nixamp 0.6.4 → 0.7.0

package/dist/handles.d.ts

@@ -0,0 +1,49 @@
+/**
+ * The name other people see.
+ *
+ * An account is keyed on an email address, because that is what the auth module
+ * authenticates. An address is a credential and a way to reach somebody, and it
+ * is not a name: putting it in a directory listing, an invite or a subdomain
+ * publishes something the account holder gave us to log in with.
+ *
+ * So there are two names. The address stays private and does the linking, and a
+ * handle is the one that appears in front of strangers. They are never the same
+ * field and never travel in the same response.
+ */
+import type { Queryable } from "./follows.ts";
+/**
+ * What a handle may be.
+ *
+ * It ends up in a URL, a subdomain and a text message, so it is the intersection
+ * of what all three tolerate: lowercase letters, digits and hyphens, not
+ * starting or ending with one. Two to thirty characters, because a subdomain
+ * label cannot exceed sixty-three and nobody types thirty.
+ */
+export declare function cleanHandle(value: unknown): string;
+export declare function isReserved(handle: string): boolean;
+/**
+ * A handle for somebody who has not chosen one.
+ *
+ * Deliberately not derived from the address. "anthony@profullstack.com" turning
+ * into "anthony" is exactly the leak this whole file exists to avoid, and it
+ * would be a leak nobody noticed until it was already in a directory listing.
+ */
+export declare function anonymousHandle(random: (size: number) => Uint8Array): string;
+export declare class Handles {
+    private readonly db;
+    private ready;
+    constructor(db: Queryable);
+    private ensure;
+    of(userId: string): Promise<string>;
+    /** Who holds this handle, so a listing can name somebody without their address. */
+    holder(handle: string): Promise<string>;
+    /**
+     * Claim one. Answers the reason it could not be taken rather than a boolean,
+     * because "that is already somebody's" and "that is not a name" are different
+     * things to tell a person.
+     */
+    claim(userId: string, wanted: unknown): Promise<{
+        handle: string;
+        error: string;
+    }>;
+}

package/dist/handles.js

@@ -0,0 +1,99 @@
+const TABLE = "nixamp_handles";
+const SCHEMA = `
+  CREATE TABLE IF NOT EXISTS ${TABLE} (
+    user_id    TEXT PRIMARY KEY,
+    handle     TEXT NOT NULL,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+  );
+  CREATE UNIQUE INDEX IF NOT EXISTS ${TABLE}_lower ON ${TABLE} (lower(handle));
+`;
+/**
+ * What a handle may be.
+ *
+ * It ends up in a URL, a subdomain and a text message, so it is the intersection
+ * of what all three tolerate: lowercase letters, digits and hyphens, not
+ * starting or ending with one. Two to thirty characters, because a subdomain
+ * label cannot exceed sixty-three and nobody types thirty.
+ */
+export function cleanHandle(value) {
+    if (typeof value !== "string")
+        return "";
+    const wanted = value.trim().toLowerCase();
+    if (!/^[a-z0-9](?:[a-z0-9-]{0,28}[a-z0-9])?$/.test(wanted))
+        return "";
+    // Doubled hyphens are how punycode marks an encoded label, so a handle with
+    // one in it can collide with an internationalised domain.
+    return wanted.includes("--") ? "" : wanted;
+}
+/**
+ * Names nobody may take, because a subdomain carrying one would impersonate the
+ * service or reach a machine we run.
+ */
+const RESERVED = new Set([
+    "www", "api", "admin", "root", "nixamp", "mail", "smtp", "imap", "ns1", "ns2",
+    "static", "cdn", "assets", "app", "dev", "staging", "test", "support", "help",
+    "status", "blog", "directory", "login", "signup", "account", "settings", "me",
+]);
+export function isReserved(handle) {
+    return RESERVED.has(handle);
+}
+/**
+ * A handle for somebody who has not chosen one.
+ *
+ * Deliberately not derived from the address. "anthony@profullstack.com" turning
+ * into "anthony" is exactly the leak this whole file exists to avoid, and it
+ * would be a leak nobody noticed until it was already in a directory listing.
+ */
+export function anonymousHandle(random) {
+    const bytes = random(4);
+    let out = "";
+    for (const byte of bytes)
+        out += byte.toString(16).padStart(2, "0");
+    return `nixamp-${out}`;
+}
+export class Handles {
+    db;
+    ready = null;
+    constructor(db) {
+        this.db = db;
+    }
+    async ensure() {
+        this.ready ??= this.db.query(SCHEMA).then(() => undefined);
+        await this.ready;
+    }
+    async of(userId) {
+        await this.ensure();
+        const { rows } = await this.db.query(`SELECT handle FROM ${TABLE} WHERE user_id = $1`, [userId]);
+        return rows[0] ? String(rows[0]["handle"] ?? "") : "";
+    }
+    /** Who holds this handle, so a listing can name somebody without their address. */
+    async holder(handle) {
+        const wanted = cleanHandle(handle);
+        if (!wanted)
+            return "";
+        await this.ensure();
+        const { rows } = await this.db.query(`SELECT user_id FROM ${TABLE} WHERE lower(handle) = $1`, [wanted]);
+        return rows[0] ? String(rows[0]["user_id"] ?? "") : "";
+    }
+    /**
+     * Claim one. Answers the reason it could not be taken rather than a boolean,
+     * because "that is already somebody's" and "that is not a name" are different
+     * things to tell a person.
+     */
+    async claim(userId, wanted) {
+        const handle = cleanHandle(wanted);
+        if (!handle) {
+            return { handle: "", error: "letters, digits and hyphens, 2 to 30 characters" };
+        }
+        if (isReserved(handle))
+            return { handle: "", error: "that one is reserved" };
+        await this.ensure();
+        const taken = await this.holder(handle);
+        if (taken && taken !== userId)
+            return { handle: "", error: "somebody already has that one" };
+        await this.db.query(`INSERT INTO ${TABLE} (user_id, handle) VALUES ($1, $2)
+       ON CONFLICT (user_id) DO UPDATE SET handle = EXCLUDED.handle, updated_at = NOW()`, [userId, handle]);
+        return { handle, error: "" };
+    }
+}

package/dist/playlist.d.ts

@@ -10,6 +10,19 @@ export declare function findAudio(root: string): string[];
  * ffmpeg is left to do what it is good at.
  */
 export declare function readPlaylist(source: string): Promise<Entry[]>;
+/**
+ * The audio linked from a directory listing a web server generated.
+ *
+ * A seedbox or a plain Apache with autoindex on serves a folder as an HTML page
+ * of relative links. Handed one of those, nixamp used to make a single track of
+ * the page itself and give it to ffmpeg, which is asked to decode HTML and says
+ * so in a way nobody reads. It is a folder; it should behave like one.
+ *
+ * Not recursive, deliberately: one page is one album, the subdirectory links are
+ * on it, and walking a stranger's whole tree from a text box is a different and
+ * much larger thing to ask for.
+ */
+export declare function readRemoteIndex(source: string, send?: typeof fetch): Promise<Entry[]>;
 /**
  * Everything `nixamp <thing>` can be handed: a directory, a file, a playlist,
  * or a URL to any of those.

package/dist/playlist.js

@@ -81,6 +81,69 @@ export async function readPlaylist(source) {
     const entries = /\.pls$/i.test(source) ? parsePls(text, source) : parseM3u(text, source);
     return entries;
 }
+/**
+ * The audio linked from a directory listing a web server generated.
+ *
+ * A seedbox or a plain Apache with autoindex on serves a folder as an HTML page
+ * of relative links. Handed one of those, nixamp used to make a single track of
+ * the page itself and give it to ffmpeg, which is asked to decode HTML and says
+ * so in a way nobody reads. It is a folder; it should behave like one.
+ *
+ * Not recursive, deliberately: one page is one album, the subdirectory links are
+ * on it, and walking a stranger's whole tree from a text box is a different and
+ * much larger thing to ask for.
+ */
+export async function readRemoteIndex(source, send = fetch) {
+    let answer;
+    try {
+        answer = await send(source, {
+            redirect: "follow",
+            headers: { accept: "text/html,*/*" },
+            signal: AbortSignal.timeout(15_000),
+        });
+    }
+    catch {
+        return [];
+    }
+    if (!answer.ok)
+        return [];
+    // Anything that is not a page is the thing itself, and the caller plays it.
+    if (!/^text\/html/i.test(answer.headers.get("content-type") ?? ""))
+        return [];
+    const html = await answer.text().catch(() => "");
+    const found = [];
+    const seen = new Set();
+    for (const match of html.matchAll(/href\s*=\s*["']([^"']+)["']/gi)) {
+        const href = match[1];
+        // The sort links an index puts at the top of every column, and anchors.
+        if (!href || href.startsWith("?") || href.startsWith("#"))
+            continue;
+        let url;
+        try {
+            // Relative to the page, which is how an index writes them.
+            url = new URL(href.replace(/&/g, "&"), source);
+        }
+        catch {
+            continue;
+        }
+        if (!isAudio(url.pathname))
+            continue;
+        const link = url.toString();
+        if (seen.has(link))
+            continue;
+        seen.add(link);
+        found.push({
+            source: link,
+            // The name as a person wrote it, not as a URL spells it.
+            title: decodeURIComponent(url.pathname.split("/").pop() ?? link),
+            duration: 0,
+        });
+    }
+    // Server order is by whatever column the index sorted on; by name is what
+    // somebody handing over an album meant.
+    found.sort((a, b) => a.title.localeCompare(b.title, undefined, { numeric: true }));
+    return found;
+}
 /**
  * Everything `nixamp <thing>` can be handed: a directory, a file, a playlist,
  * or a URL to any of those.
@@ -104,10 +167,19 @@ export async function loadSource(tools, source, probeTags = true) {
             ? { ...probe(tools, entry.source), title: entry.title || probe(tools, entry.source).title }
             : bare(entry));
     }
-    // A bare URL is one remote thing to play. Whether it is a song or a live
-    // stream is ffmpeg's problem, and it is good at it.
-    if (isRemote(source))
+    if (isRemote(source)) {
+        // A URL that names no file is probably a folder, and a folder served over
+        // http is a page of links. Asked only when it could be one: a stream URL
+        // must not pay for a fetch that will tell us nothing.
+        if (!isAudio(new URL(source).pathname)) {
+            const listed = await readRemoteIndex(source);
+            if (listed.length > 0)
+                return listed.map(bare);
+        }
+        // A bare URL is one remote thing to play. Whether it is a song or a live
+        // stream is ffmpeg's problem, and it is good at it.
         return [bare({ source, title: nameOf(source), duration: 0 })];
+    }
     return loadPlaylist(tools, source, probeTags);
 }
 /**

package/dist/server.d.ts

@@ -4,6 +4,7 @@ import { Broadcaster, type Destination, type EncoderSettings } from "./broadcast
 import { Ingest } from "./ingest.ts";
 import { Channels } from "./channels.ts";
 import { Accounts } from "./accounts.ts";
+import { Handles } from "./handles.ts";
 import { Servers } from "./servers.ts";
 import { SignIn } from "./oauth.ts";
 import { Owner } from "./owner.ts";
@@ -269,6 +270,8 @@ export interface HandlerOptions {
     signIn?: SignIn;
     /** The servers each account runs, on the instance that keeps accounts. */
     servers?: Servers;
+    /** The name other people see, which is never the address they signed up with. */
+    handles?: Handles;
     /** True when this instance is reached over https, for the cookie's Secure. */
     secureCookies?: boolean;
     /** A certificate and key in PEM, when this server is to speak https itself. */

package/dist/server.js

@@ -12,6 +12,7 @@
 import { createReadStream, statSync } from "node:fs";
 import { createServer as createHttpServer } from "node:http";
 import { createServer as createHttpsServer } from "node:https";
+import { randomBytes } from "node:crypto";
 import { hostname } from "node:os";
 import { spawn, spawnSync } from "node:child_process";
 import { readFileSync } from "node:fs";
@@ -21,6 +22,7 @@ import { Ingest, normaliseFormat } from "./ingest.js";
 import { Channels, cleanId } from "./channels.js";
 import { RtmpListeners } from "./rtmp-in.js";
 import { Accounts, clearedCookie, sessionCookie, tokenFrom } from "./accounts.js";
+import { anonymousHandle, Handles } from "./handles.js";
 import { Servers } from "./servers.js";
 import { DeviceGrants } from "./device.js";
 import { BAD_KEY_LIMIT, callerOf, Guard, SIGN_IN_LIMIT } from "./guard.js";
@@ -555,6 +557,7 @@ export function isSignInPath(path) {
         // rather than by a share key it has nothing to do with.
         path === "/api/v1/servers" ||
         path.startsWith("/api/v1/servers/") ||
+        path === "/api/v1/me/handle" ||
         OAUTH_ROUTE.test(path));
 }
 function html(response, code, body) {
@@ -994,6 +997,42 @@ export function createHandler(engine, options) {
                 json(response, 404, { error: "no such endpoint" });
                 return;
             }
+            // --- the name other people see ---------------------------------------
+            //
+            // Separate from the address on purpose. The address is a credential and
+            // a way to reach somebody; publishing it in a directory listing or an
+            // invite would be publishing what they log in with.
+            if (path === "/api/v1/me/handle" && options.handles) {
+                const handles = options.handles;
+                const who = await accounts.whoIs(tokenFrom(request.headers));
+                if (who === null) {
+                    json(response, 401, { error: "not signed in" });
+                    return;
+                }
+                if (request.method === "GET") {
+                    json(response, 200, { handle: await handles.of(who.id) });
+                    return;
+                }
+                if (request.method === "PUT" || request.method === "POST") {
+                    let body;
+                    try {
+                        body = JSON.parse(await readBody(request));
+                    }
+                    catch {
+                        json(response, 400, { error: "bad JSON" });
+                        return;
+                    }
+                    const claimed = await handles.claim(who.id, body.handle);
+                    if (claimed.error) {
+                        json(response, 409, { error: claimed.error });
+                        return;
+                    }
+                    json(response, 200, { handle: claimed.handle });
+                    return;
+                }
+                json(response, 405, { error: "GET or PUT" });
+                return;
+            }
             // --- the servers this account runs ----------------------------------
             //
             // Kept against the account rather than the machine, so the list reads the
@@ -1140,6 +1179,17 @@ export function createHandler(engine, options) {
             const result = signingUp
                 ? await accounts.signUp(body.email, body.password)
                 : await accounts.signIn(body.email, body.password);
+            // A handle asked for at sign-up, or one nobody has to think about. Never
+            // derived from the address: turning anthony@… into "anthony" is the leak
+            // this whole idea exists to avoid, and it is one nobody would notice
+            // until it was already in a directory listing.
+            if (signingUp && result.ok && result.account && options.handles) {
+                const asked = body.handle;
+                const claimed = await options.handles.claim(result.account.id, asked);
+                if (claimed.error) {
+                    await options.handles.claim(result.account.id, anonymousHandle((size) => randomBytes(size)));
+                }
+            }
             // Getting it right costs nothing: the counters only exist to stop people
             // who keep getting it wrong.
             if (result.ok)
@@ -2274,7 +2324,7 @@ export async function serve(argv, version = "0.1.0") {
                 // all: a browser already signed in can approve a terminal.
                 // The same pool the follows and reminders use: three small tables in
                 // one database do not want three sets of connections.
-                ...(pool ? { servers: new Servers(pool) } : {}),
+                ...(pool ? { servers: new Servers(pool), handles: new Handles(pool) } : {}),
                 signIn: new SignIn(providersFrom(process.env), new DeviceGrants(), process.env["NIXAMP_SITE"] ?? DEFAULT_DIRECTORY),
             }
             : {}),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nixamp",
-  "version": "0.6.4",
+  "version": "0.7.0",
   "description": "It really whips the terminal's ass. A Winamp-shaped audio player for your terminal.",
   "license": "MIT",
   "type": "module",

package/src/handles.ts

@@ -0,0 +1,120 @@
+/**
+ * The name other people see.
+ *
+ * An account is keyed on an email address, because that is what the auth module
+ * authenticates. An address is a credential and a way to reach somebody, and it
+ * is not a name: putting it in a directory listing, an invite or a subdomain
+ * publishes something the account holder gave us to log in with.
+ *
+ * So there are two names. The address stays private and does the linking, and a
+ * handle is the one that appears in front of strangers. They are never the same
+ * field and never travel in the same response.
+ */
+import type { Queryable } from "./follows.ts";
+
+const TABLE = "nixamp_handles";
+
+const SCHEMA = `
+  CREATE TABLE IF NOT EXISTS ${TABLE} (
+    user_id    TEXT PRIMARY KEY,
+    handle     TEXT NOT NULL,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+  );
+  CREATE UNIQUE INDEX IF NOT EXISTS ${TABLE}_lower ON ${TABLE} (lower(handle));
+`;
+
+/**
+ * What a handle may be.
+ *
+ * It ends up in a URL, a subdomain and a text message, so it is the intersection
+ * of what all three tolerate: lowercase letters, digits and hyphens, not
+ * starting or ending with one. Two to thirty characters, because a subdomain
+ * label cannot exceed sixty-three and nobody types thirty.
+ */
+export function cleanHandle(value: unknown): string {
+  if (typeof value !== "string") return "";
+  const wanted = value.trim().toLowerCase();
+  if (!/^[a-z0-9](?:[a-z0-9-]{0,28}[a-z0-9])?$/.test(wanted)) return "";
+  // Doubled hyphens are how punycode marks an encoded label, so a handle with
+  // one in it can collide with an internationalised domain.
+  return wanted.includes("--") ? "" : wanted;
+}
+
+/**
+ * Names nobody may take, because a subdomain carrying one would impersonate the
+ * service or reach a machine we run.
+ */
+const RESERVED = new Set([
+  "www", "api", "admin", "root", "nixamp", "mail", "smtp", "imap", "ns1", "ns2",
+  "static", "cdn", "assets", "app", "dev", "staging", "test", "support", "help",
+  "status", "blog", "directory", "login", "signup", "account", "settings", "me",
+]);
+
+export function isReserved(handle: string): boolean {
+  return RESERVED.has(handle);
+}
+
+/**
+ * A handle for somebody who has not chosen one.
+ *
+ * Deliberately not derived from the address. "anthony@profullstack.com" turning
+ * into "anthony" is exactly the leak this whole file exists to avoid, and it
+ * would be a leak nobody noticed until it was already in a directory listing.
+ */
+export function anonymousHandle(random: (size: number) => Uint8Array): string {
+  const bytes = random(4);
+  let out = "";
+  for (const byte of bytes) out += byte.toString(16).padStart(2, "0");
+  return `nixamp-${out}`;
+}
+
+export class Handles {
+  private ready: Promise<void> | null = null;
+
+  constructor(private readonly db: Queryable) {}
+
+  private async ensure(): Promise<void> {
+    this.ready ??= this.db.query(SCHEMA).then(() => undefined);
+    await this.ready;
+  }
+
+  async of(userId: string): Promise<string> {
+    await this.ensure();
+    const { rows } = await this.db.query(`SELECT handle FROM ${TABLE} WHERE user_id = $1`, [userId]);
+    return rows[0] ? String(rows[0]["handle"] ?? "") : "";
+  }
+
+  /** Who holds this handle, so a listing can name somebody without their address. */
+  async holder(handle: string): Promise<string> {
+    const wanted = cleanHandle(handle);
+    if (!wanted) return "";
+    await this.ensure();
+    const { rows } = await this.db.query(`SELECT user_id FROM ${TABLE} WHERE lower(handle) = $1`, [wanted]);
+    return rows[0] ? String(rows[0]["user_id"] ?? "") : "";
+  }
+
+  /**
+   * Claim one. Answers the reason it could not be taken rather than a boolean,
+   * because "that is already somebody's" and "that is not a name" are different
+   * things to tell a person.
+   */
+  async claim(userId: string, wanted: unknown): Promise<{ handle: string; error: string }> {
+    const handle = cleanHandle(wanted);
+    if (!handle) {
+      return { handle: "", error: "letters, digits and hyphens, 2 to 30 characters" };
+    }
+    if (isReserved(handle)) return { handle: "", error: "that one is reserved" };
+
+    await this.ensure();
+    const taken = await this.holder(handle);
+    if (taken && taken !== userId) return { handle: "", error: "somebody already has that one" };
+
+    await this.db.query(
+      `INSERT INTO ${TABLE} (user_id, handle) VALUES ($1, $2)
+       ON CONFLICT (user_id) DO UPDATE SET handle = EXCLUDED.handle, updated_at = NOW()`,
+      [userId, handle],
+    );
+    return { handle, error: "" };
+  }
+}

package/src/playlist.ts

@@ -87,6 +87,64 @@ export async function readPlaylist(source: string): Promise<Entry[]> {
   return entries;
 }
 
+/**
+ * The audio linked from a directory listing a web server generated.
+ *
+ * A seedbox or a plain Apache with autoindex on serves a folder as an HTML page
+ * of relative links. Handed one of those, nixamp used to make a single track of
+ * the page itself and give it to ffmpeg, which is asked to decode HTML and says
+ * so in a way nobody reads. It is a folder; it should behave like one.
+ *
+ * Not recursive, deliberately: one page is one album, the subdirectory links are
+ * on it, and walking a stranger's whole tree from a text box is a different and
+ * much larger thing to ask for.
+ */
+export async function readRemoteIndex(source: string, send: typeof fetch = fetch): Promise<Entry[]> {
+  let answer: Response;
+  try {
+    answer = await send(source, {
+      redirect: "follow",
+      headers: { accept: "text/html,*/*" },
+      signal: AbortSignal.timeout(15_000),
+    });
+  } catch {
+    return [];
+  }
+  if (!answer.ok) return [];
+  // Anything that is not a page is the thing itself, and the caller plays it.
+  if (!/^text\/html/i.test(answer.headers.get("content-type") ?? "")) return [];
+
+  const html = await answer.text().catch(() => "");
+  const found: Entry[] = [];
+  const seen = new Set<string>();
+  for (const match of html.matchAll(/href\s*=\s*["']([^"']+)["']/gi)) {
+    const href = match[1];
+    // The sort links an index puts at the top of every column, and anchors.
+    if (!href || href.startsWith("?") || href.startsWith("#")) continue;
+    let url: URL;
+    try {
+      // Relative to the page, which is how an index writes them.
+      url = new URL(href.replace(/&amp;/g, "&"), source);
+    } catch {
+      continue;
+    }
+    if (!isAudio(url.pathname)) continue;
+    const link = url.toString();
+    if (seen.has(link)) continue;
+    seen.add(link);
+    found.push({
+      source: link,
+      // The name as a person wrote it, not as a URL spells it.
+      title: decodeURIComponent(url.pathname.split("/").pop() ?? link),
+      duration: 0,
+    });
+  }
+  // Server order is by whatever column the index sorted on; by name is what
+  // somebody handing over an album meant.
+  found.sort((a, b) => a.title.localeCompare(b.title, undefined, { numeric: true }));
+  return found;
+}
+
 /**
  * Everything `nixamp <thing>` can be handed: a directory, a file, a playlist,
  * or a URL to any of those.
@@ -112,9 +170,18 @@ export async function loadSource(tools: Tools, source: string, probeTags = true)
     );
   }
 
-  // A bare URL is one remote thing to play. Whether it is a song or a live
-  // stream is ffmpeg's problem, and it is good at it.
-  if (isRemote(source)) return [bare({ source, title: nameOf(source), duration: 0 })];
+  if (isRemote(source)) {
+    // A URL that names no file is probably a folder, and a folder served over
+    // http is a page of links. Asked only when it could be one: a stream URL
+    // must not pay for a fetch that will tell us nothing.
+    if (!isAudio(new URL(source).pathname)) {
+      const listed = await readRemoteIndex(source);
+      if (listed.length > 0) return listed.map(bare);
+    }
+    // A bare URL is one remote thing to play. Whether it is a song or a live
+    // stream is ffmpeg's problem, and it is good at it.
+    return [bare({ source, title: nameOf(source), duration: 0 })];
+  }
 
   return loadPlaylist(tools, source, probeTags);
 }

package/src/server.ts

@@ -12,6 +12,7 @@
 import { createReadStream, statSync } from "node:fs";
 import { createServer as createHttpServer, type IncomingMessage, type Server, type ServerResponse } from "node:http";
 import { createServer as createHttpsServer } from "node:https";
+import { randomBytes } from "node:crypto";
 import { hostname, networkInterfaces } from "node:os";
 import { spawn, spawnSync } from "node:child_process";
 import { readFileSync } from "node:fs";
@@ -28,6 +29,7 @@ import { Ingest, normaliseFormat } from "./ingest.ts";
 import { Channels, cleanId } from "./channels.ts";
 import { RtmpListeners } from "./rtmp-in.ts";
 import { Accounts, clearedCookie, sessionCookie, tokenFrom } from "./accounts.ts";
+import { anonymousHandle, Handles } from "./handles.ts";
 import { Servers } from "./servers.ts";
 import { DeviceGrants } from "./device.ts";
 import { BAD_KEY_LIMIT, callerOf, Guard, SIGN_IN_LIMIT } from "./guard.ts";
@@ -692,6 +694,7 @@ export function isSignInPath(path: string): boolean {
     // rather than by a share key it has nothing to do with.
     path === "/api/v1/servers" ||
     path.startsWith("/api/v1/servers/") ||
+    path === "/api/v1/me/handle" ||
     OAUTH_ROUTE.test(path)
   );
 }
@@ -778,6 +781,8 @@ export interface HandlerOptions {
   signIn?: SignIn;
   /** The servers each account runs, on the instance that keeps accounts. */
   servers?: Servers;
+  /** The name other people see, which is never the address they signed up with. */
+  handles?: Handles;
   /** True when this instance is reached over https, for the cookie's Secure. */
   secureCookies?: boolean;
   /** A certificate and key in PEM, when this server is to speak https itself. */
@@ -1256,6 +1261,43 @@ export function createHandler(engine: Engine, options: HandlerOptions) {
         return;
       }
 
+      // --- the name other people see ---------------------------------------
+      //
+      // Separate from the address on purpose. The address is a credential and
+      // a way to reach somebody; publishing it in a directory listing or an
+      // invite would be publishing what they log in with.
+      if (path === "/api/v1/me/handle" && options.handles) {
+        const handles = options.handles;
+        const who = await accounts.whoIs(tokenFrom(request.headers));
+        if (who === null) {
+          json(response, 401, { error: "not signed in" });
+          return;
+        }
+
+        if (request.method === "GET") {
+          json(response, 200, { handle: await handles.of(who.id) });
+          return;
+        }
+        if (request.method === "PUT" || request.method === "POST") {
+          let body: { handle?: unknown };
+          try {
+            body = JSON.parse(await readBody(request)) as typeof body;
+          } catch {
+            json(response, 400, { error: "bad JSON" });
+            return;
+          }
+          const claimed = await handles.claim(who.id, body.handle);
+          if (claimed.error) {
+            json(response, 409, { error: claimed.error });
+            return;
+          }
+          json(response, 200, { handle: claimed.handle });
+          return;
+        }
+        json(response, 405, { error: "GET or PUT" });
+        return;
+      }
+
       // --- the servers this account runs ----------------------------------
       //
       // Kept against the account rather than the machine, so the list reads the
@@ -1413,6 +1455,18 @@ export function createHandler(engine: Engine, options: HandlerOptions) {
         ? await accounts.signUp(body.email, body.password)
         : await accounts.signIn(body.email, body.password);
 
+      // A handle asked for at sign-up, or one nobody has to think about. Never
+      // derived from the address: turning anthony@… into "anthony" is the leak
+      // this whole idea exists to avoid, and it is one nobody would notice
+      // until it was already in a directory listing.
+      if (signingUp && result.ok && result.account && options.handles) {
+        const asked = (body as { handle?: unknown }).handle;
+        const claimed = await options.handles.claim(result.account.id, asked);
+        if (claimed.error) {
+          await options.handles.claim(result.account.id, anonymousHandle((size) => randomBytes(size)));
+        }
+      }
+
       // Getting it right costs nothing: the counters only exist to stop people
       // who keep getting it wrong.
       if (result.ok) for (const bucket of buckets) guard.forget(bucket);
@@ -2624,7 +2678,7 @@ export async function serve(argv: string[], version = "0.1.0"): Promise<void> {
           // all: a browser already signed in can approve a terminal.
           // The same pool the follows and reminders use: three small tables in
           // one database do not want three sets of connections.
-          ...(pool ? { servers: new Servers(pool) } : {}),
+          ...(pool ? { servers: new Servers(pool), handles: new Handles(pool) } : {}),
           signIn: new SignIn(
             providersFrom(process.env),
             new DeviceGrants(),

package/web/dist/sw.js

@@ -1,5 +1,5 @@
 /* nixamp service worker — generated, do not edit */
-const CACHE = "nixamp-1788945118927";
+const CACHE = "nixamp-1788945979682";
 const PRECACHE = [
   "/",
   "/apple-touch-icon.png",