nixamp 0.57.0 → 0.58.0

package/dist/guide-rooms.d.ts

@@ -32,6 +32,18 @@ export declare function roomAddress(input: string): {
 /** Where the guide links a room's page: config `watchBase`, NIXAMP_WATCH_BASE, else this server. */
 export declare function watchBase(fallback: string, env?: Record<string, string | undefined>): string;
 export declare const watchPage: (base: string, play: string) => string;
+/** A room's page under its name, on this server. */
+export declare const roomPage: (base: string, slug: string) => string;
+export declare const ROOM_PAGE: RegExp;
+export declare const ROOM_SUB: RegExp;
+export declare function isRoomPath(path: string): boolean;
+/**
+ * The rooms by name: "Dropkick Murphys" is /room/dropkick-murphys. Oldest
+ * first, so a name stays with the room that had it; a second one is -2.
+ */
+export declare function roomSlugs(rooms: GuideRoom[]): Map<string, GuideRoom>;
+/** A room's name here, or "". */
+export declare function roomSlugOf(slugs: Map<string, GuideRoom>, id: string): string;
 export declare class RoomStore {
     private readonly file;
     private rooms;
@@ -53,6 +65,9 @@ export interface RoomState {
         title: string;
         artist: string;
     } | null;
+    /** A folder or a playlist (more than one file): HLS plays it better than the endless MP4. */
+    folder?: boolean;
+    album?: string;
 }
 /** Asks a room's own server what is on it: its channel list for a channel, the stream's headers for the live stream. */
 export declare class RoomProbe {
@@ -89,3 +104,30 @@ export interface RoomContext {
 }
 /** Answers /api/v1/guide/rooms; false when the path is not one. */
 export declare function handleRooms(request: IncomingMessage, response: ServerResponse, path: string, ctx: RoomContext): Promise<boolean>;
+export interface RoomProxyContext {
+    store: RoomStore;
+    probe: RoomProbe;
+    /** Why an address may not be fetched from this machine, or "" (as the probe's). */
+    refuse: (link: string) => Promise<string>;
+    json: (response: ServerResponse, status: number, body: unknown) => void;
+    fetcher?: typeof fetch;
+}
+/** What /room/<name>/state answers: the room as its page shows it, no address or key. */
+export interface RoomView {
+    name: string;
+    kind: "audio" | "video";
+    live: boolean;
+    folder: boolean;
+    hls: boolean;
+    title: string;
+    artist: string;
+    album: string;
+}
+/** The room's origin and key, gone from a text answer (a playlist, an error). */
+export declare function roomRewriter(play: string, slug: string): (text: string) => string;
+/**
+ * Answers /room/<name>/state, /stream and /hls/<file>, asked of the room's
+ * server with its key; false when the path is not one. The page itself is
+ * the caller's (it is the built watch page).
+ */
+export declare function handleRoomProxy(request: IncomingMessage, response: ServerResponse, path: string, ctx: RoomProxyContext): Promise<boolean>;

package/dist/guide-rooms.js

@@ -5,16 +5,20 @@
  * a Share or a "?play=" link carries, `https://host:port/api/channels/<id>?k=KEY`
  * or `https://host:port/api/live?k=KEY`. A nixamp.com member publishes one with
  * a rights basis, as a station is published; the guide lists it beside the
- * stations, and its card opens /watch?play=<that address>, which plays it as
- * a film or as radio, whichever it carries.
+ * stations; its card opens /room/<name>, which plays it as a film or as
+ * radio, whichever it carries.
  *
- * Nothing here plays anything: the room's own server does, and this only asks
- * it, now and then, whether the room is on the air and what is on it.
+ * /room/<name> is the room under a readable name on this server, which asks
+ * the room's own server for it with the key held here: the page, its state,
+ * the stream and HLS all come from this origin, so no page names the machine
+ * the room is on or carries its key. The old /watch?play=<address> links
+ * still play, straight from the room's server.
  */
 import { existsSync, readFileSync, renameSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { randomBytes } from "node:crypto";
 import { readConfig } from "./library.js";
+import { slugify } from "./radio-slug.js";
 /** Why a room may be broadcast, the same five reasons a station gives. */
 export const ROOM_BASES = ["owned", "permission", "licensed", "creative-commons", "public-domain"];
 /** Rooms one member may have on the guide at once, and rooms on it in all. */
@@ -62,6 +66,36 @@ export function watchBase(fallback, env = process.env) {
     return /^https?:\/\/[^\s"<>]+$/.test(chosen) ? chosen : fallback;
 }
 export const watchPage = (base, play) => `${base}/watch?play=${encodeURIComponent(play)}`;
+/** A room's page under its name, on this server. */
+export const roomPage = (base, slug) => `${base}/room/${slug}`;
+export const ROOM_PAGE = /^\/room\/([A-Za-z0-9_-]{1,60})\/?$/;
+export const ROOM_SUB = /^\/room\/([a-z0-9-]{1,60})\/(state|stream|hls\/[A-Za-z0-9._-]{1,64})$/;
+export function isRoomPath(path) {
+    return ROOM_PAGE.test(path) || ROOM_SUB.test(path);
+}
+/**
+ * The rooms by name: "Dropkick Murphys" is /room/dropkick-murphys. Oldest
+ * first, so a name stays with the room that had it; a second one is -2.
+ */
+export function roomSlugs(rooms) {
+    const out = new Map();
+    const sorted = [...rooms].sort((a, b) => (a.publishedAt - b.publishedAt) || a.id.localeCompare(b.id));
+    for (const room of sorted) {
+        const base = slugify(room.name) || "room";
+        let slug = base;
+        for (let n = 2; out.has(slug); n += 1)
+            slug = `${base}-${n}`;
+        out.set(slug, room);
+    }
+    return out;
+}
+/** A room's name here, or "". */
+export function roomSlugOf(slugs, id) {
+    for (const [slug, one] of slugs)
+        if (one.id === id)
+            return slug;
+    return "";
+}
 export class RoomStore {
     file;
     rooms = [];
@@ -149,6 +183,8 @@ export class RoomProbe {
                 name: String(row.name ?? address.channel).replace(/\/+$/, "").slice(0, 120),
                 kind: row.kind === "video" ? "video" : "audio",
                 nowPlaying: tags && (tags.title || tags.artist) ? { title: String(tags.title ?? ""), artist: String(tags.artist ?? "") } : null,
+                folder: address.channel.startsWith("folder-") || (Array.isArray(row.playlist) && row.playlist.length > 1),
+                album: String(tags?.album ?? "").slice(0, 200),
             };
         }
         // The live stream: on the air when it answers with media.
@@ -160,7 +196,7 @@ export class RoomProbe {
             controller.abort();
             if (!answer.ok)
                 return null;
-            return { live: true, name: "Live", kind: type.startsWith("video/") ? "video" : "audio", nowPlaying: null };
+            return { live: true, name: "Live", kind: type.startsWith("video/") ? "video" : "audio", nowPlaying: null, folder: false, album: "" };
         }
         finally {
             clearTimeout(timer);
@@ -169,6 +205,7 @@ export class RoomProbe {
 }
 /** The rooms as guide cards: the page to open, on the air or not, and what is on. */
 export async function roomEntries(store, probe, base) {
+    const slugs = roomSlugs(store.list());
     return Promise.all(store.list().map(async (room) => {
         const state = await probe.state(room.play);
         return {
@@ -177,7 +214,7 @@ export async function roomEntries(store, probe, base) {
             kind: state?.kind ?? room.kind,
             group: "rooms",
             state: state?.live ? "live" : "offline",
-            page: watchPage(base, room.play),
+            page: roomPage(base, roomSlugOf(slugs, room.id) || room.id),
             nowPlaying: state?.nowPlaying ?? null,
         };
     }));
@@ -245,7 +282,7 @@ export async function handleRooms(request, response, path, ctx) {
         const title = typeof body?.title === "string" ? body.title.trim().slice(0, 120) : "";
         const note = typeof body?.note === "string" ? body.note.trim().slice(0, 300) : "";
         const room = ctx.store.put({ play: address.play, name: title || state.name, kind: state.kind, basis, note, by: taken?.by ?? by });
-        ctx.json(response, 200, { room: { id: room.id, name: room.name, kind: room.kind, basis: room.basis }, page: watchPage(ctx.base, room.play) });
+        ctx.json(response, 200, { room: { id: room.id, name: room.name, kind: room.kind, basis: room.basis }, page: roomPage(ctx.base, roomSlugOf(roomSlugs(ctx.store.list()), room.id) || room.id) });
         return true;
     }
     const one = /^\/api\/v1\/guide\/rooms\/([A-Za-z0-9_-]{1,32})$/.exec(path);
@@ -262,3 +299,116 @@ export async function handleRooms(request, response, path, ctx) {
     ctx.json(response, 405, { error: "method not allowed", code: "method_not_allowed" });
     return true;
 }
+/** The room's origin and key, gone from a text answer (a playlist, an error). */
+export function roomRewriter(play, slug) {
+    const address = roomAddress(play);
+    if (!address)
+        return (text) => text;
+    const channelPath = address.channel !== null ? `/api/channels/${address.channel}` : "/api/live";
+    return (text) => text
+        .split(`${address.origin}${channelPath}/hls/`).join(`/room/${slug}/hls/`)
+        .split(`${address.origin}${channelPath}`).join(`/room/${slug}/stream`)
+        .split(address.origin).join("")
+        .split(`?k=${address.key}&`).join("?").split(`&k=${address.key}`).join("").split(`?k=${address.key}`).join("")
+        .split(address.key).join("");
+}
+/**
+ * Answers /room/<name>/state, /stream and /hls/<file>, asked of the room's
+ * server with its key; false when the path is not one. The page itself is
+ * the caller's (it is the built watch page).
+ */
+export async function handleRoomProxy(request, response, path, ctx) {
+    const sub = ROOM_SUB.exec(path);
+    if (!sub)
+        return false;
+    const method = request.method ?? "GET";
+    if (method !== "GET" && method !== "HEAD") {
+        ctx.json(response, 405, { error: "a room's page can watch, not drive", code: "method_not_allowed" });
+        return true;
+    }
+    const slug = sub[1];
+    const room = roomSlugs(ctx.store.list()).get(slug);
+    const address = room ? roomAddress(room.play) : null;
+    if (!room || !address) {
+        ctx.json(response, 404, { error: "no room by that name", code: "not_found" });
+        return true;
+    }
+    const what = sub[2];
+    if (what === "state") {
+        const state = await ctx.probe.state(room.play);
+        if (!state) {
+            ctx.json(response, 404, { error: "that room is not on the air", code: "unavailable" });
+            return true;
+        }
+        const view = {
+            name: room.name || state.name,
+            kind: state.kind,
+            live: state.live,
+            folder: state.folder === true,
+            hls: address.channel !== null,
+            title: state.nowPlaying?.title ?? "",
+            artist: state.nowPlaying?.artist ?? "",
+            album: state.album ?? "",
+        };
+        response.setHeader("cache-control", "no-store");
+        ctx.json(response, 200, view);
+        return true;
+    }
+    let upstream;
+    if (what === "stream")
+        upstream = address.play;
+    else {
+        if (address.channel === null) {
+            ctx.json(response, 404, { error: "the live stream has no HLS", code: "not_found" });
+            return true;
+        }
+        upstream = `${address.origin}/api/channels/${address.channel}/${what}?k=${address.key}`;
+    }
+    if ((await ctx.refuse(upstream).catch(() => "refused")) !== "") {
+        ctx.json(response, 502, { error: "that room's server cannot be reached from here", code: "upstream" });
+        return true;
+    }
+    const stop = new AbortController();
+    response.on("close", () => stop.abort());
+    const answer = await (ctx.fetcher ?? fetch)(upstream, {
+        method, signal: stop.signal, redirect: "error",
+        headers: { ...(request.headers.range ? { range: String(request.headers.range) } : {}), accept: String(request.headers.accept ?? "*/*") },
+    }).catch(() => null);
+    if (!answer) {
+        ctx.json(response, 502, { error: "that room's server did not answer", code: "upstream" });
+        return true;
+    }
+    const type = answer.headers.get("content-type") ?? "";
+    const text = /json|mpegurl|^text\//i.test(type);
+    const headers = { "cache-control": "no-store", "x-content-type-options": "nosniff" };
+    for (const name of ["content-type", "content-length", "content-range", "accept-ranges", "x-accel-buffering", "retry-after"]) {
+        const value = answer.headers.get(name);
+        if (value && !(text && name === "content-length"))
+            headers[name] = value;
+    }
+    if (text) {
+        // A playlist (or an error) is small: read whole, the room's address and key taken out.
+        const body = roomRewriter(room.play, slug)(await answer.text().catch(() => ""));
+        response.writeHead(answer.status, { ...headers, "content-length": String(Buffer.byteLength(body)) });
+        response.end(method === "HEAD" ? undefined : body);
+        return true;
+    }
+    response.writeHead(answer.status, headers);
+    if (!answer.body || method === "HEAD") {
+        response.end();
+        return true;
+    }
+    try {
+        for await (const chunk of answer.body) {
+            if (response.destroyed)
+                break;
+            if (!response.write(chunk))
+                await new Promise((done) => { response.once("drain", done); response.once("close", done); });
+        }
+    }
+    catch {
+        // The viewer left, or the room's server did.
+    }
+    response.end();
+    return true;
+}

package/dist/label-profiles.js

@@ -98,7 +98,7 @@ export function bandMarkdown(band) {
 const MEMBERS_SYSTEM = [
     "You cast the members of a fictional band (or the one person behind a solo act) for an AI record label.",
     "Everyone is invented: never a real person, never a lookalike of one. Give each a full name, their role, and a look described",
-    "precisely enough that an illustrator could draw the same person every time: age range, face, skin tone, hair, build, signature outfit and accessories.",
+    "precisely enough that an illustrator could draw the same person every time. Start every look with their gender and age (\"woman, 24, ...\"), then face, skin tone, hair, build, signature outfit and accessories.",
     "Answer as JSON: {\"members\": [{\"name\": \"\", \"role\": \"\", \"look\": \"at most 300 characters\", \"voice\": \"how they sing or play, at most 150 characters\",",
     "\"personality\": \"at most 150 characters\", \"influences\": \"styles and eras, never named artists, at most 120 characters\", \"bio\": \"one or two sentences\"}]}.",
 ].join(" ");
@@ -143,7 +143,7 @@ export function castLine(members) {
 }
 /** The portrait prompt for a member: the same person every time it is used as a reference. */
 export function portraitPrompt(member, band) {
-    return `Photographic portrait of ${member.look}. ${member.role} in the ${band.genre} band ${band.name}. Head and shoulders, three-quarter view, natural expression, soft studio light, plain dark background, sharp focus, 85mm lens. No text, no logos.`;
+    return `Photographic portrait of ${member.name}: ${member.look}. ${member.role} in the ${band.genre} band ${band.name}. Head and shoulders, three-quarter view, natural expression, soft studio light, plain dark background, sharp focus, 85mm lens. No text, no logos.`;
 }
 /** Writes the member pages and portraits that are missing; returns the members as the pages now say. */
 export async function writeMembers(folder, members, band, draw) {

package/dist/oauth.d.ts

@@ -13,22 +13,41 @@ export interface Provider {
     scope: string;
     /** Turn the provider's access token into an address it stands behind. */
     identify(accessToken: string, send: typeof fetch): Promise<Identity | null>;
+    /** OAuth 2.1: the round trip carries a PKCE S256 challenge and the exchange its verifier. */
+    pkce?: boolean;
 }
 /** Who the provider says this is. `subject` is stable when an address is not. */
 export interface Identity {
     provider: string;
     subject: string;
     email: string;
+    /**
+     * Whether the provider verified the address. Absent means yes (GitHub and
+     * Google are only asked for verified ones). An unverified one never links
+     * to an existing account and is never the new account's address.
+     */
+    verified?: boolean;
 }
+/**
+ * CoinPay (coinpayportal.com), the house identity: OAuth 2.1, authorization
+ * code with PKCE S256 and a client secret. CoinPay does not verify the
+ * address it reports, so a CoinPay identity is matched by its `sub` only.
+ */
+export declare function coinpayProvider(clientId: string, clientSecret: string, base?: string): Provider;
+/** A PKCE pair: the verifier kept here, the S256 challenge sent with the browser. */
+export declare function pkcePair(): {
+    verifier: string;
+    challenge: string;
+};
 export declare function githubProvider(clientId: string, clientSecret: string): Provider;
 export declare function googleProvider(clientId: string, clientSecret: string): Provider;
 /** Whichever providers this deployment has been given both halves of. */
 export declare function providersFrom(env: Record<string, string | undefined>): Provider[];
 export declare function redirectUri(site: string, provider: Provider): string;
 /** Where to send the browser. `state` is the only thing standing between this and CSRF. */
-export declare function authorizeUrl(provider: Provider, site: string, state: string): string;
+export declare function authorizeUrl(provider: Provider, site: string, state: string, challenge?: string): string;
 /** Swap the code for an access token. Empty string means the provider refused. */
-export declare function exchangeCode(provider: Provider, code: string, site: string, send?: typeof fetch): Promise<string>;
+export declare function exchangeCode(provider: Provider, code: string, site: string, send?: typeof fetch, verifier?: string): Promise<string>;
 /** The slice of the auth module's storage adapter that identities need. */
 export interface Users {
     getUserByEmail(email: string): Promise<{
@@ -60,6 +79,8 @@ export declare class Identities {
     constructor(db: Queryable, users: Users);
     private ensure;
     resolve(identity: Identity): Promise<Account | null>;
+    /** The account linked to this subject, or a new one whose address is `<provider>-<subject>@<provider>.invalid`. */
+    private resolveUnverified;
 }
 /**
  * What a round trip to a provider is for.
@@ -74,7 +95,19 @@ export interface Pending {
     /** Set when this round trip is approving a terminal rather than a browser. */
     userCode: string;
     createdAt: number;
+    /** The PKCE verifier, for a provider that takes one. */
+    verifier?: string;
+    /** Where the browser goes once signed in (a path here, or an allowed site); "/" by default. */
+    redirect?: string;
 }
+/** The sites a sign-in may return to: NIXAMP_SIGNIN_RETURN_HOSTS, else the ones that send people here. */
+export declare function signInReturnHosts(env?: Record<string, string | undefined>): string[];
+/**
+ * Where a sign-in may send the browser afterwards: a path on this site, or a
+ * page on one of the sites that send people here to sign in (live.streaming).
+ * Anything else is "/", so a sign-in link cannot be made to bounce elsewhere.
+ */
+export declare function safeRedirect(value: unknown, allowedHosts?: string[]): string;
 /** A state is only ever open for the length of one sign-in. */
 export declare const STATE_TTL_MS = 600000;
 export declare class SignIn {
@@ -91,7 +124,7 @@ export declare class SignIn {
     }[];
     provider(id: unknown): Provider | null;
     /** Start a round trip, and answer the URL the browser should go to. */
-    begin(provider: Provider, userCode?: string): string;
+    begin(provider: Provider, userCode?: string, redirect?: string): string;
     /** Redeem a state exactly once, so a replayed callback finds nothing. */
     claim(state: unknown): Pending | null;
     private sweep;

package/dist/oauth.js

@@ -16,7 +16,37 @@
  * address, and both are asked. Without that check, anyone who can add an
  * unverified address at a provider could claim somebody else's nixamp account.
  */
-import { randomBytes } from "node:crypto";
+import { createHash, randomBytes } from "node:crypto";
+/**
+ * CoinPay (coinpayportal.com), the house identity: OAuth 2.1, authorization
+ * code with PKCE S256 and a client secret. CoinPay does not verify the
+ * address it reports, so a CoinPay identity is matched by its `sub` only.
+ */
+export function coinpayProvider(clientId, clientSecret, base = "https://coinpayportal.com") {
+    return {
+        id: "coinpay",
+        name: "CoinPay",
+        clientId,
+        clientSecret,
+        authorizeUrl: `${base}/api/oauth/authorize`,
+        tokenUrl: `${base}/api/oauth/token`,
+        scope: "openid profile email",
+        pkce: true,
+        async identify(accessToken, send) {
+            const who = await readJson(await send(`${base}/api/oauth/userinfo`, { headers: { authorization: `Bearer ${accessToken}`, ...AGENT } }));
+            const subject = typeof who["sub"] === "string" ? who["sub"] : "";
+            if (!subject)
+                return null;
+            const email = typeof who["email"] === "string" ? who["email"].toLowerCase() : "";
+            return { provider: "coinpay", subject, email, verified: who["email_verified"] === true };
+        },
+    };
+}
+/** A PKCE pair: the verifier kept here, the S256 challenge sent with the browser. */
+export function pkcePair() {
+    const verifier = randomBytes(32).toString("base64url");
+    return { verifier, challenge: createHash("sha256").update(verifier).digest("base64url") };
+}
 const AGENT = { "user-agent": "nixamp" };
 async function readJson(answer) {
     if (!answer.ok)
@@ -86,23 +116,30 @@ export function providersFrom(env) {
     if (env["GOOGLE_CLIENT_ID"] && env["GOOGLE_CLIENT_SECRET"]) {
         found.push(googleProvider(env["GOOGLE_CLIENT_ID"], env["GOOGLE_CLIENT_SECRET"]));
     }
+    if (env["COINPAY_OAUTH_CLIENT_ID"] && env["COINPAY_OAUTH_CLIENT_SECRET"]) {
+        found.push(coinpayProvider(env["COINPAY_OAUTH_CLIENT_ID"], env["COINPAY_OAUTH_CLIENT_SECRET"], env["COINPAY_OAUTH_BASE"] || undefined));
+    }
     return found;
 }
 export function redirectUri(site, provider) {
     return `${site.replace(/\/+$/, "")}/api/v1/${provider.id}/oauth/callback`;
 }
 /** Where to send the browser. `state` is the only thing standing between this and CSRF. */
-export function authorizeUrl(provider, site, state) {
+export function authorizeUrl(provider, site, state, challenge = "") {
     const url = new URL(provider.authorizeUrl);
     url.searchParams.set("client_id", provider.clientId);
     url.searchParams.set("redirect_uri", redirectUri(site, provider));
     url.searchParams.set("response_type", "code");
     url.searchParams.set("scope", provider.scope);
     url.searchParams.set("state", state);
+    if (challenge) {
+        url.searchParams.set("code_challenge", challenge);
+        url.searchParams.set("code_challenge_method", "S256");
+    }
     return url.toString();
 }
 /** Swap the code for an access token. Empty string means the provider refused. */
-export async function exchangeCode(provider, code, site, send = fetch) {
+export async function exchangeCode(provider, code, site, send = fetch, verifier = "") {
     const answer = await send(provider.tokenUrl, {
         method: "POST",
         headers: {
@@ -118,6 +155,7 @@ export async function exchangeCode(provider, code, site, send = fetch) {
             code,
             redirect_uri: redirectUri(site, provider),
             grant_type: "authorization_code",
+            ...(verifier ? { code_verifier: verifier } : {}),
         }).toString(),
     });
     const body = await readJson(answer);
@@ -156,7 +194,15 @@ export class Identities {
         await this.ready;
     }
     async resolve(identity) {
-        if (!identity.subject || !identity.email)
+        if (!identity.subject)
+            return null;
+        // An address the provider did not verify (CoinPay's) is a hint, not a
+        // claim: the account is found by subject alone, and a new one gets an
+        // address nobody can own, so purchases kept by email are never reached
+        // through it.
+        if (identity.verified === false)
+            return this.resolveUnverified(identity);
+        if (!identity.email)
             return null;
         await this.ensure();
         // Already linked. The subject is what is matched, not the address: people
@@ -200,6 +246,59 @@ export class Identities {
        ON CONFLICT (provider, subject) DO UPDATE SET email = EXCLUDED.email`, [identity.provider, identity.subject, account.id, identity.email]);
         return account;
     }
+    /** The account linked to this subject, or a new one whose address is `<provider>-<subject>@<provider>.invalid`. */
+    async resolveUnverified(identity) {
+        await this.ensure();
+        const { rows } = await this.db.query(`SELECT user_id, email FROM ${TABLE} WHERE provider = $1 AND subject = $2`, [identity.provider, identity.subject]);
+        const linked = rows[0];
+        const placeholder = `${identity.provider}-${identity.subject.replace(/[^A-Za-z0-9._-]/g, "").slice(0, 60)}@${identity.provider}.invalid`;
+        if (linked) {
+            const id = String(linked["user_id"] ?? "");
+            return id ? { id, email: String(linked["email"] ?? "") || placeholder } : null;
+        }
+        const existing = await this.users.getUserByEmail(placeholder);
+        const account = existing?.id
+            ? { id: existing.id, email: existing.email ?? placeholder }
+            : await (async () => {
+                const made = await this.users.createUser({
+                    email: placeholder,
+                    password: null,
+                    emailVerified: false,
+                    profile: { signedUpWith: identity.provider, ...(identity.email ? { providerEmail: identity.email } : {}) },
+                });
+                return { id: String(made.id ?? ""), email: made.email ?? placeholder };
+            })();
+        if (!account.id)
+            return null;
+        await this.db.query(`INSERT INTO ${TABLE} (provider, subject, user_id, email) VALUES ($1, $2, $3, $4)
+       ON CONFLICT (provider, subject) DO NOTHING`, [identity.provider, identity.subject, account.id, placeholder]);
+        return account;
+    }
+}
+/** The sites a sign-in may return to: NIXAMP_SIGNIN_RETURN_HOSTS, else the ones that send people here. */
+export function signInReturnHosts(env = process.env) {
+    const set = (env["NIXAMP_SIGNIN_RETURN_HOSTS"] ?? "").split(",").map((one) => one.trim().toLowerCase()).filter(Boolean);
+    return set.length ? set : ["live.streaming", "live.streaming.pit.world", "bittorrented.com", "backtoschool.help"];
+}
+/**
+ * Where a sign-in may send the browser afterwards: a path on this site, or a
+ * page on one of the sites that send people here to sign in (live.streaming).
+ * Anything else is "/", so a sign-in link cannot be made to bounce elsewhere.
+ */
+export function safeRedirect(value, allowedHosts = []) {
+    if (typeof value !== "string" || value === "")
+        return "/";
+    if (value.startsWith("/") && !value.startsWith("//") && !value.startsWith("/\\"))
+        return value.slice(0, 500);
+    try {
+        const url = new URL(value);
+        if (url.protocol === "https:" && allowedHosts.includes(url.hostname))
+            return url.href.slice(0, 500);
+    }
+    catch {
+        // not a URL
+    }
+    return "/";
 }
 /** A state is only ever open for the length of one sign-in. */
 export const STATE_TTL_MS = 600_000;
@@ -223,11 +322,12 @@ export class SignIn {
         return this.providers.find((candidate) => candidate.id === id) ?? null;
     }
     /** Start a round trip, and answer the URL the browser should go to. */
-    begin(provider, userCode = "") {
+    begin(provider, userCode = "", redirect = "/") {
         this.sweep();
         const state = randomBytes(24).toString("base64url");
-        this.states.set(state, { provider: provider.id, userCode, createdAt: this.now() });
-        return authorizeUrl(provider, this.site, state);
+        const pair = provider.pkce ? pkcePair() : null;
+        this.states.set(state, { provider: provider.id, userCode, createdAt: this.now(), redirect, ...(pair ? { verifier: pair.verifier } : {}) });
+        return authorizeUrl(provider, this.site, state, pair?.challenge ?? "");
     }
     /** Redeem a state exactly once, so a replayed callback finds nothing. */
     claim(state) {

package/dist/radio-pages.d.ts

@@ -188,9 +188,9 @@ export interface StationFace {
     description?: string;
     video?: boolean;
 }
-export declare function stationHead(station: StationFace, slug: string, base: string): string;
+export declare function stationHead(station: StationFace, slug: string, base: string, path?: string): string;
 /** The built station page (or the inline one) as /radio/<name> serves it: its head, the header, indexable. */
-export declare function asRadioPage(html: string, station: StationFace, slug: string, base: string, nav: string): string;
+export declare function asRadioPage(html: string, station: StationFace, slug: string, base: string, nav: string, path?: string): string;
 /** A station another server lists on this guide (a guide peer), as /radio reaches it. */
 export interface PeerRadio {
     origin: string;

package/dist/radio-pages.js

@@ -388,8 +388,8 @@ export function renderAlbum(catalogue, album, ctx) {
 export function renderMissing(what, base, nav) {
     return document({ title: `Not here · live.streaming`, description: "Nothing by that name is on the air here.", url: `${base}/radio` }, nav, `<h1>No ${escape(what)} by that name</h1><p class="lead">Nothing by that name is on the air here now. <a href="/radio">See every station</a>.</p>`);
 }
-export function stationHead(station, slug, base) {
-    const url = `${base}/radio/${slug}`;
+export function stationHead(station, slug, base, path = `/radio/${slug}`) {
+    const url = `${base}${path}`;
     const description = station.description || `${station.name}, live now. Free to listen; tap the artist or album on the air to see more.`;
     return `<title>${escape(station.name)} · live.streaming</title>
     <meta name="description" content="${escape(description)}" />
@@ -403,9 +403,9 @@ export function stationHead(station, slug, base) {
     <style>${NAV_STYLE}</style>`;
 }
 /** The built station page (or the inline one) as /radio/<name> serves it: its head, the header, indexable. */
-export function asRadioPage(html, station, slug, base, nav) {
+export function asRadioPage(html, station, slug, base, nav, path) {
     return html
-        .replace(/<title>[^<]*<\/title>/, stationHead(station, slug, base))
+        .replace(/<title>[^<]*<\/title>/, stationHead(station, slug, base, path))
         .replace(/\s*<meta name="robots" content="noindex"\s*\/?>/, "")
         .replace(/<body>/, `<body>\n${nav}`);
 }