nixamp 0.6.4 → 0.7.1

package/dist/handles.d.ts

@@ -0,0 +1,58 @@
+/**
+ * The name other people see.
+ *
+ * An account is keyed on an email address, because that is what the auth module
+ * authenticates. An address is a credential and a way to reach somebody, and it
+ * is not a name: putting it in a directory listing, an invite or a subdomain
+ * publishes something the account holder gave us to log in with.
+ *
+ * So there are two names. The address stays private and does the linking, and a
+ * handle is the one that appears in front of strangers. They are never the same
+ * field and never travel in the same response.
+ */
+import type { Queryable } from "./follows.ts";
+/**
+ * What a handle may be.
+ *
+ * It ends up in a URL, a subdomain and a text message, so it is the intersection
+ * of what all three tolerate: lowercase letters, digits and hyphens, not
+ * starting or ending with one. Two to thirty characters, because a subdomain
+ * label cannot exceed sixty-three and nobody types thirty.
+ */
+export declare function cleanHandle(value: unknown): string;
+export declare function isReserved(handle: string): boolean;
+/**
+ * A handle for somebody who has not chosen one.
+ *
+ * Deliberately not derived from the address. "anthony@profullstack.com" turning
+ * into "anthony" is exactly the leak this whole file exists to avoid, and it
+ * would be a leak nobody noticed until it was already in a directory listing.
+ */
+export declare function anonymousHandle(random: (size: number) => Uint8Array): string;
+export declare class Handles {
+    private readonly db;
+    private ready;
+    constructor(db: Queryable);
+    private ensure;
+    of(userId: string): Promise<string>;
+    /**
+     * Handles for a page of rows, in one query.
+     *
+     * A public listing names people, and naming them one query at a time is how a
+     * list of fifty becomes fifty round trips. Anyone without a handle is absent
+     * from the map rather than present as an empty string, so a caller decides
+     * what to show for somebody who never picked one.
+     */
+    many(userIds: string[]): Promise<Map<string, string>>;
+    /** Who holds this handle, so a listing can name somebody without their address. */
+    holder(handle: string): Promise<string>;
+    /**
+     * Claim one. Answers the reason it could not be taken rather than a boolean,
+     * because "that is already somebody's" and "that is not a name" are different
+     * things to tell a person.
+     */
+    claim(userId: string, wanted: unknown): Promise<{
+        handle: string;
+        error: string;
+    }>;
+}

package/dist/handles.js

@@ -0,0 +1,117 @@
+const TABLE = "nixamp_handles";
+const SCHEMA = `
+  CREATE TABLE IF NOT EXISTS ${TABLE} (
+    user_id    TEXT PRIMARY KEY,
+    handle     TEXT NOT NULL,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+  );
+  CREATE UNIQUE INDEX IF NOT EXISTS ${TABLE}_lower ON ${TABLE} (lower(handle));
+`;
+/**
+ * What a handle may be.
+ *
+ * It ends up in a URL, a subdomain and a text message, so it is the intersection
+ * of what all three tolerate: lowercase letters, digits and hyphens, not
+ * starting or ending with one. Two to thirty characters, because a subdomain
+ * label cannot exceed sixty-three and nobody types thirty.
+ */
+export function cleanHandle(value) {
+    if (typeof value !== "string")
+        return "";
+    const wanted = value.trim().toLowerCase();
+    // Two characters minimum, thirty maximum: the trailing character is required,
+    // which is also what stops a handle ending in a hyphen.
+    if (!/^[a-z0-9][a-z0-9-]{0,28}[a-z0-9]$/.test(wanted))
+        return "";
+    // Doubled hyphens are how punycode marks an encoded label, so a handle with
+    // one in it can collide with an internationalised domain.
+    return wanted.includes("--") ? "" : wanted;
+}
+/**
+ * Names nobody may take, because a subdomain carrying one would impersonate the
+ * service or reach a machine we run.
+ */
+const RESERVED = new Set([
+    "www", "api", "admin", "root", "nixamp", "mail", "smtp", "imap", "ns1", "ns2",
+    "static", "cdn", "assets", "app", "dev", "staging", "test", "support", "help",
+    "status", "blog", "directory", "login", "signup", "account", "settings", "me",
+]);
+export function isReserved(handle) {
+    return RESERVED.has(handle);
+}
+/**
+ * A handle for somebody who has not chosen one.
+ *
+ * Deliberately not derived from the address. "anthony@profullstack.com" turning
+ * into "anthony" is exactly the leak this whole file exists to avoid, and it
+ * would be a leak nobody noticed until it was already in a directory listing.
+ */
+export function anonymousHandle(random) {
+    const bytes = random(4);
+    let out = "";
+    for (const byte of bytes)
+        out += byte.toString(16).padStart(2, "0");
+    return `nixamp-${out}`;
+}
+export class Handles {
+    db;
+    ready = null;
+    constructor(db) {
+        this.db = db;
+    }
+    async ensure() {
+        this.ready ??= this.db.query(SCHEMA).then(() => undefined);
+        await this.ready;
+    }
+    async of(userId) {
+        await this.ensure();
+        const { rows } = await this.db.query(`SELECT handle FROM ${TABLE} WHERE user_id = $1`, [userId]);
+        return rows[0] ? String(rows[0]["handle"] ?? "") : "";
+    }
+    /**
+     * Handles for a page of rows, in one query.
+     *
+     * A public listing names people, and naming them one query at a time is how a
+     * list of fifty becomes fifty round trips. Anyone without a handle is absent
+     * from the map rather than present as an empty string, so a caller decides
+     * what to show for somebody who never picked one.
+     */
+    async many(userIds) {
+        const wanted = [...new Set(userIds.filter(Boolean))];
+        if (wanted.length === 0)
+            return new Map();
+        await this.ensure();
+        const { rows } = await this.db.query(`SELECT user_id, handle FROM ${TABLE} WHERE user_id = ANY($1)`, [wanted]);
+        return new Map(rows.map((row) => [String(row["user_id"] ?? ""), String(row["handle"] ?? "")]));
+    }
+    /** Who holds this handle, so a listing can name somebody without their address. */
+    async holder(handle) {
+        const wanted = cleanHandle(handle);
+        if (!wanted)
+            return "";
+        await this.ensure();
+        const { rows } = await this.db.query(`SELECT user_id FROM ${TABLE} WHERE lower(handle) = $1`, [wanted]);
+        return rows[0] ? String(rows[0]["user_id"] ?? "") : "";
+    }
+    /**
+     * Claim one. Answers the reason it could not be taken rather than a boolean,
+     * because "that is already somebody's" and "that is not a name" are different
+     * things to tell a person.
+     */
+    async claim(userId, wanted) {
+        const handle = cleanHandle(wanted);
+        if (!handle) {
+            return { handle: "", error: "letters, digits and hyphens, 2 to 30 characters" };
+        }
+        if (isReserved(handle))
+            return { handle: "", error: "that one is reserved" };
+        await this.ensure();
+        const taken = await this.holder(handle);
+        if (taken && taken !== userId)
+            return { handle: "", error: "somebody already has that one" };
+        await this.db.query(`INSERT INTO ${TABLE} (user_id, handle) VALUES ($1, $2)
+       ON CONFLICT (user_id) DO UPDATE SET handle = EXCLUDED.handle, updated_at = NOW()`, [userId, handle]);
+        return { handle, error: "" };
+    }
+}

package/dist/main.js

@@ -52,6 +52,7 @@ const HELP = `nixamp — it really whips the terminal's ass.
   nixamp logout / whoami        forget it, or check it
   nixamp token create|list|revoke  tokens for a machine that cannot sign in
   nixamp server list|add|remove  the machines you run, kept against your account
+  nixamp opendir list|add|remove  folders found on the web, published for everyone
   nixamp update [version]        re-run the installer, keeping your choices
   nixamp uninstall [--yes]       remove everything the installer created
 
@@ -292,6 +293,11 @@ export async function main() {
         process.exitCode = await login(first === "signup" ? [...rest, "--signup"] : rest);
         return;
     }
+    if (first === "opendir" || first === "opendirs") {
+        const { opendirs } = await import("./session.js");
+        process.exitCode = await opendirs(rest);
+        return;
+    }
     if (first === "server" || first === "servers") {
         const { servers } = await import("./session.js");
         process.exitCode = await servers(rest);

package/dist/opendirs.d.ts

@@ -0,0 +1,43 @@
+import type { Queryable } from "./follows.ts";
+export interface OpenDir {
+    id: string;
+    url: string;
+    name: string;
+    /** How many playable files were on the page when it was added. */
+    tracks: number;
+    /** The finder's public handle. Never their address. */
+    by: string;
+    createdAt: number;
+}
+/**
+ * The name to show for a folder nobody named.
+ *
+ * The last path segment, which for a folder of music is the album, written the
+ * way a person wrote it rather than the way a URL spells it.
+ */
+export declare function nameOfDir(url: string): string;
+export declare class OpenDirs {
+    private readonly db;
+    private ready;
+    constructor(db: Queryable);
+    private ensure;
+    /**
+     * The list, newest first, in pages.
+     *
+     * Keyset on the row's own creation time rather than an offset, because a list
+     * anybody may add to shifts under a reader who is paging through it, and an
+     * offset in a shifting list repeats and skips rows.
+     */
+    list(limit?: number, before?: number): Promise<{
+        rows: Omit<OpenDir, "by">[];
+        addedBy: string[];
+        next: number;
+    }>;
+    /**
+     * Publish one. `tracks` is what the finder's server actually saw on the page,
+     * so a row nobody can play never reaches the list.
+     */
+    add(userId: string, url: unknown, name: unknown, tracks: number): Promise<Omit<OpenDir, "by"> | null>;
+    /** Only the finder takes their own row down. */
+    remove(userId: string, id: string): Promise<boolean>;
+}

package/dist/opendirs.js

@@ -0,0 +1,133 @@
+/**
+ * Open directories somebody found, kept as a list anyone can read.
+ *
+ * Deliberately not the stream directory. That one lists what is playing right
+ * now: a heartbeat, a TTL, a room code, somebody at the other end. An open
+ * directory is the opposite in every one of those respects. It is always there,
+ * nobody is broadcasting it, and it is not the finder's to broadcast. Mixing
+ * the two would put "chovy is playing this, dial in" next to "here is a link
+ * to a stranger's file server" under one heading.
+ *
+ * Public to read and signed in to add, because a public list with nobody
+ * accountable for its rows is a public list of whatever anybody felt like
+ * putting there. What is shown against a row is the finder's handle, never the
+ * address they signed up with.
+ */
+import { randomBytes } from "node:crypto";
+import { cleanUrl } from "./servers.js";
+const TABLE = "nixamp_opendirs";
+const SCHEMA = `
+  CREATE TABLE IF NOT EXISTS ${TABLE} (
+    id          TEXT PRIMARY KEY,
+    url         TEXT NOT NULL,
+    name        TEXT NOT NULL DEFAULT '',
+    added_by    TEXT NOT NULL,
+    tracks      INTEGER NOT NULL DEFAULT 0,
+    created_at  TIMESTAMPTZ NOT NULL DEFAULT NOW()
+  );
+  CREATE UNIQUE INDEX IF NOT EXISTS ${TABLE}_url ON ${TABLE} (url);
+  CREATE INDEX IF NOT EXISTS ${TABLE}_added ON ${TABLE} (created_at DESC);
+`;
+/**
+ * The name to show for a folder nobody named.
+ *
+ * The last path segment, which for a folder of music is the album, written the
+ * way a person wrote it rather than the way a URL spells it.
+ */
+export function nameOfDir(url) {
+    try {
+        const parts = new URL(url).pathname.split("/").filter(Boolean);
+        const last = parts[parts.length - 1];
+        return last ? decodeURIComponent(last).slice(0, 120) : new URL(url).host;
+    }
+    catch {
+        return "an open directory";
+    }
+}
+function asTime(value) {
+    if (value instanceof Date)
+        return value.getTime();
+    if (typeof value === "string") {
+        const at = Date.parse(value);
+        return Number.isNaN(at) ? 0 : at;
+    }
+    return typeof value === "number" ? value : 0;
+}
+export class OpenDirs {
+    db;
+    ready = null;
+    constructor(db) {
+        this.db = db;
+    }
+    async ensure() {
+        this.ready ??= this.db.query(SCHEMA).then(() => undefined);
+        await this.ready;
+    }
+    /**
+     * The list, newest first, in pages.
+     *
+     * Keyset on the row's own creation time rather than an offset, because a list
+     * anybody may add to shifts under a reader who is paging through it, and an
+     * offset in a shifting list repeats and skips rows.
+     */
+    async list(limit = 50, before = 0) {
+        await this.ensure();
+        const size = Math.min(200, Math.max(1, limit));
+        const { rows } = await this.db.query(`SELECT id, url, name, added_by, tracks, created_at FROM ${TABLE}
+        ${before > 0 ? "WHERE created_at < $2" : ""}
+        ORDER BY created_at DESC LIMIT $1`, before > 0 ? [size + 1, new Date(before).toISOString()] : [size + 1]);
+        // One more than asked for, so "is there another page" is a fact rather
+        // than a guess from a full one.
+        const page = rows.slice(0, size);
+        return {
+            rows: page.map((row) => ({
+                id: String(row["id"] ?? ""),
+                url: String(row["url"] ?? ""),
+                name: String(row["name"] ?? ""),
+                tracks: Number(row["tracks"] ?? 0),
+                createdAt: asTime(row["created_at"]),
+            })),
+            addedBy: page.map((row) => String(row["added_by"] ?? "")),
+            next: rows.length > size ? asTime(page[page.length - 1]?.["created_at"]) : 0,
+        };
+    }
+    /**
+     * Publish one. `tracks` is what the finder's server actually saw on the page,
+     * so a row nobody can play never reaches the list.
+     */
+    async add(userId, url, name, tracks) {
+        const clean = typeof url === "string" ? url.trim() : "";
+        // Not cleanUrl's origin-only treatment: a folder is a path, and the path is
+        // the whole point of the row.
+        if (!/^https?:\/\//i.test(clean) || cleanUrl(clean) === "")
+            return null;
+        if (tracks <= 0)
+            return null;
+        await this.ensure();
+        const { rows } = await this.db.query(`INSERT INTO ${TABLE} (id, url, name, added_by, tracks) VALUES ($1, $2, $3, $4, $5)
+       ON CONFLICT (url) DO UPDATE SET name = EXCLUDED.name, tracks = EXCLUDED.tracks
+       RETURNING id, url, name, tracks, created_at`, [
+            randomBytes(8).toString("hex"),
+            clean,
+            (typeof name === "string" && name.trim() ? name.trim() : nameOfDir(clean)).slice(0, 120),
+            userId,
+            Math.min(100_000, tracks),
+        ]);
+        const row = rows[0];
+        if (!row)
+            return null;
+        return {
+            id: String(row["id"] ?? ""),
+            url: String(row["url"] ?? ""),
+            name: String(row["name"] ?? ""),
+            tracks: Number(row["tracks"] ?? 0),
+            createdAt: asTime(row["created_at"]),
+        };
+    }
+    /** Only the finder takes their own row down. */
+    async remove(userId, id) {
+        await this.ensure();
+        const { rows } = await this.db.query(`DELETE FROM ${TABLE} WHERE id = $1 AND added_by = $2 RETURNING id`, [id, userId]);
+        return rows.length > 0;
+    }
+}

package/dist/playlist.d.ts

@@ -10,6 +10,19 @@ export declare function findAudio(root: string): string[];
  * ffmpeg is left to do what it is good at.
  */
 export declare function readPlaylist(source: string): Promise<Entry[]>;
+/**
+ * The audio linked from a directory listing a web server generated.
+ *
+ * A seedbox or a plain Apache with autoindex on serves a folder as an HTML page
+ * of relative links. Handed one of those, nixamp used to make a single track of
+ * the page itself and give it to ffmpeg, which is asked to decode HTML and says
+ * so in a way nobody reads. It is a folder; it should behave like one.
+ *
+ * Not recursive, deliberately: one page is one album, the subdirectory links are
+ * on it, and walking a stranger's whole tree from a text box is a different and
+ * much larger thing to ask for.
+ */
+export declare function readRemoteIndex(source: string, send?: typeof fetch): Promise<Entry[]>;
 /**
  * Everything `nixamp <thing>` can be handed: a directory, a file, a playlist,
  * or a URL to any of those.

package/dist/playlist.js

@@ -81,6 +81,69 @@ export async function readPlaylist(source) {
     const entries = /\.pls$/i.test(source) ? parsePls(text, source) : parseM3u(text, source);
     return entries;
 }
+/**
+ * The audio linked from a directory listing a web server generated.
+ *
+ * A seedbox or a plain Apache with autoindex on serves a folder as an HTML page
+ * of relative links. Handed one of those, nixamp used to make a single track of
+ * the page itself and give it to ffmpeg, which is asked to decode HTML and says
+ * so in a way nobody reads. It is a folder; it should behave like one.
+ *
+ * Not recursive, deliberately: one page is one album, the subdirectory links are
+ * on it, and walking a stranger's whole tree from a text box is a different and
+ * much larger thing to ask for.
+ */
+export async function readRemoteIndex(source, send = fetch) {
+    let answer;
+    try {
+        answer = await send(source, {
+            redirect: "follow",
+            headers: { accept: "text/html,*/*" },
+            signal: AbortSignal.timeout(15_000),
+        });
+    }
+    catch {
+        return [];
+    }
+    if (!answer.ok)
+        return [];
+    // Anything that is not a page is the thing itself, and the caller plays it.
+    if (!/^text\/html/i.test(answer.headers.get("content-type") ?? ""))
+        return [];
+    const html = await answer.text().catch(() => "");
+    const found = [];
+    const seen = new Set();
+    for (const match of html.matchAll(/href\s*=\s*["']([^"']+)["']/gi)) {
+        const href = match[1];
+        // The sort links an index puts at the top of every column, and anchors.
+        if (!href || href.startsWith("?") || href.startsWith("#"))
+            continue;
+        let url;
+        try {
+            // Relative to the page, which is how an index writes them.
+            url = new URL(href.replace(/&/g, "&"), source);
+        }
+        catch {
+            continue;
+        }
+        if (!isAudio(url.pathname))
+            continue;
+        const link = url.toString();
+        if (seen.has(link))
+            continue;
+        seen.add(link);
+        found.push({
+            source: link,
+            // The name as a person wrote it, not as a URL spells it.
+            title: decodeURIComponent(url.pathname.split("/").pop() ?? link),
+            duration: 0,
+        });
+    }
+    // Server order is by whatever column the index sorted on; by name is what
+    // somebody handing over an album meant.
+    found.sort((a, b) => a.title.localeCompare(b.title, undefined, { numeric: true }));
+    return found;
+}
 /**
  * Everything `nixamp <thing>` can be handed: a directory, a file, a playlist,
  * or a URL to any of those.
@@ -104,10 +167,19 @@ export async function loadSource(tools, source, probeTags = true) {
             ? { ...probe(tools, entry.source), title: entry.title || probe(tools, entry.source).title }
             : bare(entry));
     }
-    // A bare URL is one remote thing to play. Whether it is a song or a live
-    // stream is ffmpeg's problem, and it is good at it.
-    if (isRemote(source))
+    if (isRemote(source)) {
+        // A URL that names no file is probably a folder, and a folder served over
+        // http is a page of links. Asked only when it could be one: a stream URL
+        // must not pay for a fetch that will tell us nothing.
+        if (!isAudio(new URL(source).pathname)) {
+            const listed = await readRemoteIndex(source);
+            if (listed.length > 0)
+                return listed.map(bare);
+        }
+        // A bare URL is one remote thing to play. Whether it is a song or a live
+        // stream is ffmpeg's problem, and it is good at it.
         return [bare({ source, title: nameOf(source), duration: 0 })];
+    }
     return loadPlaylist(tools, source, probeTags);
 }
 /**

package/dist/server.d.ts

@@ -4,6 +4,8 @@ import { Broadcaster, type Destination, type EncoderSettings } from "./broadcast
 import { Ingest } from "./ingest.ts";
 import { Channels } from "./channels.ts";
 import { Accounts } from "./accounts.ts";
+import { Handles } from "./handles.ts";
+import { OpenDirs } from "./opendirs.ts";
 import { Servers } from "./servers.ts";
 import { SignIn } from "./oauth.ts";
 import { Owner } from "./owner.ts";
@@ -269,6 +271,10 @@ export interface HandlerOptions {
     signIn?: SignIn;
     /** The servers each account runs, on the instance that keeps accounts. */
     servers?: Servers;
+    /** The name other people see, which is never the address they signed up with. */
+    handles?: Handles;
+    /** Open directories people have found, which anyone may read. */
+    openDirs?: OpenDirs;
     /** True when this instance is reached over https, for the cookie's Secure. */
     secureCookies?: boolean;
     /** A certificate and key in PEM, when this server is to speak https itself. */