nixamp 0.7.41 → 0.9.3

package/src/dns.ts

@@ -0,0 +1,207 @@
+/**
+ * The zone: where a server's name is written down.
+ *
+ * nixamp.com hands every signed-in account's servers a name under
+ * `<label>.<handle>.nixamp.com`, and a name is only a name once it resolves.
+ * The records live at Porkbun, behind an API key that stays on nixamp.com:
+ * a server asks nixamp.com for its name, and nixamp.com is the only thing
+ * that ever talks to the registrar. The certificate module needs the same
+ * zone for its `_acme-challenge` TXT records, which is why TXT is here too.
+ *
+ * Behind an interface, because a test wants a zone it can read back without
+ * a network, and a nixamp started without keys still wants the rest of the
+ * code to run.
+ */
+import { isIP } from "node:net";
+
+export type RecordType = "A" | "AAAA" | "TXT";
+
+export interface DnsRecord {
+  id: string;
+  /** The full hostname, e.g. "server2.chovy.nixamp.com". */
+  host: string;
+  type: RecordType;
+  content: string;
+  ttl: number;
+}
+
+export interface DnsZone {
+  /** The apex this zone answers for: "nixamp.com". */
+  readonly zone: string;
+  list(host: string, type: RecordType): Promise<DnsRecord[]>;
+  /** Afterwards exactly one record of that host and type exists, with this content. */
+  set(host: string, type: RecordType, content: string, ttl?: number): Promise<void>;
+  /** One more. An ACME order for a wildcard and its apex wants two TXT at once. */
+  add(host: string, type: RecordType, content: string, ttl?: number): Promise<void>;
+  /** All of host and type, or only those whose content matches. */
+  remove(host: string, type: RecordType, content?: string): Promise<void>;
+}
+
+/** 2026, not 1998: an address is either family, and both are first class. */
+export function isIPv4(value: unknown): boolean {
+  return typeof value === "string" && isIP(value) === 4;
+}
+
+export function isIPv6(value: unknown): boolean {
+  return typeof value === "string" && isIP(value) === 6;
+}
+
+/** Porkbun's floor. Anything lower is silently raised, so it is raised here, loudly. */
+export const MIN_TTL = 600;
+
+function ttlOf(ttl: number | undefined): number {
+  return Math.max(MIN_TTL, Math.floor(ttl ?? MIN_TTL));
+}
+
+/**
+ * A zone kept in memory. For tests, and for a nixamp started without registrar
+ * keys, where a name can be handed out and simply will not resolve -- which the
+ * operator is told about elsewhere, rather than crashing here.
+ */
+export class MemoryZone implements DnsZone {
+  readonly records: DnsRecord[] = [];
+  private sequence = 0;
+
+  constructor(readonly zone: string) {}
+
+  async list(host: string, type: RecordType): Promise<DnsRecord[]> {
+    return this.records.filter((record) => record.host === host && record.type === type);
+  }
+
+  async set(host: string, type: RecordType, content: string, ttl?: number): Promise<void> {
+    await this.remove(host, type);
+    await this.add(host, type, content, ttl);
+  }
+
+  async add(host: string, type: RecordType, content: string, ttl?: number): Promise<void> {
+    this.records.push({ id: String(++this.sequence), host, type, content, ttl: ttlOf(ttl) });
+  }
+
+  async remove(host: string, type: RecordType, content?: string): Promise<void> {
+    for (let i = this.records.length - 1; i >= 0; i--) {
+      const record = this.records[i] as DnsRecord;
+      if (record.host !== host || record.type !== type) continue;
+      if (content !== undefined && record.content !== content) continue;
+      this.records.splice(i, 1);
+    }
+  }
+}
+
+/** How long to wait on the registrar before deciding it is not answering. */
+const PORKBUN_TIMEOUT_MS = 20_000;
+
+interface PorkbunRecord {
+  id?: string | number;
+  name?: string;
+  type?: string;
+  content?: string;
+  ttl?: string | number;
+}
+
+/**
+ * Porkbun's v3 DNS API.
+ *
+ * Every call is a POST carrying both halves of the key in the body -- the
+ * field is `secretapikey`, which the API itself names as the usual mistake --
+ * and the subdomain is the host with the zone taken off: "server2.chovy" for
+ * "server2.chovy.nixamp.com", and nothing at all for the apex.
+ */
+export class Porkbun implements DnsZone {
+  constructor(
+    readonly zone: string,
+    private readonly apiKey: string,
+    private readonly secretApiKey: string,
+    private readonly send: typeof fetch = fetch,
+    private readonly base = "https://api.porkbun.com/api/json/v3",
+  ) {}
+
+  /** The part before the zone, or "" for the zone itself. */
+  private sub(host: string): string {
+    const suffix = `.${this.zone}`;
+    if (host === this.zone) return "";
+    if (!host.endsWith(suffix)) throw new Error(`${host} is not in ${this.zone}`);
+    return host.slice(0, -suffix.length);
+  }
+
+  private async call<T>(path: string, fields: Record<string, unknown> = {}): Promise<T> {
+    let answer: Response;
+    try {
+      answer = await this.send(`${this.base}${path}`, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ apikey: this.apiKey, secretapikey: this.secretApiKey, ...fields }),
+        signal: AbortSignal.timeout(PORKBUN_TIMEOUT_MS),
+      });
+    } catch (error) {
+      throw new Error(`Porkbun did not answer: ${(error as Error).message}`);
+    }
+    let body: { status?: string; message?: string } & T;
+    try {
+      body = (await answer.json()) as typeof body;
+    } catch {
+      throw new Error(`Porkbun answered ${answer.status} with something that is not JSON`);
+    }
+    if (!answer.ok || body.status !== "SUCCESS") {
+      throw new Error(`Porkbun refused: ${body.message ?? `HTTP ${answer.status}`}`);
+    }
+    return body;
+  }
+
+  async list(host: string, type: RecordType): Promise<DnsRecord[]> {
+    // A trailing slash with nothing after it is how the apex is asked for.
+    const body = await this.call<{ records?: PorkbunRecord[] }>(
+      `/dns/retrieveByNameType/${this.zone}/${type}/${this.sub(host)}`,
+    );
+    return (body.records ?? [])
+      .filter((record) => (record.type ?? type) === type)
+      .map((record) => ({
+        id: String(record.id ?? ""),
+        host: record.name ?? host,
+        type,
+        content: record.content ?? "",
+        ttl: Number(record.ttl ?? MIN_TTL) || MIN_TTL,
+      }));
+  }
+
+  async add(host: string, type: RecordType, content: string, ttl?: number): Promise<void> {
+    await this.call(`/dns/create/${this.zone}`, {
+      name: this.sub(host),
+      type,
+      content,
+      ttl: String(ttlOf(ttl)),
+    });
+  }
+
+  async set(host: string, type: RecordType, content: string, ttl?: number): Promise<void> {
+    const existing = await this.list(host, type);
+    const [first, ...extras] = existing;
+    if (first === undefined) {
+      await this.add(host, type, content, ttl);
+      return;
+    }
+    // Edit rather than delete-and-create: the name never has a moment with no
+    // record at all, which for an A record is a moment nobody can connect.
+    // Unless nothing would change: Porkbun refuses an edit that edits nothing
+    // ("We were unable to edit the DNS record"), and a server announcing the
+    // address it already has is the ordinary case, not an error.
+    if (first.content !== content || first.ttl !== ttlOf(ttl)) {
+      await this.call(`/dns/edit/${this.zone}/${first.id}`, {
+        name: this.sub(host),
+        type,
+        content,
+        ttl: String(ttlOf(ttl)),
+      });
+    }
+    for (const extra of extras) {
+      await this.call(`/dns/delete/${this.zone}/${extra.id}`);
+    }
+  }
+
+  async remove(host: string, type: RecordType, content?: string): Promise<void> {
+    const existing = await this.list(host, type);
+    for (const record of existing) {
+      if (content !== undefined && record.content !== content) continue;
+      await this.call(`/dns/delete/${this.zone}/${record.id}`);
+    }
+  }
+}

package/src/library.ts

@@ -0,0 +1,175 @@
+/**
+ * Where the media is.
+ *
+ * A server that is not told serves the directory it was started in, and a
+ * daemon restarted from a home directory served the home directory: every
+ * key, session and download on the machine, listed in a public directory
+ * under a link anybody could be handed. That is not a default anyone chose,
+ * so it is not a default any more.
+ *
+ * The library is a setting. It is asked for once -- at sign-in, or the first
+ * time the daemon is started without being told -- and kept beside the keys,
+ * so `nixamp daemon start` on its own means the same folder every time. And
+ * some folders are refused however they are asked for: the whole filesystem,
+ * the home directory, anything above it, and the hidden folders where keys
+ * and sessions live.
+ */
+import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join, resolve } from "node:path";
+import { createInterface } from "node:readline/promises";
+import { stateDir } from "./daemon.ts";
+
+export interface Config {
+  /** The folder the daemon serves when it is not told which. */
+  library?: string;
+}
+
+export function configPath(): string {
+  return join(stateDir(), "config.json");
+}
+
+export function readConfig(): Config {
+  try {
+    const parsed = JSON.parse(readFileSync(configPath(), "utf8")) as unknown;
+    if (typeof parsed !== "object" || parsed === null) return {};
+    const record = parsed as Record<string, unknown>;
+    return { ...(typeof record["library"] === "string" ? { library: record["library"] } : {}) };
+  } catch {
+    return {};
+  }
+}
+
+export function writeConfig(patch: Partial<Config>): void {
+  const next = { ...readConfig(), ...patch };
+  mkdirSync(stateDir(), { recursive: true });
+  writeFileSync(configPath(), `${JSON.stringify(next, null, 2)}\n`);
+}
+
+/** The saved library, or "" when nobody has said yet. */
+export function readLibrary(): string {
+  return readConfig().library ?? "";
+}
+
+export function writeLibrary(path: string): void {
+  writeConfig({ library: resolve(path) });
+}
+
+/**
+ * Why a folder must not be served, or "" when it may be.
+ *
+ * Judged on the resolved path, so `~/..` and `/home/me/./` do not slip past.
+ * A hidden folder inside home is refused because that is where `.ssh`,
+ * `.config` and nixamp's own keys are; a hidden folder elsewhere is somebody's
+ * deliberate choice.
+ */
+export function forbiddenLibrary(path: string, home = homedir()): string {
+  const full = resolve(path);
+  const house = resolve(home);
+  if (full === "/" || /^[A-Za-z]:\\?$/.test(full)) return "the whole filesystem";
+  if (full === house) return "your whole home directory";
+  if (house.startsWith(`${full}/`)) return "a folder above your home directory";
+  if (full.startsWith(`${house}/`)) {
+    // Any dotted segment on the way, not only the last: ~/.local/state is
+    // where nixamp's own keys are, and its basename says nothing.
+    const hidden = full.slice(house.length + 1).split("/").find((segment) => segment.startsWith("."));
+    if (hidden) return `a hidden folder (${hidden}), which is where keys and sessions live`;
+  }
+  return "";
+}
+
+/** Folders a person is likely to mean, in the order they are likely to mean them. */
+export function suggestedLibraries(home = homedir()): string[] {
+  return ["Music", "Videos", "Movies", "Downloads"]
+    .map((name) => join(home, name))
+    .filter((path) => {
+      try {
+        return statSync(path).isDirectory();
+      } catch {
+        return false;
+      }
+    });
+}
+
+/** One line from the terminal. Split out so the question can be tested. */
+export async function askLine(question: string): Promise<string> {
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  try {
+    return (await rl.question(question)).trim();
+  } finally {
+    rl.close();
+  }
+}
+
+/**
+ * Ask where the media is, refusing the answers that must be refused, and
+ * keep the answer. Empty when the person gave up or gave nothing usable
+ * three times.
+ */
+export async function askLibrary(
+  ask: (question: string) => Promise<string> = askLine,
+  home = homedir(),
+  say: (line: string) => void = (line) => console.log(line),
+): Promise<string> {
+  const suggestions = suggestedLibraries(home);
+  say("Where is your media? nixamp serves one folder and nothing outside it.");
+  for (const path of suggestions) say(`  ${path}`);
+  const fallback = suggestions[0] ?? "";
+  for (let attempt = 0; attempt < 3; attempt += 1) {
+    const typed = await ask(fallback ? `Folder [${fallback}]: ` : "Folder: ");
+    const chosen = (typed || fallback).replace(/^~(?=$|\/)/, home);
+    if (!chosen) continue;
+    const full = resolve(chosen);
+    const why = forbiddenLibrary(full, home);
+    if (why) {
+      say(`  nixamp will not serve ${why}. Pick a folder with your media in it.`);
+      continue;
+    }
+    if (!existsSync(full) || !statSync(full).isDirectory()) {
+      say(`  ${full} is not a folder here.`);
+      continue;
+    }
+    writeLibrary(full);
+    say(`  Serving ${full}. Change it any time with \`nixamp library <folder>\`.`);
+    return full;
+  }
+  return "";
+}
+
+/**
+ * The library to use: the saved one, or -- when there is somebody to ask --
+ * the one they name now. "" when there is neither.
+ */
+export async function chooseLibrary(interactive: boolean, ask?: (question: string) => Promise<string>): Promise<string> {
+  const saved = readLibrary();
+  if (saved) return saved;
+  if (!interactive) return "";
+  return askLibrary(ask);
+}
+
+/** `nixamp library [folder]`: say where the media is, or set it. */
+export async function libraryCommand(argv: string[]): Promise<number> {
+  const [given] = argv;
+  if (!given) {
+    const saved = readLibrary();
+    if (!saved) {
+      console.log("nixamp: no library set. `nixamp library ~/Music` sets it, and `nixamp daemon start` serves it.");
+      return 1;
+    }
+    console.log(saved);
+    return 0;
+  }
+  const full = resolve(given.replace(/^~(?=$|\/)/, homedir()));
+  const why = forbiddenLibrary(full);
+  if (why) {
+    console.error(`nixamp: will not serve ${why}. Pick a folder with your media in it.`);
+    return 64;
+  }
+  if (!existsSync(full) || !statSync(full).isDirectory()) {
+    console.error(`nixamp: ${full} is not a folder here.`);
+    return 66;
+  }
+  writeLibrary(full);
+  console.log(`nixamp will serve ${full}. Start it with \`nixamp daemon start\`.`);
+  return 0;
+}

package/src/main.ts

@@ -77,6 +77,8 @@ const HELP = `nixamp — it really whips the terminal's ass.
   nixamp login [--with github]  sign in to nixamp.com, in a browser or here
   nixamp logout / whoami        forget it, or check it
   nixamp token create|list|revoke  tokens for a machine that cannot sign in
+  nixamp dns [set|rm]           names under your handle, for your servers
+  nixamp library [folder]       where the media is; the daemon serves this and nothing outside it
   nixamp server list|add|remove  the machines you run, kept against your account
   nixamp opendir list|add|remove  folders found on the web, published for everyone
   nixamp update [version]        re-run the installer, keeping your choices
@@ -190,6 +192,18 @@ NIXAMP_TOKEN in the environment is a signed-in nixamp with no login at all.
 A token is shown once because the server keeps only its hash. Put it in the
 environment as NIXAMP_TOKEN, or keep it here with \`nixamp login --token\`.
 Signing out does not touch it: that is what it is for.
+`,
+  dns: `nixamp dns — names under your handle, for your servers.
+
+  nixamp dns                     every name on your account, and where it points
+  nixamp dns set NAME            NAME.<handle>.nixamp.com, pointed at this machine
+  nixamp dns set NAME --a IP --aaaa IP   pointed somewhere you name; "off" clears one
+  nixamp dns set NAME --ttl N    how long resolvers may keep it (seconds)
+  nixamp dns rm NAME             take the name away
+
+The DNS keys stay on nixamp.com. A signed-in \`nixamp serve\` names itself
+this way on start and picks up the handle's certificate, so a server is
+https://NAME.<handle>.nixamp.com with nothing typed here.
 `,
   daemon: `nixamp daemon — a nixamp that outlives the terminal that started it.
 
@@ -250,9 +264,44 @@ async function runDaemon(argv: string[]): Promise<number> {
   const [action = "status", ...rest] = argv;
   const entry = fileURLToPath(new URL("./main.js", import.meta.url));
 
+  // The daemon has to know where the media is. Told a folder, that folder is
+  // kept as the library so the next start needs no telling; told nothing, the
+  // saved library is used, or asked for when there is somebody to ask.
+  const withLibrary = async (args: string[]): Promise<string[] | null> => {
+    const { forbiddenLibrary, chooseLibrary, writeLibrary } = await import("./library.ts");
+    const { parseServeArgs } = await import("./server.ts");
+    const { isRemote } = await import("./sources.ts");
+    let given = "";
+    try {
+      given = parseServeArgs(args).root;
+    } catch {
+      // A bad flag is the daemon's to report, in its own words.
+      return args;
+    }
+    if (given) {
+      if (!isRemote(given)) {
+        const why = forbiddenLibrary(given);
+        if (why) {
+          console.error(`nixamp: will not serve ${why}. Pick a folder with your media in it.`);
+          return null;
+        }
+        writeLibrary(given);
+      }
+      return args;
+    }
+    const library = await chooseLibrary(process.stdin.isTTY === true);
+    if (!library) {
+      console.error("nixamp: which folder? `nixamp library ~/Music` once, then `nixamp daemon start`.");
+      return null;
+    }
+    return [library, ...args];
+  };
+
   if (action === "start") {
+    const args = await withLibrary(rest);
+    if (args === null) return 64;
     try {
-      const state = await d.start(rest, entry);
+      const state = await d.start(args, entry);
       for (const line of d.daemonLines(state)) console.log(line);
       return 0;
     } catch (error) {
@@ -268,8 +317,12 @@ async function runDaemon(argv: string[]): Promise<number> {
   }
 
   if (action === "restart") {
+    // With no arguments the flags it was started with are replayed, library
+    // included; with arguments, the library rule applies as for start.
+    const args = rest.length === 0 ? rest : await withLibrary(rest);
+    if (args === null) return 64;
     try {
-      const state = await d.restart(rest, entry);
+      const state = await d.restart(args, entry);
       for (const line of d.daemonLines(state)) console.log(line);
       return 0;
     } catch (error) {
@@ -331,7 +384,13 @@ export async function main(): Promise<void> {
 
   if (first === "serve") {
     const { serve } = await import("./server.ts");
-    await serve(rest, version());
+    try {
+      await serve(rest, version());
+    } catch (error) {
+      // A refusal is a sentence, not a stack trace.
+      console.error((error as Error).message);
+      process.exitCode = 64;
+    }
     return;
   }
   if (first === "daemon") {
@@ -346,6 +405,13 @@ export async function main(): Promise<void> {
   if (first === "login" || first === "signup") {
     const { login } = await import("./session.ts");
     process.exitCode = await login(first === "signup" ? [...rest, "--signup"] : rest);
+    // Signed in is the moment a machine is about to be a server, so it is
+    // the moment to ask where the media is -- once, kept beside the keys.
+    if (process.exitCode === 0 && process.stdin.isTTY) {
+      const { chooseLibrary } = await import("./library.ts");
+      const library = await chooseLibrary(true);
+      if (library) console.log("  Start serving it with `nixamp daemon start`.");
+    }
     return;
   }
   if (first === "opendir" || first === "opendirs") {
@@ -363,6 +429,16 @@ export async function main(): Promise<void> {
     process.exitCode = await tokens(rest);
     return;
   }
+  if (first === "dns") {
+    const { dns } = await import("./session.ts");
+    process.exitCode = await dns(rest);
+    return;
+  }
+  if (first === "library") {
+    const { libraryCommand } = await import("./library.ts");
+    process.exitCode = await libraryCommand(rest);
+    return;
+  }
   if (first === "logout" || first === "whoami") {
     const session = await import("./session.ts");
     process.exitCode = first === "logout" ? session.logout() : await session.whoami();
@@ -377,8 +453,16 @@ export async function main(): Promise<void> {
 
   // resolve() would turn https://host/x into /cwd/https:/host/x, so a URL is
   // left exactly as it was typed.
-  const asked = first ?? ".";
+  // The saved library before the current directory, and never a folder the
+  // server would refuse: `d` hands this same folder to a daemon.
+  const { forbiddenLibrary, readLibrary } = await import("./library.ts");
+  const asked = first ?? (readLibrary() || ".");
   const target = isRemote(asked) ? asked : resolve(asked);
+  const why = isRemote(target) ? "" : forbiddenLibrary(target);
+  if (why) {
+    console.error(`nixamp: will not play ${why}. Pick a folder with your media in it, or set one: nixamp library ~/Music`);
+    process.exit(64);
+  }
   const tools = detectTools();
   // The noise it makes when it wakes up. Started before the library is walked
   // so it plays over the wait rather than after it, and never awaited: a