nixamp 0.7.17 → 0.7.19

package/dist/publish.d.ts

@@ -12,7 +12,14 @@ export interface PublishTarget {
      * gets a 401 in JSON, which is a caller hearing nothing.
      */
     audio?: string;
-    tracks: number;
+    /**
+     * How many tracks there are, asked at every heartbeat rather than once.
+     *
+     * Taken as a number, it was read before the library had finished loading --
+     * the port opens first now -- so a server with five thousand tracks
+     * advertised nought of them for as long as it stayed up.
+     */
+    tracks: () => number;
     nowPlaying: () => string;
     /**
      * The account this stream belongs to, from `nixamp login`.

package/dist/publish.js

@@ -58,7 +58,7 @@ export class Publisher {
                     name: this.target.name,
                     url: this.target.url,
                     ...(this.target.audio ? { audio: this.target.audio } : {}),
-                    tracks: this.target.tracks,
+                    tracks: this.target.tracks(),
                     nowPlaying: this.target.nowPlaying(),
                 }),
             });

package/dist/server.js

@@ -775,10 +775,17 @@ export function createHandler(engine, options) {
         // cookie, so every later fetch, EventSource and <audio src> carries it
         // without the page knowing anything about keys. Either key works here, and
         // which one was used decides what the browser can then do.
-        const offeredInPath = key !== null ? keyInPath(path) : null;
-        if (offeredInPath !== null) {
-            const offered = offeredInPath;
-            if (scopeOf(offered, key, listenKey) === null) {
+        const inPath = key !== null ? keyInPath(path) : null;
+        if (inPath !== null) {
+            const offered = inPath.key;
+            // The path has to be telling the truth about the key it carries. A `/v/`
+            // link holding the control key would read as view-only to whoever you
+            // sent it to and hand them the controls, which is the whole reason for
+            // naming the two shapes in the first place.
+            //
+            // A mismatch answers exactly as a wrong key does, so nothing is learned
+            // from the difference between the two.
+            if (scopeOf(offered, key, listenKey) !== inPath.wants) {
                 json(response, 404, { error: "not found" });
                 return;
             }
@@ -2937,9 +2944,9 @@ export async function serve(argv, version = "0.1.0") {
             name: options.name || hostname(),
             url: listen,
             audio,
-            // Asked of the engine rather than a variable, because the library is
-            // now read after the port opens and may still be arriving.
-            tracks: engine.snapshot(false).trackCount,
+            // Asked at every heartbeat rather than once, because the library is
+            // read after the port opens and is still arriving when this is made.
+            tracks: () => engine.snapshot(false).trackCount,
             // From `nixamp login`. The directory will not list a stream it cannot
             // attribute to somebody, because a listing is now a phone code that
             // costs money to answer.

package/dist/share.d.ts

@@ -94,8 +94,19 @@ export declare function reachableAddresses(host: string, port: number, publicUrl
  * A link should say what it is before anybody clicks it.
  */
 export declare const KEY_PATHS: readonly ["/a/", "/v/"];
-/** The key in a share link, whichever of the three shapes it came in. */
-export declare function keyInPath(path: string): string | null;
+/**
+ * The key in a share link, and what the link claimed to be.
+ *
+ * Both halves, because a label nobody checks is a label that can lie. `/a/`
+ * means this administers and `/v/` means this only views; handed the other
+ * key, a path would otherwise have said one thing and done the other -- and
+ * the dangerous direction is real: a `/v/` link built around the control key
+ * reads as view-only to the person you send it to and hands them the controls.
+ */
+export declare function keyInPath(path: string): {
+    key: string;
+    wants: Scope;
+} | null;
 /** The full link, key and all. `admin` picks the shape that says which it is. */
 export declare function shareLink(base: string, key: string | null, admin?: boolean): string;
 /**

package/dist/share.js

@@ -251,7 +251,15 @@ export function reachableAddresses(host, port, publicUrl = "", scheme = "http")
  * A link should say what it is before anybody clicks it.
  */
 export const KEY_PATHS = ["/a/", "/v/"];
-/** The key in a share link, whichever of the three shapes it came in. */
+/**
+ * The key in a share link, and what the link claimed to be.
+ *
+ * Both halves, because a label nobody checks is a label that can lie. `/a/`
+ * means this administers and `/v/` means this only views; handed the other
+ * key, a path would otherwise have said one thing and done the other -- and
+ * the dangerous direction is real: a `/v/` link built around the control key
+ * reads as view-only to the person you send it to and hands them the controls.
+ */
 export function keyInPath(path) {
     for (const prefix of KEY_PATHS) {
         if (!path.startsWith(prefix))
@@ -259,12 +267,15 @@ export function keyInPath(path) {
         const rest = path.slice(prefix.length).replace(/\/+$/, "");
         if (rest === "" || rest.includes("/"))
             return null;
+        let key = rest;
         try {
-            return decodeURIComponent(rest);
+            key = decodeURIComponent(rest);
         }
         catch {
-            return rest;
+            // A key that is not valid percent-encoding is taken as written; it will
+            // fail to match anything, which is the right answer either way.
         }
+        return { key, wants: prefix === "/a/" ? "control" : "listen" };
     }
     return null;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nixamp",
-  "version": "0.7.17",
+  "version": "0.7.19",
   "description": "It really whips the terminal's ass. A Winamp-shaped audio player for your terminal.",
   "license": "MIT",
   "type": "module",

package/src/publish.ts

@@ -21,7 +21,14 @@ export interface PublishTarget {
    * gets a 401 in JSON, which is a caller hearing nothing.
    */
   audio?: string;
-  tracks: number;
+  /**
+   * How many tracks there are, asked at every heartbeat rather than once.
+   *
+   * Taken as a number, it was read before the library had finished loading --
+   * the port opens first now -- so a server with five thousand tracks
+   * advertised nought of them for as long as it stayed up.
+   */
+  tracks: () => number;
   nowPlaying: () => string;
   /**
    * The account this stream belongs to, from `nixamp login`.
@@ -92,7 +99,7 @@ export class Publisher {
           name: this.target.name,
           url: this.target.url,
           ...(this.target.audio ? { audio: this.target.audio } : {}),
-          tracks: this.target.tracks,
+          tracks: this.target.tracks(),
           nowPlaying: this.target.nowPlaying(),
         }),
       });

package/src/server.ts

@@ -1074,10 +1074,17 @@ export function createHandler(engine: Engine, options: HandlerOptions) {
     // cookie, so every later fetch, EventSource and <audio src> carries it
     // without the page knowing anything about keys. Either key works here, and
     // which one was used decides what the browser can then do.
-    const offeredInPath = key !== null ? keyInPath(path) : null;
-    if (offeredInPath !== null) {
-      const offered = offeredInPath;
-      if (scopeOf(offered, key, listenKey) === null) {
+    const inPath = key !== null ? keyInPath(path) : null;
+    if (inPath !== null) {
+      const offered = inPath.key;
+      // The path has to be telling the truth about the key it carries. A `/v/`
+      // link holding the control key would read as view-only to whoever you
+      // sent it to and hand them the controls, which is the whole reason for
+      // naming the two shapes in the first place.
+      //
+      // A mismatch answers exactly as a wrong key does, so nothing is learned
+      // from the difference between the two.
+      if (scopeOf(offered, key, listenKey) !== inPath.wants) {
         json(response, 404, { error: "not found" });
         return;
       }
@@ -3394,9 +3401,9 @@ export async function serve(argv: string[], version = "0.1.0"): Promise<void> {
         name: options.name || hostname(),
         url: listen,
         audio,
-        // Asked of the engine rather than a variable, because the library is
-        // now read after the port opens and may still be arriving.
-        tracks: engine.snapshot(false).trackCount,
+        // Asked at every heartbeat rather than once, because the library is
+        // read after the port opens and is still arriving when this is made.
+        tracks: () => engine.snapshot(false).trackCount,
         // From `nixamp login`. The directory will not list a stream it cannot
         // attribute to somebody, because a listing is now a phone code that
         // costs money to answer.

package/src/share.ts

@@ -282,17 +282,28 @@ export function reachableAddresses(
  */
 export const KEY_PATHS = ["/a/", "/v/"] as const;
 
-/** The key in a share link, whichever of the three shapes it came in. */
-export function keyInPath(path: string): string | null {
+/**
+ * The key in a share link, and what the link claimed to be.
+ *
+ * Both halves, because a label nobody checks is a label that can lie. `/a/`
+ * means this administers and `/v/` means this only views; handed the other
+ * key, a path would otherwise have said one thing and done the other -- and
+ * the dangerous direction is real: a `/v/` link built around the control key
+ * reads as view-only to the person you send it to and hands them the controls.
+ */
+export function keyInPath(path: string): { key: string; wants: Scope } | null {
   for (const prefix of KEY_PATHS) {
     if (!path.startsWith(prefix)) continue;
     const rest = path.slice(prefix.length).replace(/\/+$/, "");
     if (rest === "" || rest.includes("/")) return null;
+    let key = rest;
     try {
-      return decodeURIComponent(rest);
+      key = decodeURIComponent(rest);
     } catch {
-      return rest;
+      // A key that is not valid percent-encoding is taken as written; it will
+      // fail to match anything, which is the right answer either way.
     }
+    return { key, wants: prefix === "/a/" ? "control" : "listen" };
   }
   return null;
 }

package/web/dist/sw.js

@@ -1,5 +1,5 @@
 /* nixamp service worker — generated, do not edit */
-const CACHE = "nixamp-1788962802424";
+const CACHE = "nixamp-1788964111536";
 const PRECACHE = [
   "/",
   "/apple-touch-icon.png",