nixamp 0.57.0 → 0.58.0

package/dist/server.js

@@ -40,7 +40,7 @@ import { NixampLinks, nixampExchange } from "./nixamp-link.js";
 import { handleNixampLinkApi, nixampLinkPath } from "./nixamp-link-api.js";
 import { DeviceGrants } from "./device.js";
 import { BAD_KEY_LIMIT, callerOf, Guard, SIGN_IN_LIMIT } from "./guard.js";
-import { deviceDonePage, devicePage, exchangeCode, providersFrom, signInFailedPage, SignIn, } from "./oauth.js";
+import { deviceDonePage, devicePage, exchangeCode, providersFrom, safeRedirect, signInReturnHosts, signInFailedPage, SignIn, } from "./oauth.js";
 import { AuthorizationServer, BACKTOSCHOOL_CLIENT, SCOPE_NAMES, clientsFrom } from "./oauth-server.js";
 import { handleOAuthApi, oauthApiPath } from "./oauth-api.js";
 import { WatchParties } from "./watch-party.js";
@@ -73,7 +73,7 @@ import { LyricsFinder } from "./lyrics.js";
 import { LyricsPublisher } from "./lyrics-publish.js";
 import { aiKey } from "./ai-keys.js";
 import { STATION_APP_CSP, STATION_PAGE, STATION_PAGE_CSP, STATION_PAGE_HTML, WATCH_APP_CSP } from "./station-page.js";
-import { handleRooms, RoomProbe, roomEntries, RoomStore, watchBase } from "./guide-rooms.js";
+import { handleRoomProxy, handleRooms, isRoomPath, ROOM_PAGE, roomAddress, RoomProbe, roomEntries, roomSlugOf, roomSlugs, RoomStore, watchBase } from "./guide-rooms.js";
 import { handleVods, VodProbe, vodEntries, VodStore, vodView } from "./guide-vods.js";
 import { withPitFooter } from "./pit-footer.js";
 import { handleFollowPage } from "./follow-page.js";
@@ -2317,6 +2317,8 @@ export function createHandler(engine, options) {
             !/^\/watch\/[a-z0-9]{10}$/.test(path) &&
             // A live room's page: the room's own key travels in ?play=, checked by its server.
             !(path === "/watch" && Boolean(options.stations?.rooms)) &&
+            // A live room under its name here, asked of its server with the key held here (guide-rooms.ts).
+            !(isRoomPath(path) && Boolean(options.stations?.rooms)) &&
             // Live rooms on the guide: listed for anybody, published by a member (guide-rooms.ts).
             !((path === "/api/v1/guide/rooms" || path.startsWith("/api/v1/guide/rooms/")) && Boolean(options.stations?.rooms)) &&
             // On demand: a file's page and the guide's list of them (guide-vods.ts); the file's own key travels in its play address.
@@ -2546,7 +2548,56 @@ export function createHandler(engine, options) {
         // A live room's page: /watch?play=<a nixamp server's channel or live
         // stream address>. The built page plays it in @profullstack/player, as a
         // film or as radio; nothing about the room passes through here.
+        if (options.stations?.rooms && isRoomPath(path)) {
+            const rooms = options.stations.rooms;
+            if (await handleRoomProxy(request, response, path, { store: rooms.store, probe: rooms.probe, refuse: (link) => refusedDestination(link), json }))
+                return;
+            const asked = ROOM_PAGE.exec(path)[1];
+            const slugs = roomSlugs(rooms.store.list());
+            const room = slugs.get(asked);
+            if (!room) {
+                // A room's id finds its name: /room/<id> goes to /room/<name>.
+                const named = roomSlugOf(slugs, asked);
+                if (named) {
+                    response.writeHead(301, { location: `/room/${named}`, "cache-control": "public, max-age=300" });
+                    response.end();
+                    return;
+                }
+            }
+            if (request.method !== "GET" && request.method !== "HEAD") {
+                json(response, 405, { error: "method not allowed", code: "method_not_allowed" });
+                return;
+            }
+            const built = web !== null && isFile(join(web, "watch.html")) ? readFileSync(join(web, "watch.html"), "utf8") : null;
+            if (!built) {
+                json(response, 404, { error: "this server was started without its web pages" });
+                return;
+            }
+            const base = radioBaseFor(request, options.stations.publicBase?.() ?? "");
+            const nav = radioNav(guideHosts().has(requestHost) ? "/" : "/guide", "live");
+            const face = room ? { name: room.name, description: room.note || `${room.name}, live now on live.streaming.`, video: room.kind === "video" } : { name: "No such room" };
+            response.writeHead(room ? 200 : 404, {
+                "content-type": "text/html; charset=utf-8",
+                "cache-control": "no-cache",
+                "content-security-policy": adCsp(WATCH_APP_CSP, guideAds()),
+                "referrer-policy": "strict-origin-when-cross-origin",
+                "x-content-type-options": "nosniff",
+            });
+            response.end(request.method === "HEAD" ? undefined : withPageAd(asRadioPage(built, face, asked, base, nav, `/room/${asked}`), guideAds()));
+            return;
+        }
         if (options.stations?.rooms && path === "/watch" && (request.method === "GET" || request.method === "HEAD")) {
+            // A room published here plays under its name: the old link keeps working and lands there.
+            const play = roomAddress(url.searchParams.get("play") ?? "");
+            if (play) {
+                const slugs = roomSlugs(options.stations.rooms.store.list());
+                const published = [...slugs].find(([, one]) => one.play === play.play)?.[0];
+                if (published) {
+                    response.writeHead(302, { location: `/room/${published}`, "cache-control": "no-store", "referrer-policy": "no-referrer" });
+                    response.end();
+                    return;
+                }
+            }
             const built = web !== null && isFile(join(web, "watch.html")) ? withPageAd(readFileSync(join(web, "watch.html"), "utf8"), guideAds()) : null;
             if (!built) {
                 json(response, 404, { error: "this server was started without its web pages" });
@@ -4509,7 +4560,9 @@ export function createHandler(engine, options) {
                 // A terminal can link straight here with the code it is showing, which
                 // is one hop shorter than the page for somebody who followed the link.
                 const grant = signIn.device.find(url.searchParams.get("device") ?? "");
-                response.writeHead(302, { location: signIn.begin(provider, grant?.userCode ?? "") });
+                // Back where the visit was going: a page here, or a site that sends people here to sign in.
+                const redirect = safeRedirect(url.searchParams.get("redirect"), signInReturnHosts());
+                response.writeHead(302, { location: signIn.begin(provider, grant?.userCode ?? "", redirect) });
                 response.end();
                 return;
             }
@@ -4525,10 +4578,10 @@ export function createHandler(engine, options) {
                 html(response, 400, signInFailedPage(url.searchParams.get("error") ?? "The provider sent no code."));
                 return;
             }
-            const access = await exchangeCode(provider, code, signIn.site).catch(() => "");
+            const access = await exchangeCode(provider, code, signIn.site, fetch, pending.verifier ?? "").catch(() => "");
             const identity = access ? await provider.identify(access, fetch).catch(() => null) : null;
             if (identity === null) {
-                html(response, 401, signInFailedPage(`${provider.name} did not confirm a verified email address.`));
+                html(response, 401, signInFailedPage(provider.pkce ? `${provider.name} did not finish the sign-in. Try it again.` : `${provider.name} did not confirm a verified email address.`));
                 return;
             }
             const result = await accounts.signInWith(identity);
@@ -4548,7 +4601,7 @@ export function createHandler(engine, options) {
             }
             response.writeHead(302, {
                 "set-cookie": sessionCookie(result.token, secure),
-                location: "/",
+                location: pending.redirect || "/",
             });
             response.end();
             return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nixamp",
-  "version": "0.57.0",
+  "version": "0.58.0",
   "description": "It really whips the terminal's ass. A Winamp-shaped audio player for your terminal.",
   "license": "MIT",
   "type": "module",

package/src/guide-rooms.ts

@@ -5,11 +5,14 @@
  * a Share or a "?play=" link carries, `https://host:port/api/channels/<id>?k=KEY`
  * or `https://host:port/api/live?k=KEY`. A nixamp.com member publishes one with
  * a rights basis, as a station is published; the guide lists it beside the
- * stations, and its card opens /watch?play=<that address>, which plays it as
- * a film or as radio, whichever it carries.
+ * stations; its card opens /room/<name>, which plays it as a film or as
+ * radio, whichever it carries.
  *
- * Nothing here plays anything: the room's own server does, and this only asks
- * it, now and then, whether the room is on the air and what is on it.
+ * /room/<name> is the room under a readable name on this server, which asks
+ * the room's own server for it with the key held here: the page, its state,
+ * the stream and HLS all come from this origin, so no page names the machine
+ * the room is on or carries its key. The old /watch?play=<address> links
+ * still play, straight from the room's server.
  */
 import { existsSync, readFileSync, renameSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
@@ -17,6 +20,7 @@ import { randomBytes } from "node:crypto";
 import type { IncomingMessage, ServerResponse } from "node:http";
 import { readConfig } from "./library.ts";
 import type { GuideEntry } from "./station-guide.ts";
+import { slugify } from "./radio-slug.ts";
 
 /** Why a room may be broadcast, the same five reasons a station gives. */
 export const ROOM_BASES = ["owned", "permission", "licensed", "creative-commons", "public-domain"] as const;
@@ -74,6 +78,38 @@ export function watchBase(fallback: string, env: Record<string, string | undefin
 
 export const watchPage = (base: string, play: string): string => `${base}/watch?play=${encodeURIComponent(play)}`;
 
+/** A room's page under its name, on this server. */
+export const roomPage = (base: string, slug: string): string => `${base}/room/${slug}`;
+
+export const ROOM_PAGE = /^\/room\/([A-Za-z0-9_-]{1,60})\/?$/;
+export const ROOM_SUB = /^\/room\/([a-z0-9-]{1,60})\/(state|stream|hls\/[A-Za-z0-9._-]{1,64})$/;
+
+export function isRoomPath(path: string): boolean {
+  return ROOM_PAGE.test(path) || ROOM_SUB.test(path);
+}
+
+/**
+ * The rooms by name: "Dropkick Murphys" is /room/dropkick-murphys. Oldest
+ * first, so a name stays with the room that had it; a second one is -2.
+ */
+export function roomSlugs(rooms: GuideRoom[]): Map<string, GuideRoom> {
+  const out = new Map<string, GuideRoom>();
+  const sorted = [...rooms].sort((a, b) => (a.publishedAt - b.publishedAt) || a.id.localeCompare(b.id));
+  for (const room of sorted) {
+    const base = slugify(room.name) || "room";
+    let slug = base;
+    for (let n = 2; out.has(slug); n += 1) slug = `${base}-${n}`;
+    out.set(slug, room);
+  }
+  return out;
+}
+
+/** A room's name here, or "". */
+export function roomSlugOf(slugs: Map<string, GuideRoom>, id: string): string {
+  for (const [slug, one] of slugs) if (one.id === id) return slug;
+  return "";
+}
+
 export class RoomStore {
   private rooms: GuideRoom[] = [];
   constructor(private readonly file: string) {
@@ -128,6 +164,9 @@ export interface RoomState {
   name: string;
   kind: "audio" | "video";
   nowPlaying: { title: string; artist: string } | null;
+  /** A folder or a playlist (more than one file): HLS plays it better than the endless MP4. */
+  folder?: boolean;
+  album?: string;
 }
 
 interface ChannelRow {
@@ -135,7 +174,8 @@ interface ChannelRow {
   name?: string;
   kind?: string;
   live?: boolean;
-  codecs?: { tags?: { title?: string; artist?: string } };
+  playlist?: unknown[];
+  codecs?: { tags?: { title?: string; artist?: string; album?: string } };
 }
 
 /** Asks a room's own server what is on it: its channel list for a channel, the stream's headers for the live stream. */
@@ -175,6 +215,8 @@ export class RoomProbe {
         name: String(row.name ?? address.channel).replace(/\/+$/, "").slice(0, 120),
         kind: row.kind === "video" ? "video" : "audio",
         nowPlaying: tags && (tags.title || tags.artist) ? { title: String(tags.title ?? ""), artist: String(tags.artist ?? "") } : null,
+        folder: address.channel.startsWith("folder-") || (Array.isArray(row.playlist) && row.playlist.length > 1),
+        album: String(tags?.album ?? "").slice(0, 200),
       };
     }
     // The live stream: on the air when it answers with media.
@@ -185,7 +227,7 @@ export class RoomProbe {
       const type = answer.headers.get("content-type") ?? "";
       controller.abort();
       if (!answer.ok) return null;
-      return { live: true, name: "Live", kind: type.startsWith("video/") ? "video" : "audio", nowPlaying: null };
+      return { live: true, name: "Live", kind: type.startsWith("video/") ? "video" : "audio", nowPlaying: null, folder: false, album: "" };
     } finally {
       clearTimeout(timer);
     }
@@ -194,6 +236,7 @@ export class RoomProbe {
 
 /** The rooms as guide cards: the page to open, on the air or not, and what is on. */
 export async function roomEntries(store: RoomStore, probe: RoomProbe, base: string): Promise<GuideEntry[]> {
+  const slugs = roomSlugs(store.list());
   return Promise.all(store.list().map(async (room) => {
     const state = await probe.state(room.play);
     return {
@@ -202,7 +245,7 @@ export async function roomEntries(store: RoomStore, probe: RoomProbe, base: stri
       kind: state?.kind ?? room.kind,
       group: "rooms" as const,
       state: state?.live ? "live" : "offline",
-      page: watchPage(base, room.play),
+      page: roomPage(base, roomSlugOf(slugs, room.id) || room.id),
       nowPlaying: state?.nowPlaying ?? null,
     };
   }));
@@ -281,7 +324,7 @@ export async function handleRooms(request: IncomingMessage, response: ServerResp
     const title = typeof body?.title === "string" ? body.title.trim().slice(0, 120) : "";
     const note = typeof body?.note === "string" ? body.note.trim().slice(0, 300) : "";
     const room = ctx.store.put({ play: address.play, name: title || state.name, kind: state.kind, basis, note, by: taken?.by ?? by });
-    ctx.json(response, 200, { room: { id: room.id, name: room.name, kind: room.kind, basis: room.basis }, page: watchPage(ctx.base, room.play) });
+    ctx.json(response, 200, { room: { id: room.id, name: room.name, kind: room.kind, basis: room.basis }, page: roomPage(ctx.base, roomSlugOf(roomSlugs(ctx.store.list()), room.id) || room.id) });
     return true;
   }
   const one = /^\/api\/v1\/guide\/rooms\/([A-Za-z0-9_-]{1,32})$/.exec(path);
@@ -298,3 +341,134 @@ export async function handleRooms(request: IncomingMessage, response: ServerResp
   ctx.json(response, 405, { error: "method not allowed", code: "method_not_allowed" });
   return true;
 }
+
+// --- /room/<name>: the room through this server ----------------------------------
+
+export interface RoomProxyContext {
+  store: RoomStore;
+  probe: RoomProbe;
+  /** Why an address may not be fetched from this machine, or "" (as the probe's). */
+  refuse: (link: string) => Promise<string>;
+  json: (response: ServerResponse, status: number, body: unknown) => void;
+  fetcher?: typeof fetch;
+}
+
+/** What /room/<name>/state answers: the room as its page shows it, no address or key. */
+export interface RoomView {
+  name: string;
+  kind: "audio" | "video";
+  live: boolean;
+  folder: boolean;
+  hls: boolean;
+  title: string;
+  artist: string;
+  album: string;
+}
+
+/** The room's origin and key, gone from a text answer (a playlist, an error). */
+export function roomRewriter(play: string, slug: string): (text: string) => string {
+  const address = roomAddress(play);
+  if (!address) return (text) => text;
+  const channelPath = address.channel !== null ? `/api/channels/${address.channel}` : "/api/live";
+  return (text) => text
+    .split(`${address.origin}${channelPath}/hls/`).join(`/room/${slug}/hls/`)
+    .split(`${address.origin}${channelPath}`).join(`/room/${slug}/stream`)
+    .split(address.origin).join("")
+    .split(`?k=${address.key}&`).join("?").split(`&k=${address.key}`).join("").split(`?k=${address.key}`).join("")
+    .split(address.key).join("");
+}
+
+/**
+ * Answers /room/<name>/state, /stream and /hls/<file>, asked of the room's
+ * server with its key; false when the path is not one. The page itself is
+ * the caller's (it is the built watch page).
+ */
+export async function handleRoomProxy(request: IncomingMessage, response: ServerResponse, path: string, ctx: RoomProxyContext): Promise<boolean> {
+  const sub = ROOM_SUB.exec(path);
+  if (!sub) return false;
+  const method = request.method ?? "GET";
+  if (method !== "GET" && method !== "HEAD") {
+    ctx.json(response, 405, { error: "a room's page can watch, not drive", code: "method_not_allowed" });
+    return true;
+  }
+  const slug = sub[1]!;
+  const room = roomSlugs(ctx.store.list()).get(slug);
+  const address = room ? roomAddress(room.play) : null;
+  if (!room || !address) {
+    ctx.json(response, 404, { error: "no room by that name", code: "not_found" });
+    return true;
+  }
+  const what = sub[2]!;
+  if (what === "state") {
+    const state = await ctx.probe.state(room.play);
+    if (!state) {
+      ctx.json(response, 404, { error: "that room is not on the air", code: "unavailable" });
+      return true;
+    }
+    const view: RoomView = {
+      name: room.name || state.name,
+      kind: state.kind,
+      live: state.live,
+      folder: state.folder === true,
+      hls: address.channel !== null,
+      title: state.nowPlaying?.title ?? "",
+      artist: state.nowPlaying?.artist ?? "",
+      album: state.album ?? "",
+    };
+    response.setHeader("cache-control", "no-store");
+    ctx.json(response, 200, view);
+    return true;
+  }
+  let upstream: string;
+  if (what === "stream") upstream = address.play;
+  else {
+    if (address.channel === null) {
+      ctx.json(response, 404, { error: "the live stream has no HLS", code: "not_found" });
+      return true;
+    }
+    upstream = `${address.origin}/api/channels/${address.channel}/${what}?k=${address.key}`;
+  }
+  if ((await ctx.refuse(upstream).catch(() => "refused")) !== "") {
+    ctx.json(response, 502, { error: "that room's server cannot be reached from here", code: "upstream" });
+    return true;
+  }
+  const stop = new AbortController();
+  response.on("close", () => stop.abort());
+  const answer = await (ctx.fetcher ?? fetch)(upstream, {
+    method, signal: stop.signal, redirect: "error",
+    headers: { ...(request.headers.range ? { range: String(request.headers.range) } : {}), accept: String(request.headers.accept ?? "*/*") },
+  }).catch(() => null);
+  if (!answer) {
+    ctx.json(response, 502, { error: "that room's server did not answer", code: "upstream" });
+    return true;
+  }
+  const type = answer.headers.get("content-type") ?? "";
+  const text = /json|mpegurl|^text\//i.test(type);
+  const headers: Record<string, string> = { "cache-control": "no-store", "x-content-type-options": "nosniff" };
+  for (const name of ["content-type", "content-length", "content-range", "accept-ranges", "x-accel-buffering", "retry-after"]) {
+    const value = answer.headers.get(name);
+    if (value && !(text && name === "content-length")) headers[name] = value;
+  }
+  if (text) {
+    // A playlist (or an error) is small: read whole, the room's address and key taken out.
+    const body = roomRewriter(room.play, slug)(await answer.text().catch(() => ""));
+    response.writeHead(answer.status, { ...headers, "content-length": String(Buffer.byteLength(body)) });
+    response.end(method === "HEAD" ? undefined : body);
+    return true;
+  }
+  response.writeHead(answer.status, headers);
+  if (!answer.body || method === "HEAD") {
+    response.end();
+    return true;
+  }
+  try {
+    for await (const chunk of answer.body as unknown as AsyncIterable<Uint8Array>) {
+      if (response.destroyed) break;
+      if (!response.write(chunk)) await new Promise((done) => { response.once("drain", done); response.once("close", done); });
+    }
+  } catch {
+    // The viewer left, or the room's server did.
+  }
+  response.end();
+  return true;
+}

package/src/label-profiles.ts

@@ -121,7 +121,7 @@ export function bandMarkdown(band: {
 const MEMBERS_SYSTEM = [
   "You cast the members of a fictional band (or the one person behind a solo act) for an AI record label.",
   "Everyone is invented: never a real person, never a lookalike of one. Give each a full name, their role, and a look described",
-  "precisely enough that an illustrator could draw the same person every time: age range, face, skin tone, hair, build, signature outfit and accessories.",
+  "precisely enough that an illustrator could draw the same person every time. Start every look with their gender and age (\"woman, 24, ...\"), then face, skin tone, hair, build, signature outfit and accessories.",
   "Answer as JSON: {\"members\": [{\"name\": \"\", \"role\": \"\", \"look\": \"at most 300 characters\", \"voice\": \"how they sing or play, at most 150 characters\",",
   "\"personality\": \"at most 150 characters\", \"influences\": \"styles and eras, never named artists, at most 120 characters\", \"bio\": \"one or two sentences\"}]}.",
 ].join(" ");
@@ -171,7 +171,7 @@ export function castLine(members: Member[]): string {
 
 /** The portrait prompt for a member: the same person every time it is used as a reference. */
 export function portraitPrompt(member: Member, band: { name: string; genre: string }): string {
-  return `Photographic portrait of ${member.look}. ${member.role} in the ${band.genre} band ${band.name}. Head and shoulders, three-quarter view, natural expression, soft studio light, plain dark background, sharp focus, 85mm lens. No text, no logos.`;
+  return `Photographic portrait of ${member.name}: ${member.look}. ${member.role} in the ${band.genre} band ${band.name}. Head and shoulders, three-quarter view, natural expression, soft studio light, plain dark background, sharp focus, 85mm lens. No text, no logos.`;
 }
 
 /** Writes the member pages and portraits that are missing; returns the members as the pages now say. */

package/src/oauth.ts

@@ -16,7 +16,7 @@
  * address, and both are asked. Without that check, anyone who can add an
  * unverified address at a provider could claim somebody else's nixamp account.
  */
-import { randomBytes } from "node:crypto";
+import { createHash, randomBytes } from "node:crypto";
 import type { Account } from "./accounts.ts";
 import type { DeviceGrants } from "./device.ts";
 import type { Queryable } from "./follows.ts";
@@ -33,6 +33,8 @@ export interface Provider {
   scope: string;
   /** Turn the provider's access token into an address it stands behind. */
   identify(accessToken: string, send: typeof fetch): Promise<Identity | null>;
+  /** OAuth 2.1: the round trip carries a PKCE S256 challenge and the exchange its verifier. */
+  pkce?: boolean;
 }
 
 /** Who the provider says this is. `subject` is stable when an address is not. */
@@ -40,6 +42,43 @@ export interface Identity {
   provider: string;
   subject: string;
   email: string;
+  /**
+   * Whether the provider verified the address. Absent means yes (GitHub and
+   * Google are only asked for verified ones). An unverified one never links
+   * to an existing account and is never the new account's address.
+   */
+  verified?: boolean;
+}
+
+/**
+ * CoinPay (coinpayportal.com), the house identity: OAuth 2.1, authorization
+ * code with PKCE S256 and a client secret. CoinPay does not verify the
+ * address it reports, so a CoinPay identity is matched by its `sub` only.
+ */
+export function coinpayProvider(clientId: string, clientSecret: string, base = "https://coinpayportal.com"): Provider {
+  return {
+    id: "coinpay",
+    name: "CoinPay",
+    clientId,
+    clientSecret,
+    authorizeUrl: `${base}/api/oauth/authorize`,
+    tokenUrl: `${base}/api/oauth/token`,
+    scope: "openid profile email",
+    pkce: true,
+    async identify(accessToken, send) {
+      const who = await readJson(await send(`${base}/api/oauth/userinfo`, { headers: { authorization: `Bearer ${accessToken}`, ...AGENT } }));
+      const subject = typeof who["sub"] === "string" ? who["sub"] : "";
+      if (!subject) return null;
+      const email = typeof who["email"] === "string" ? who["email"].toLowerCase() : "";
+      return { provider: "coinpay", subject, email, verified: who["email_verified"] === true };
+    },
+  };
+}
+
+/** A PKCE pair: the verifier kept here, the S256 challenge sent with the browser. */
+export function pkcePair(): { verifier: string; challenge: string } {
+  const verifier = randomBytes(32).toString("base64url");
+  return { verifier, challenge: createHash("sha256").update(verifier).digest("base64url") };
 }
 
 const AGENT = { "user-agent": "nixamp" };
@@ -114,6 +153,9 @@ export function providersFrom(env: Record<string, string | undefined>): Provider
   if (env["GOOGLE_CLIENT_ID"] && env["GOOGLE_CLIENT_SECRET"]) {
     found.push(googleProvider(env["GOOGLE_CLIENT_ID"], env["GOOGLE_CLIENT_SECRET"]));
   }
+  if (env["COINPAY_OAUTH_CLIENT_ID"] && env["COINPAY_OAUTH_CLIENT_SECRET"]) {
+    found.push(coinpayProvider(env["COINPAY_OAUTH_CLIENT_ID"], env["COINPAY_OAUTH_CLIENT_SECRET"], env["COINPAY_OAUTH_BASE"] || undefined));
+  }
   return found;
 }
 
@@ -122,13 +164,17 @@ export function redirectUri(site: string, provider: Provider): string {
 }
 
 /** Where to send the browser. `state` is the only thing standing between this and CSRF. */
-export function authorizeUrl(provider: Provider, site: string, state: string): string {
+export function authorizeUrl(provider: Provider, site: string, state: string, challenge = ""): string {
   const url = new URL(provider.authorizeUrl);
   url.searchParams.set("client_id", provider.clientId);
   url.searchParams.set("redirect_uri", redirectUri(site, provider));
   url.searchParams.set("response_type", "code");
   url.searchParams.set("scope", provider.scope);
   url.searchParams.set("state", state);
+  if (challenge) {
+    url.searchParams.set("code_challenge", challenge);
+    url.searchParams.set("code_challenge_method", "S256");
+  }
   return url.toString();
 }
 
@@ -138,6 +184,7 @@ export async function exchangeCode(
   code: string,
   site: string,
   send: typeof fetch = fetch,
+  verifier = "",
 ): Promise<string> {
   const answer = await send(provider.tokenUrl, {
     method: "POST",
@@ -154,6 +201,7 @@ export async function exchangeCode(
       code,
       redirect_uri: redirectUri(site, provider),
       grant_type: "authorization_code",
+      ...(verifier ? { code_verifier: verifier } : {}),
     }).toString(),
   });
   const body = await readJson(answer);
@@ -208,7 +256,13 @@ export class Identities {
   }
 
   async resolve(identity: Identity): Promise<Account | null> {
-    if (!identity.subject || !identity.email) return null;
+    if (!identity.subject) return null;
+    // An address the provider did not verify (CoinPay's) is a hint, not a
+    // claim: the account is found by subject alone, and a new one gets an
+    // address nobody can own, so purchases kept by email are never reached
+    // through it.
+    if (identity.verified === false) return this.resolveUnverified(identity);
+    if (!identity.email) return null;
     await this.ensure();
 
     // Already linked. The subject is what is matched, not the address: people
@@ -256,6 +310,37 @@ export class Identities {
     );
     return account;
   }
+
+  /** The account linked to this subject, or a new one whose address is `<provider>-<subject>@<provider>.invalid`. */
+  private async resolveUnverified(identity: Identity): Promise<Account | null> {
+    await this.ensure();
+    const { rows } = await this.db.query(`SELECT user_id, email FROM ${TABLE} WHERE provider = $1 AND subject = $2`, [identity.provider, identity.subject]);
+    const linked = rows[0];
+    const placeholder = `${identity.provider}-${identity.subject.replace(/[^A-Za-z0-9._-]/g, "").slice(0, 60)}@${identity.provider}.invalid`;
+    if (linked) {
+      const id = String(linked["user_id"] ?? "");
+      return id ? { id, email: String(linked["email"] ?? "") || placeholder } : null;
+    }
+    const existing = await this.users.getUserByEmail(placeholder);
+    const account = existing?.id
+      ? { id: existing.id, email: existing.email ?? placeholder }
+      : await (async () => {
+          const made = await this.users.createUser({
+            email: placeholder,
+            password: null,
+            emailVerified: false,
+            profile: { signedUpWith: identity.provider, ...(identity.email ? { providerEmail: identity.email } : {}) },
+          });
+          return { id: String(made.id ?? ""), email: made.email ?? placeholder };
+        })();
+    if (!account.id) return null;
+    await this.db.query(
+      `INSERT INTO ${TABLE} (provider, subject, user_id, email) VALUES ($1, $2, $3, $4)
+       ON CONFLICT (provider, subject) DO NOTHING`,
+      [identity.provider, identity.subject, account.id, placeholder],
+    );
+    return account;
+  }
 }
 
 // --- the sign-in surface ----------------------------------------------------
@@ -273,6 +358,33 @@ export interface Pending {
   /** Set when this round trip is approving a terminal rather than a browser. */
   userCode: string;
   createdAt: number;
+  /** The PKCE verifier, for a provider that takes one. */
+  verifier?: string;
+  /** Where the browser goes once signed in (a path here, or an allowed site); "/" by default. */
+  redirect?: string;
+}
+
+/** The sites a sign-in may return to: NIXAMP_SIGNIN_RETURN_HOSTS, else the ones that send people here. */
+export function signInReturnHosts(env: Record<string, string | undefined> = process.env): string[] {
+  const set = (env["NIXAMP_SIGNIN_RETURN_HOSTS"] ?? "").split(",").map((one) => one.trim().toLowerCase()).filter(Boolean);
+  return set.length ? set : ["live.streaming", "live.streaming.pit.world", "bittorrented.com", "backtoschool.help"];
+}
+
+/**
+ * Where a sign-in may send the browser afterwards: a path on this site, or a
+ * page on one of the sites that send people here to sign in (live.streaming).
+ * Anything else is "/", so a sign-in link cannot be made to bounce elsewhere.
+ */
+export function safeRedirect(value: unknown, allowedHosts: string[] = []): string {
+  if (typeof value !== "string" || value === "") return "/";
+  if (value.startsWith("/") && !value.startsWith("//") && !value.startsWith("/\\")) return value.slice(0, 500);
+  try {
+    const url = new URL(value);
+    if (url.protocol === "https:" && allowedHosts.includes(url.hostname)) return url.href.slice(0, 500);
+  } catch {
+    // not a URL
+  }
+  return "/";
 }
 
 /** A state is only ever open for the length of one sign-in. */
@@ -298,11 +410,12 @@ export class SignIn {
   }
 
   /** Start a round trip, and answer the URL the browser should go to. */
-  begin(provider: Provider, userCode = ""): string {
+  begin(provider: Provider, userCode = "", redirect = "/"): string {
     this.sweep();
     const state = randomBytes(24).toString("base64url");
-    this.states.set(state, { provider: provider.id, userCode, createdAt: this.now() });
-    return authorizeUrl(provider, this.site, state);
+    const pair = provider.pkce ? pkcePair() : null;
+    this.states.set(state, { provider: provider.id, userCode, createdAt: this.now(), redirect, ...(pair ? { verifier: pair.verifier } : {}) });
+    return authorizeUrl(provider, this.site, state, pair?.challenge ?? "");
   }
 
   /** Redeem a state exactly once, so a replayed callback finds nothing. */

package/src/radio-pages.ts

@@ -476,8 +476,8 @@ export function renderMissing(what: string, base: string, nav: string): string {
 /** What a station page's head says: a station of ours or a peer's. */
 export interface StationFace { name: string; description?: string; video?: boolean }
 
-export function stationHead(station: StationFace, slug: string, base: string): string {
-  const url = `${base}/radio/${slug}`;
+export function stationHead(station: StationFace, slug: string, base: string, path = `/radio/${slug}`): string {
+  const url = `${base}${path}`;
   const description = station.description || `${station.name}, live now. Free to listen; tap the artist or album on the air to see more.`;
   return `<title>${escape(station.name)} · live.streaming</title>
     <meta name="description" content="${escape(description)}" />
@@ -492,9 +492,9 @@ export function stationHead(station: StationFace, slug: string, base: string): s
 }
 
 /** The built station page (or the inline one) as /radio/<name> serves it: its head, the header, indexable. */
-export function asRadioPage(html: string, station: StationFace, slug: string, base: string, nav: string): string {
+export function asRadioPage(html: string, station: StationFace, slug: string, base: string, nav: string, path?: string): string {
   return html
-    .replace(/<title>[^<]*<\/title>/, stationHead(station, slug, base))
+    .replace(/<title>[^<]*<\/title>/, stationHead(station, slug, base, path))
     .replace(/\s*<meta name="robots" content="noindex"\s*\/?>/, "")
     .replace(/<body>/, `<body>\n${nav}`);
 }