى النص المفرغ والصوت المترجم`};export{t as default};