nixamp 0.7.41 → 0.9.3

package/dist/names.js

@@ -0,0 +1,184 @@
+import { isReserved } from "./handles.js";
+import { isIPv4, isIPv6 } from "./dns.js";
+/** An error with the HTTP status it deserves, so a route can pass it straight on. */
+export class NameError extends Error {
+    status;
+    constructor(status, message) {
+        super(message);
+        this.status = status;
+    }
+}
+/**
+ * Names nobody may give a server, over and above the handles nobody may take:
+ * the mail and discovery names a client resolves on its own, anything an
+ * underscore marks as a protocol record, and anything punycode-shaped.
+ */
+const RESERVED_LABELS = new Set([
+    "www", "mail", "mx", "smtp", "imap", "pop", "ns1", "ns2", "ftp",
+    "_dmarc", "_acme-challenge", "autoconfig", "autodiscover",
+]);
+/**
+ * The label a server may have: two to thirty of [a-z0-9-], not starting or
+ * ending with a hyphen, lowercased for the caller who typed it in capitals.
+ * "" when it is not one, so a route can say so in one sentence.
+ */
+export function validLabel(value) {
+    if (typeof value !== "string")
+        return "";
+    const label = value.trim().toLowerCase();
+    if (!/^[a-z0-9][a-z0-9-]{0,28}[a-z0-9]$/.test(label))
+        return "";
+    if (label.startsWith("_") || label.startsWith("xn--"))
+        return "";
+    if (RESERVED_LABELS.has(label) || isReserved(label))
+        return "";
+    return label;
+}
+const TABLE = "dns_names";
+const SCHEMA = `
+  CREATE TABLE IF NOT EXISTS ${TABLE} (
+    account_id  TEXT NOT NULL,
+    handle      TEXT NOT NULL,
+    label       TEXT NOT NULL,
+    a           TEXT NOT NULL DEFAULT '',
+    aaaa        TEXT NOT NULL DEFAULT '',
+    ttl         INTEGER NOT NULL DEFAULT 600,
+    created_at  TIMESTAMPTZ NOT NULL DEFAULT now(),
+    updated_at  TIMESTAMPTZ NOT NULL DEFAULT now(),
+    PRIMARY KEY (handle, label)
+  );
+  CREATE INDEX IF NOT EXISTS ${TABLE}_account ON ${TABLE} (account_id);
+`;
+export const MIN_TTL = 600;
+export const MAX_TTL = 86_400;
+/** Enough for a rack, not enough for a squatter. */
+export const DEFAULT_PER_ACCOUNT = 20;
+function when(value) {
+    if (value instanceof Date)
+        return value.getTime();
+    const parsed = new Date(String(value ?? 0)).getTime();
+    return Number.isFinite(parsed) ? parsed : 0;
+}
+export class Names {
+    db;
+    dns;
+    limits;
+    ready = null;
+    constructor(db, dns, limits = {}) {
+        this.db = db;
+        this.dns = dns;
+        this.limits = limits;
+    }
+    async ensure() {
+        this.ready ??= this.db.query(SCHEMA).then(() => undefined);
+        await this.ready;
+    }
+    host(handle, label) {
+        return `${label}.${handle}.${this.dns.zone}`;
+    }
+    record(handle, row) {
+        return {
+            label: row.label,
+            host: this.host(handle, row.label),
+            a: row.a ?? "",
+            aaaa: row.aaaa ?? "",
+            ttl: Number(row.ttl) || MIN_TTL,
+            createdAt: when(row.created_at),
+            updatedAt: when(row.updated_at),
+        };
+    }
+    async list(accountId, handle) {
+        await this.ensure();
+        const { rows } = await this.db.query(`SELECT account_id, handle, label, a, aaaa, ttl, created_at, updated_at
+       FROM ${TABLE} WHERE account_id = $1 AND handle = $2 ORDER BY created_at`, [accountId, handle]);
+        return rows.map((row) => this.record(handle, row));
+    }
+    /** The row for one name, whoever owns it. */
+    async find(handle, label) {
+        const { rows } = await this.db.query(`SELECT account_id, handle, label, a, aaaa, ttl, created_at, updated_at
+       FROM ${TABLE} WHERE handle = $1 AND label = $2`, [handle, label]);
+        return rows[0] ?? null;
+    }
+    /**
+     * Make or change a name. `null` for a family takes that record away,
+     * `undefined` leaves it as it was, so a server that has only ever had an
+     * IPv4 address can be given an IPv6 one without restating the first.
+     */
+    async set(accountId, handle, wanted, want) {
+        const label = validLabel(wanted);
+        if (label === "")
+            throw new NameError(400, "that is not a name a server can have");
+        if (want.a !== undefined && want.a !== null && !isIPv4(want.a)) {
+            throw new NameError(400, "that is not an IPv4 address");
+        }
+        if (want.aaaa !== undefined && want.aaaa !== null && !isIPv6(want.aaaa)) {
+            throw new NameError(400, "that is not an IPv6 address");
+        }
+        await this.ensure();
+        const existing = await this.find(handle, label);
+        if (existing !== null && existing.account_id !== accountId) {
+            throw new NameError(409, "that name belongs to somebody else");
+        }
+        if (existing === null) {
+            const { rows } = await this.db.query(`SELECT count(*)::int AS n FROM ${TABLE} WHERE account_id = $1`, [accountId]);
+            const have = Number(rows[0]?.n ?? 0);
+            const limit = this.limits.perAccount ?? DEFAULT_PER_ACCOUNT;
+            if (have >= limit)
+                throw new NameError(422, `an account may have ${limit} names, and this one has ${have}`);
+        }
+        // What the name will point at once this is done.
+        const a = want.a === undefined ? (existing?.a ?? "") : (want.a ?? "");
+        const aaaa = want.aaaa === undefined ? (existing?.aaaa ?? "") : (want.aaaa ?? "");
+        if (a === "" && aaaa === "")
+            throw new NameError(400, "give an address");
+        const ttl = Math.min(MAX_TTL, Math.max(MIN_TTL, Math.floor(want.ttl ?? existing?.ttl ?? MIN_TTL)));
+        // The zone first. A registrar that says no is the caller's problem to hear
+        // about now, not a row that claims a name the world cannot resolve.
+        const host = this.host(handle, label);
+        try {
+            if (a !== "")
+                await this.dns.set(host, "A", a, ttl);
+            else if (existing !== null && existing.a !== "")
+                await this.dns.remove(host, "A");
+            if (aaaa !== "")
+                await this.dns.set(host, "AAAA", aaaa, ttl);
+            else if (existing !== null && existing.aaaa !== "")
+                await this.dns.remove(host, "AAAA");
+        }
+        catch (error) {
+            throw new NameError(502, `the zone did not take that record: ${error.message}`);
+        }
+        const { rows } = await this.db.query(`INSERT INTO ${TABLE} (account_id, handle, label, a, aaaa, ttl)
+       VALUES ($1, $2, $3, $4, $5, $6)
+       ON CONFLICT (handle, label) DO UPDATE
+         SET a = EXCLUDED.a, aaaa = EXCLUDED.aaaa, ttl = EXCLUDED.ttl, updated_at = now()
+       RETURNING account_id, handle, label, a, aaaa, ttl, created_at, updated_at`, [accountId, handle, label, a, aaaa, ttl]);
+        const row = rows[0];
+        return this.record(handle, row ?? {
+            account_id: accountId, handle, label, a, aaaa, ttl,
+            created_at: existing?.created_at ?? new Date(), updated_at: new Date(),
+        });
+    }
+    /** Take a name away. False when it is not this account's to take. */
+    async remove(accountId, handle, wanted) {
+        const label = validLabel(wanted);
+        if (label === "")
+            return false;
+        await this.ensure();
+        const existing = await this.find(handle, label);
+        if (existing === null || existing.account_id !== accountId)
+            return false;
+        const host = this.host(handle, label);
+        try {
+            await this.dns.remove(host, "A");
+            await this.dns.remove(host, "AAAA");
+        }
+        catch (error) {
+            throw new NameError(502, `the zone did not let go of that record: ${error.message}`);
+        }
+        await this.db.query(`DELETE FROM ${TABLE} WHERE account_id = $1 AND handle = $2 AND label = $3`, [
+            accountId, handle, label,
+        ]);
+        return true;
+    }
+}

package/dist/naming.d.ts

@@ -0,0 +1,57 @@
+export interface Named {
+    host: string;
+    a: string;
+    aaaa: string;
+}
+export interface CertFiles {
+    cert: string;
+    key: string;
+    expiresAt: number;
+    /** The name on the certificate, e.g. `*.chovy.nixamp.com`. */
+    host: string;
+}
+/**
+ * Claim, or refresh, this machine's name.
+ *
+ * "auto" for both families: the site records whichever addresses this request
+ * arrived from, which is the only honest answer to "what is my public
+ * address" from behind a router. Null when refused or unreachable, and the
+ * reason is said rather than thrown: a server without a name still serves.
+ */
+export declare function claimName(site: string, token: string, label: string, say: (line: string) => void, fetcher?: typeof fetch): Promise<Named | null>;
+/**
+ * The handle's certificate.
+ *
+ * The first one is issued while we wait: a wildcard by DNS challenge takes a
+ * couple of minutes, which is said once so the pause reads as work rather
+ * than a hang. After that it is a cached answer on the site's side.
+ */
+export declare function fetchCert(site: string, token: string, opts: {
+    waitMs?: number;
+    everyMs?: number;
+    sleep?: (ms: number) => Promise<void>;
+    fetcher?: typeof fetch;
+}, say: (line: string) => void): Promise<CertFiles | null>;
+/**
+ * Keep a certificate beside the keys. Private, because the key is what lets
+ * anybody be this server.
+ */
+export declare function writeCertFiles(stateDir: string, files: CertFiles): {
+    cert: string;
+    key: string;
+};
+/**
+ * The certificate from last time, if it is still good for more than a day.
+ * Anything closer to expiry is treated as absent so the next start fetches
+ * a fresh one rather than serving one that lapses overnight.
+ */
+export declare function readCertFiles(stateDir: string, host: string): {
+    cert: string;
+    key: string;
+    expiresAt: number;
+} | null;
+/**
+ * What this machine calls itself in DNS: the name it was given, else the
+ * first label of its hostname, made safe for a subdomain.
+ */
+export declare function labelFor(name: string, hostname: string): string;

package/dist/naming.js

@@ -0,0 +1,150 @@
+/**
+ * A name and a certificate for this machine, from nixamp.com.
+ *
+ * The DNS keys never leave nixamp.com: a server signed in to an account asks
+ * for `<label>.<handle>.nixamp.com` and the site makes the record for the
+ * address the request came from, A and AAAA both. The certificate is one
+ * wildcard per handle, issued and renewed by the site, handed to the account's
+ * own servers over the authenticated API and kept on disk here so a restart
+ * serves https at once rather than after a round trip.
+ */
+import { chmodSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+/** A certificate this close to expiry is not worth serving: fetch a fresh one. */
+const TOO_CLOSE_MS = 24 * 60 * 60 * 1000;
+function bearer(token) {
+    return { authorization: `Bearer ${token}`, "content-type": "application/json" };
+}
+/**
+ * Claim, or refresh, this machine's name.
+ *
+ * "auto" for both families: the site records whichever addresses this request
+ * arrived from, which is the only honest answer to "what is my public
+ * address" from behind a router. Null when refused or unreachable, and the
+ * reason is said rather than thrown: a server without a name still serves.
+ */
+export async function claimName(site, token, label, say, fetcher = fetch) {
+    try {
+        const answer = await fetcher(`${site}/api/v1/dns/${encodeURIComponent(label)}`, {
+            method: "PUT",
+            headers: bearer(token),
+            body: JSON.stringify({ a: "auto", aaaa: "auto" }),
+        });
+        const body = (await answer.json().catch(() => ({})));
+        if (!answer.ok || !body.name?.host) {
+            say(`nixamp: ${site} would not name this machine: ${body.error ?? `answered ${answer.status}`}`);
+            return null;
+        }
+        return { host: body.name.host, a: body.name.a ?? "", aaaa: body.name.aaaa ?? "" };
+    }
+    catch (error) {
+        say(`nixamp: could not reach ${site} to claim a name: ${error.message}`);
+        return null;
+    }
+}
+/**
+ * The handle's certificate.
+ *
+ * The first one is issued while we wait: a wildcard by DNS challenge takes a
+ * couple of minutes, which is said once so the pause reads as work rather
+ * than a hang. After that it is a cached answer on the site's side.
+ */
+export async function fetchCert(site, token, opts, say) {
+    const waitMs = opts.waitMs ?? 240_000;
+    const everyMs = opts.everyMs ?? 10_000;
+    const sleep = opts.sleep ?? ((ms) => new Promise((done) => setTimeout(done, ms)));
+    const fetcher = opts.fetcher ?? fetch;
+    let waited = 0;
+    let announced = false;
+    for (;;) {
+        let answer;
+        try {
+            answer = await fetcher(`${site}/api/v1/certs`, { headers: bearer(token) });
+        }
+        catch (error) {
+            say(`nixamp: could not reach ${site} for a certificate: ${error.message}`);
+            return null;
+        }
+        const body = (await answer.json().catch(() => ({})));
+        if (answer.ok && body.status === "ready" && body.cert && body.key && body.host) {
+            return { cert: body.cert, key: body.key, expiresAt: body.expiresAt ?? 0, host: body.host };
+        }
+        if (answer.status === 202 || body.status === "issuing") {
+            if (!announced) {
+                announced = true;
+                const host = body.host ?? "your handle";
+                say(`Getting a certificate for ${host}… the first one takes a couple of minutes.`);
+            }
+            if (waited >= waitMs) {
+                say(`nixamp: ${site} is still issuing the certificate; serving http until it is ready.`);
+                return null;
+            }
+            await sleep(everyMs);
+            waited += everyMs;
+            continue;
+        }
+        say(`nixamp: ${site} could not issue a certificate: ${body.error ?? `answered ${answer.status}`}`);
+        return null;
+    }
+}
+/** `*.chovy.nixamp.com` becomes `chovy.nixamp.com`, which is a filename. */
+function fileStem(host) {
+    return host.replace(/^\*\./, "").replace(/[^A-Za-z0-9.-]/g, "_");
+}
+/**
+ * Keep a certificate beside the keys. Private, because the key is what lets
+ * anybody be this server.
+ */
+export function writeCertFiles(stateDir, files) {
+    const dir = join(stateDir, "tls");
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    chmodSync(dir, 0o700);
+    const stem = join(dir, fileStem(files.host));
+    const cert = `${stem}.cert.pem`;
+    const key = `${stem}.key.pem`;
+    writeFileSync(cert, files.cert, { mode: 0o600 });
+    writeFileSync(key, files.key, { mode: 0o600 });
+    chmodSync(cert, 0o600);
+    chmodSync(key, 0o600);
+    writeFileSync(`${stem}.json`, JSON.stringify({ host: files.host, expiresAt: files.expiresAt }), { mode: 0o600 });
+    return { cert, key };
+}
+/**
+ * The certificate from last time, if it is still good for more than a day.
+ * Anything closer to expiry is treated as absent so the next start fetches
+ * a fresh one rather than serving one that lapses overnight.
+ */
+export function readCertFiles(stateDir, host) {
+    const stem = join(stateDir, "tls", fileStem(host));
+    try {
+        const meta = JSON.parse(readFileSync(`${stem}.json`, "utf8"));
+        const expiresAt = typeof meta.expiresAt === "number" ? meta.expiresAt : 0;
+        if (expiresAt - Date.now() < TOO_CLOSE_MS)
+            return null;
+        const cert = readFileSync(`${stem}.cert.pem`, "utf8");
+        const key = readFileSync(`${stem}.key.pem`, "utf8");
+        if (!cert || !key)
+            return null;
+        return { cert, key, expiresAt };
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * What this machine calls itself in DNS: the name it was given, else the
+ * first label of its hostname, made safe for a subdomain.
+ */
+export function labelFor(name, hostname) {
+    for (const candidate of [name, hostname.split(".")[0] ?? ""]) {
+        const label = candidate
+            .toLowerCase()
+            .replace(/[^a-z0-9-]+/g, "-")
+            .replace(/^-+|-+$/g, "")
+            .slice(0, 30)
+            .replace(/-+$/g, "");
+        if (label.length >= 2)
+            return label;
+    }
+    return "server";
+}

package/dist/owner.js

@@ -102,5 +102,9 @@ export function needsAdmin(path, method = "GET") {
     // Listening to a channel is not: that is what the share link is for.
     if (path.startsWith("/api/channels/") && method !== "GET")
         return true;
+    // Adding, refreshing or removing a catalog is administering; browsing one,
+    // and picking something in it to play, is what the link is for.
+    if (path.startsWith("/api/catalogs") && method !== "GET" && !path.endsWith("/play"))
+        return true;
     return false;
 }

package/dist/publish.d.ts

@@ -21,6 +21,8 @@ export interface PublishTarget {
      */
     tracks: () => number;
     nowPlaying: () => string;
+    /** The admin share link, kept by the directory for the owner alone. */
+    admin?: string;
     /** Whether the player is actually running, so a stopped server is not listed as live. */
     playing?: () => boolean;
     /** The live channels on this server, by name, for the listing to show. */

package/dist/publish.js

@@ -58,6 +58,9 @@ export class Publisher {
                     name: this.target.name,
                     url: this.target.url,
                     ...(this.target.audio ? { audio: this.target.audio } : {}),
+                    // The link that drives this server. The directory keeps it for the
+                    // account that owns the listing and shows it to nobody else.
+                    ...(this.target.admin ? { admin: this.target.admin } : {}),
                     tracks: this.target.tracks(),
                     nowPlaying: this.target.nowPlaying(),
                     ...(this.target.playing ? { playing: this.target.playing() } : {}),

package/dist/server.d.ts

@@ -13,6 +13,10 @@ import { Directory } from "./directory.ts";
 import { PartyLine } from "./partyline.ts";
 import { Follows } from "./follows.ts";
 import { Favorites } from "./favorites.ts";
+import { Catalogs } from "./catalogs.ts";
+import { Names } from "./names.ts";
+import { Certs } from "./certs.ts";
+import { type Throttle } from "@profullstack/throttle";
 import { type Tools, type Track } from "./audio.ts";
 import { type Command, type RemoteTrack, type Snapshot } from "./protocol.ts";
 export declare const SERVE_BAND_COUNT = 24;
@@ -34,6 +38,8 @@ export interface ServeOptions {
     newKey: boolean;
     /** Start without the noise it makes when it wakes up. */
     noJingle: boolean;
+    /** Do not ask nixamp.com for a name and a certificate, even when signed in. */
+    noName: boolean;
     /**
      * Ask the local firewall to let the port through, and put it back on the way
      * out. Off by default because it changes the machine, not just this process.
@@ -337,6 +343,23 @@ export declare class PlayerEngine implements Engine {
  * looking at what is on wants "that album from the web", not every track in
  * it. An entry names where to start, so clicking it plays.
  */
+/**
+ * A fetch-shaped Request for the throttle, built from the Node one.
+ *
+ * @profullstack/throttle is written against the web Request so it runs at an
+ * edge; this server is Node's http. Only what the throttle reads is carried
+ * across: method, URL and headers. The body is not, because metering is
+ * decided before anybody reads it.
+ */
+export declare function requestFor(request: IncomingMessage, origin?: string): Request;
+/** Write a refusal the throttle produced back through the Node response. */
+export declare function answerWith(response: ServerResponse, refused: Response): Promise<void>;
+/**
+ * How many channels a server will start on demand at once. Each is an ffmpeg,
+ * and a catalog has thousands of entries; this is what keeps a room full of
+ * curious people from becoming a room full of decoders.
+ */
+export declare const MAX_ON_DEMAND = 4;
 /**
  * Probe a source and start carrying it as a channel of its own.
  *
@@ -414,6 +437,8 @@ export interface HandlerOptions {
     channels?: Channels;
     /** Write down the channels this server pulls, so a restart puts them back. */
     rememberChannels?: (list: RememberedChannel[]) => void;
+    /** The m3u catalogs this server keeps, browsable by group. */
+    catalogs?: Catalogs;
     /** Live audio going out to RTMP. */
     broadcaster?: Broadcaster;
     /** Where a broadcast should send, and what it should look like. */
@@ -511,6 +536,18 @@ export interface HandlerOptions {
     follows?: Follows;
     /** The servers an account hearted. nixamp.com only, like follows. */
     favorites?: Favorites;
+    /** Names under `<handle>.<zone>` for an account's servers. nixamp.com only. */
+    names?: Names;
+    /** One wildcard certificate per handle, issued and renewed here. nixamp.com only. */
+    certs?: Certs;
+    /** The zone the names live in, e.g. "nixamp.com". */
+    dnsZone?: string;
+    /**
+     * The rate limit over everything, from @profullstack/throttle. Fetch-shaped,
+     * so the handler builds a Request from the Node one and writes back the
+     * Response it is refused with.
+     */
+    throttle?: Throttle;
     /** The VAPID public key a browser needs before it can subscribe. */
     vapidPublicKey?: string;
 }