nixamp 0.7.41 → 0.9.3

package/src/names.ts

@@ -0,0 +1,239 @@
+/**
+ * An account's names: the servers it runs, each with a hostname under its handle.
+ *
+ * `server2.chovy.nixamp.com` used to be a record somebody typed into the
+ * registrar by hand, which is why the second machine came up as a bare IP
+ * over http. A name is now a row against the account, mirrored into the zone
+ * as an A and an AAAA record, and the account may make, change and drop as
+ * many as it reasonably needs without anybody holding a registrar key.
+ *
+ * The database row is the truth and the zone follows it: the zone is written
+ * first, so a registrar that refuses is an error to the caller and nothing is
+ * stored, rather than a row that claims a name the world cannot resolve.
+ */
+import type { Queryable } from "./follows.ts";
+import { isReserved } from "./handles.ts";
+import { isIPv4, isIPv6, type DnsZone } from "./dns.ts";
+
+export interface NameRecord {
+  label: string;
+  host: string;
+  a: string;
+  aaaa: string;
+  ttl: number;
+  createdAt: number;
+  updatedAt: number;
+}
+
+/** An error with the HTTP status it deserves, so a route can pass it straight on. */
+export class NameError extends Error {
+  constructor(
+    public status: number,
+    message: string,
+  ) {
+    super(message);
+  }
+}
+
+/**
+ * Names nobody may give a server, over and above the handles nobody may take:
+ * the mail and discovery names a client resolves on its own, anything an
+ * underscore marks as a protocol record, and anything punycode-shaped.
+ */
+const RESERVED_LABELS = new Set([
+  "www", "mail", "mx", "smtp", "imap", "pop", "ns1", "ns2", "ftp",
+  "_dmarc", "_acme-challenge", "autoconfig", "autodiscover",
+]);
+
+/**
+ * The label a server may have: two to thirty of [a-z0-9-], not starting or
+ * ending with a hyphen, lowercased for the caller who typed it in capitals.
+ * "" when it is not one, so a route can say so in one sentence.
+ */
+export function validLabel(value: unknown): string {
+  if (typeof value !== "string") return "";
+  const label = value.trim().toLowerCase();
+  if (!/^[a-z0-9][a-z0-9-]{0,28}[a-z0-9]$/.test(label)) return "";
+  if (label.startsWith("_") || label.startsWith("xn--")) return "";
+  if (RESERVED_LABELS.has(label) || isReserved(label)) return "";
+  return label;
+}
+
+const TABLE = "dns_names";
+
+const SCHEMA = `
+  CREATE TABLE IF NOT EXISTS ${TABLE} (
+    account_id  TEXT NOT NULL,
+    handle      TEXT NOT NULL,
+    label       TEXT NOT NULL,
+    a           TEXT NOT NULL DEFAULT '',
+    aaaa        TEXT NOT NULL DEFAULT '',
+    ttl         INTEGER NOT NULL DEFAULT 600,
+    created_at  TIMESTAMPTZ NOT NULL DEFAULT now(),
+    updated_at  TIMESTAMPTZ NOT NULL DEFAULT now(),
+    PRIMARY KEY (handle, label)
+  );
+  CREATE INDEX IF NOT EXISTS ${TABLE}_account ON ${TABLE} (account_id);
+`;
+
+export const MIN_TTL = 600;
+export const MAX_TTL = 86_400;
+/** Enough for a rack, not enough for a squatter. */
+export const DEFAULT_PER_ACCOUNT = 20;
+
+interface Row {
+  account_id: string;
+  handle: string;
+  label: string;
+  a: string;
+  aaaa: string;
+  ttl: number;
+  created_at: unknown;
+  updated_at: unknown;
+}
+
+function when(value: unknown): number {
+  if (value instanceof Date) return value.getTime();
+  const parsed = new Date(String(value ?? 0)).getTime();
+  return Number.isFinite(parsed) ? parsed : 0;
+}
+
+export class Names {
+  private ready: Promise<void> | null = null;
+
+  constructor(
+    private readonly db: Queryable,
+    private readonly dns: DnsZone,
+    private readonly limits: { perAccount?: number } = {},
+  ) {}
+
+  private async ensure(): Promise<void> {
+    this.ready ??= this.db.query(SCHEMA).then(() => undefined);
+    await this.ready;
+  }
+
+  private host(handle: string, label: string): string {
+    return `${label}.${handle}.${this.dns.zone}`;
+  }
+
+  private record(handle: string, row: Row): NameRecord {
+    return {
+      label: row.label,
+      host: this.host(handle, row.label),
+      a: row.a ?? "",
+      aaaa: row.aaaa ?? "",
+      ttl: Number(row.ttl) || MIN_TTL,
+      createdAt: when(row.created_at),
+      updatedAt: when(row.updated_at),
+    };
+  }
+
+  async list(accountId: string, handle: string): Promise<NameRecord[]> {
+    await this.ensure();
+    const { rows } = await this.db.query(
+      `SELECT account_id, handle, label, a, aaaa, ttl, created_at, updated_at
+       FROM ${TABLE} WHERE account_id = $1 AND handle = $2 ORDER BY created_at`,
+      [accountId, handle],
+    );
+    return (rows as unknown as Row[]).map((row) => this.record(handle, row));
+  }
+
+  /** The row for one name, whoever owns it. */
+  private async find(handle: string, label: string): Promise<Row | null> {
+    const { rows } = await this.db.query(
+      `SELECT account_id, handle, label, a, aaaa, ttl, created_at, updated_at
+       FROM ${TABLE} WHERE handle = $1 AND label = $2`,
+      [handle, label],
+    );
+    return (rows[0] as unknown as Row | undefined) ?? null;
+  }
+
+  /**
+   * Make or change a name. `null` for a family takes that record away,
+   * `undefined` leaves it as it was, so a server that has only ever had an
+   * IPv4 address can be given an IPv6 one without restating the first.
+   */
+  async set(
+    accountId: string,
+    handle: string,
+    wanted: unknown,
+    want: { a?: string | null; aaaa?: string | null; ttl?: number },
+  ): Promise<NameRecord> {
+    const label = validLabel(wanted);
+    if (label === "") throw new NameError(400, "that is not a name a server can have");
+    if (want.a !== undefined && want.a !== null && !isIPv4(want.a)) {
+      throw new NameError(400, "that is not an IPv4 address");
+    }
+    if (want.aaaa !== undefined && want.aaaa !== null && !isIPv6(want.aaaa)) {
+      throw new NameError(400, "that is not an IPv6 address");
+    }
+    await this.ensure();
+
+    const existing = await this.find(handle, label);
+    if (existing !== null && existing.account_id !== accountId) {
+      throw new NameError(409, "that name belongs to somebody else");
+    }
+    if (existing === null) {
+      const { rows } = await this.db.query(
+        `SELECT count(*)::int AS n FROM ${TABLE} WHERE account_id = $1`,
+        [accountId],
+      );
+      const have = Number((rows[0] as { n?: unknown } | undefined)?.n ?? 0);
+      const limit = this.limits.perAccount ?? DEFAULT_PER_ACCOUNT;
+      if (have >= limit) throw new NameError(422, `an account may have ${limit} names, and this one has ${have}`);
+    }
+
+    // What the name will point at once this is done.
+    const a = want.a === undefined ? (existing?.a ?? "") : (want.a ?? "");
+    const aaaa = want.aaaa === undefined ? (existing?.aaaa ?? "") : (want.aaaa ?? "");
+    if (a === "" && aaaa === "") throw new NameError(400, "give an address");
+    const ttl = Math.min(MAX_TTL, Math.max(MIN_TTL, Math.floor(want.ttl ?? existing?.ttl ?? MIN_TTL)));
+
+    // The zone first. A registrar that says no is the caller's problem to hear
+    // about now, not a row that claims a name the world cannot resolve.
+    const host = this.host(handle, label);
+    try {
+      if (a !== "") await this.dns.set(host, "A", a, ttl);
+      else if (existing !== null && existing.a !== "") await this.dns.remove(host, "A");
+      if (aaaa !== "") await this.dns.set(host, "AAAA", aaaa, ttl);
+      else if (existing !== null && existing.aaaa !== "") await this.dns.remove(host, "AAAA");
+    } catch (error) {
+      throw new NameError(502, `the zone did not take that record: ${(error as Error).message}`);
+    }
+
+    const { rows } = await this.db.query(
+      `INSERT INTO ${TABLE} (account_id, handle, label, a, aaaa, ttl)
+       VALUES ($1, $2, $3, $4, $5, $6)
+       ON CONFLICT (handle, label) DO UPDATE
+         SET a = EXCLUDED.a, aaaa = EXCLUDED.aaaa, ttl = EXCLUDED.ttl, updated_at = now()
+       RETURNING account_id, handle, label, a, aaaa, ttl, created_at, updated_at`,
+      [accountId, handle, label, a, aaaa, ttl],
+    );
+    const row = rows[0] as unknown as Row | undefined;
+    return this.record(handle, row ?? {
+      account_id: accountId, handle, label, a, aaaa, ttl,
+      created_at: existing?.created_at ?? new Date(), updated_at: new Date(),
+    });
+  }
+
+  /** Take a name away. False when it is not this account's to take. */
+  async remove(accountId: string, handle: string, wanted: unknown): Promise<boolean> {
+    const label = validLabel(wanted);
+    if (label === "") return false;
+    await this.ensure();
+    const existing = await this.find(handle, label);
+    if (existing === null || existing.account_id !== accountId) return false;
+
+    const host = this.host(handle, label);
+    try {
+      await this.dns.remove(host, "A");
+      await this.dns.remove(host, "AAAA");
+    } catch (error) {
+      throw new NameError(502, `the zone did not let go of that record: ${(error as Error).message}`);
+    }
+    await this.db.query(`DELETE FROM ${TABLE} WHERE account_id = $1 AND handle = $2 AND label = $3`, [
+      accountId, handle, label,
+    ]);
+    return true;
+  }
+}

package/src/naming.ts

@@ -0,0 +1,197 @@
+/**
+ * A name and a certificate for this machine, from nixamp.com.
+ *
+ * The DNS keys never leave nixamp.com: a server signed in to an account asks
+ * for `<label>.<handle>.nixamp.com` and the site makes the record for the
+ * address the request came from, A and AAAA both. The certificate is one
+ * wildcard per handle, issued and renewed by the site, handed to the account's
+ * own servers over the authenticated API and kept on disk here so a restart
+ * serves https at once rather than after a round trip.
+ */
+import { chmodSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+
+export interface Named {
+  host: string;
+  a: string;
+  aaaa: string;
+}
+
+export interface CertFiles {
+  cert: string;
+  key: string;
+  expiresAt: number;
+  /** The name on the certificate, e.g. `*.chovy.nixamp.com`. */
+  host: string;
+}
+
+/** A certificate this close to expiry is not worth serving: fetch a fresh one. */
+const TOO_CLOSE_MS = 24 * 60 * 60 * 1000;
+
+function bearer(token: string): Record<string, string> {
+  return { authorization: `Bearer ${token}`, "content-type": "application/json" };
+}
+
+/**
+ * Claim, or refresh, this machine's name.
+ *
+ * "auto" for both families: the site records whichever addresses this request
+ * arrived from, which is the only honest answer to "what is my public
+ * address" from behind a router. Null when refused or unreachable, and the
+ * reason is said rather than thrown: a server without a name still serves.
+ */
+export async function claimName(
+  site: string,
+  token: string,
+  label: string,
+  say: (line: string) => void,
+  fetcher: typeof fetch = fetch,
+): Promise<Named | null> {
+  try {
+    const answer = await fetcher(`${site}/api/v1/dns/${encodeURIComponent(label)}`, {
+      method: "PUT",
+      headers: bearer(token),
+      body: JSON.stringify({ a: "auto", aaaa: "auto" }),
+    });
+    const body = (await answer.json().catch(() => ({}))) as {
+      name?: { host?: string; a?: string | null; aaaa?: string | null };
+      error?: string;
+    };
+    if (!answer.ok || !body.name?.host) {
+      say(`nixamp: ${site} would not name this machine: ${body.error ?? `answered ${answer.status}`}`);
+      return null;
+    }
+    return { host: body.name.host, a: body.name.a ?? "", aaaa: body.name.aaaa ?? "" };
+  } catch (error) {
+    say(`nixamp: could not reach ${site} to claim a name: ${(error as Error).message}`);
+    return null;
+  }
+}
+
+/**
+ * The handle's certificate.
+ *
+ * The first one is issued while we wait: a wildcard by DNS challenge takes a
+ * couple of minutes, which is said once so the pause reads as work rather
+ * than a hang. After that it is a cached answer on the site's side.
+ */
+export async function fetchCert(
+  site: string,
+  token: string,
+  opts: {
+    waitMs?: number;
+    everyMs?: number;
+    sleep?: (ms: number) => Promise<void>;
+    fetcher?: typeof fetch;
+  },
+  say: (line: string) => void,
+): Promise<CertFiles | null> {
+  const waitMs = opts.waitMs ?? 240_000;
+  const everyMs = opts.everyMs ?? 10_000;
+  const sleep = opts.sleep ?? ((ms: number) => new Promise<void>((done) => setTimeout(done, ms)));
+  const fetcher = opts.fetcher ?? fetch;
+  let waited = 0;
+  let announced = false;
+
+  for (;;) {
+    let answer: Response;
+    try {
+      answer = await fetcher(`${site}/api/v1/certs`, { headers: bearer(token) });
+    } catch (error) {
+      say(`nixamp: could not reach ${site} for a certificate: ${(error as Error).message}`);
+      return null;
+    }
+    const body = (await answer.json().catch(() => ({}))) as {
+      status?: string;
+      cert?: string;
+      key?: string;
+      expiresAt?: number;
+      host?: string;
+      error?: string;
+    };
+
+    if (answer.ok && body.status === "ready" && body.cert && body.key && body.host) {
+      return { cert: body.cert, key: body.key, expiresAt: body.expiresAt ?? 0, host: body.host };
+    }
+    if (answer.status === 202 || body.status === "issuing") {
+      if (!announced) {
+        announced = true;
+        const host = body.host ?? "your handle";
+        say(`Getting a certificate for ${host}… the first one takes a couple of minutes.`);
+      }
+      if (waited >= waitMs) {
+        say(`nixamp: ${site} is still issuing the certificate; serving http until it is ready.`);
+        return null;
+      }
+      await sleep(everyMs);
+      waited += everyMs;
+      continue;
+    }
+    say(`nixamp: ${site} could not issue a certificate: ${body.error ?? `answered ${answer.status}`}`);
+    return null;
+  }
+}
+
+/** `*.chovy.nixamp.com` becomes `chovy.nixamp.com`, which is a filename. */
+function fileStem(host: string): string {
+  return host.replace(/^\*\./, "").replace(/[^A-Za-z0-9.-]/g, "_");
+}
+
+/**
+ * Keep a certificate beside the keys. Private, because the key is what lets
+ * anybody be this server.
+ */
+export function writeCertFiles(stateDir: string, files: CertFiles): { cert: string; key: string } {
+  const dir = join(stateDir, "tls");
+  mkdirSync(dir, { recursive: true, mode: 0o700 });
+  chmodSync(dir, 0o700);
+  const stem = join(dir, fileStem(files.host));
+  const cert = `${stem}.cert.pem`;
+  const key = `${stem}.key.pem`;
+  writeFileSync(cert, files.cert, { mode: 0o600 });
+  writeFileSync(key, files.key, { mode: 0o600 });
+  chmodSync(cert, 0o600);
+  chmodSync(key, 0o600);
+  writeFileSync(`${stem}.json`, JSON.stringify({ host: files.host, expiresAt: files.expiresAt }), { mode: 0o600 });
+  return { cert, key };
+}
+
+/**
+ * The certificate from last time, if it is still good for more than a day.
+ * Anything closer to expiry is treated as absent so the next start fetches
+ * a fresh one rather than serving one that lapses overnight.
+ */
+export function readCertFiles(
+  stateDir: string,
+  host: string,
+): { cert: string; key: string; expiresAt: number } | null {
+  const stem = join(stateDir, "tls", fileStem(host));
+  try {
+    const meta = JSON.parse(readFileSync(`${stem}.json`, "utf8")) as { expiresAt?: number };
+    const expiresAt = typeof meta.expiresAt === "number" ? meta.expiresAt : 0;
+    if (expiresAt - Date.now() < TOO_CLOSE_MS) return null;
+    const cert = readFileSync(`${stem}.cert.pem`, "utf8");
+    const key = readFileSync(`${stem}.key.pem`, "utf8");
+    if (!cert || !key) return null;
+    return { cert, key, expiresAt };
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * What this machine calls itself in DNS: the name it was given, else the
+ * first label of its hostname, made safe for a subdomain.
+ */
+export function labelFor(name: string, hostname: string): string {
+  for (const candidate of [name, hostname.split(".")[0] ?? ""]) {
+    const label = candidate
+      .toLowerCase()
+      .replace(/[^a-z0-9-]+/g, "-")
+      .replace(/^-+|-+$/g, "")
+      .slice(0, 30)
+      .replace(/-+$/g, "");
+    if (label.length >= 2) return label;
+  }
+  return "server";
+}

package/src/owner.ts

@@ -119,5 +119,8 @@ export function needsAdmin(path: string, method = "GET"): boolean {
   // Publishing to a channel, or ending one, is administering the server.
   // Listening to a channel is not: that is what the share link is for.
   if (path.startsWith("/api/channels/") && method !== "GET") return true;
+  // Adding, refreshing or removing a catalog is administering; browsing one,
+  // and picking something in it to play, is what the link is for.
+  if (path.startsWith("/api/catalogs") && method !== "GET" && !path.endsWith("/play")) return true;
   return false;
 }

package/src/publish.ts

@@ -30,6 +30,8 @@ export interface PublishTarget {
    */
   tracks: () => number;
   nowPlaying: () => string;
+  /** The admin share link, kept by the directory for the owner alone. */
+  admin?: string;
   /** Whether the player is actually running, so a stopped server is not listed as live. */
   playing?: () => boolean;
   /** The live channels on this server, by name, for the listing to show. */
@@ -103,6 +105,9 @@ export class Publisher {
           name: this.target.name,
           url: this.target.url,
           ...(this.target.audio ? { audio: this.target.audio } : {}),
+          // The link that drives this server. The directory keeps it for the
+          // account that owns the listing and shows it to nobody else.
+          ...(this.target.admin ? { admin: this.target.admin } : {}),
           tracks: this.target.tracks(),
           nowPlaying: this.target.nowPlaying(),
           ...(this.target.playing ? { playing: this.target.playing() } : {}),