nixamp 0.8.0 → 0.9.4

package/src/library.ts

@@ -0,0 +1,175 @@
+/**
+ * Where the media is.
+ *
+ * A server that is not told serves the directory it was started in, and a
+ * daemon restarted from a home directory served the home directory: every
+ * key, session and download on the machine, listed in a public directory
+ * under a link anybody could be handed. That is not a default anyone chose,
+ * so it is not a default any more.
+ *
+ * The library is a setting. It is asked for once -- at sign-in, or the first
+ * time the daemon is started without being told -- and kept beside the keys,
+ * so `nixamp daemon start` on its own means the same folder every time. And
+ * some folders are refused however they are asked for: the whole filesystem,
+ * the home directory, anything above it, and the hidden folders where keys
+ * and sessions live.
+ */
+import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join, resolve } from "node:path";
+import { createInterface } from "node:readline/promises";
+import { stateDir } from "./daemon.ts";
+
+export interface Config {
+  /** The folder the daemon serves when it is not told which. */
+  library?: string;
+}
+
+export function configPath(): string {
+  return join(stateDir(), "config.json");
+}
+
+export function readConfig(): Config {
+  try {
+    const parsed = JSON.parse(readFileSync(configPath(), "utf8")) as unknown;
+    if (typeof parsed !== "object" || parsed === null) return {};
+    const record = parsed as Record<string, unknown>;
+    return { ...(typeof record["library"] === "string" ? { library: record["library"] } : {}) };
+  } catch {
+    return {};
+  }
+}
+
+export function writeConfig(patch: Partial<Config>): void {
+  const next = { ...readConfig(), ...patch };
+  mkdirSync(stateDir(), { recursive: true });
+  writeFileSync(configPath(), `${JSON.stringify(next, null, 2)}\n`);
+}
+
+/** The saved library, or "" when nobody has said yet. */
+export function readLibrary(): string {
+  return readConfig().library ?? "";
+}
+
+export function writeLibrary(path: string): void {
+  writeConfig({ library: resolve(path) });
+}
+
+/**
+ * Why a folder must not be served, or "" when it may be.
+ *
+ * Judged on the resolved path, so `~/..` and `/home/me/./` do not slip past.
+ * A hidden folder inside home is refused because that is where `.ssh`,
+ * `.config` and nixamp's own keys are; a hidden folder elsewhere is somebody's
+ * deliberate choice.
+ */
+export function forbiddenLibrary(path: string, home = homedir()): string {
+  const full = resolve(path);
+  const house = resolve(home);
+  if (full === "/" || /^[A-Za-z]:\\?$/.test(full)) return "the whole filesystem";
+  if (full === house) return "your whole home directory";
+  if (house.startsWith(`${full}/`)) return "a folder above your home directory";
+  if (full.startsWith(`${house}/`)) {
+    // Any dotted segment on the way, not only the last: ~/.local/state is
+    // where nixamp's own keys are, and its basename says nothing.
+    const hidden = full.slice(house.length + 1).split("/").find((segment) => segment.startsWith("."));
+    if (hidden) return `a hidden folder (${hidden}), which is where keys and sessions live`;
+  }
+  return "";
+}
+
+/** Folders a person is likely to mean, in the order they are likely to mean them. */
+export function suggestedLibraries(home = homedir()): string[] {
+  return ["Music", "Videos", "Movies", "Downloads"]
+    .map((name) => join(home, name))
+    .filter((path) => {
+      try {
+        return statSync(path).isDirectory();
+      } catch {
+        return false;
+      }
+    });
+}
+
+/** One line from the terminal. Split out so the question can be tested. */
+export async function askLine(question: string): Promise<string> {
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  try {
+    return (await rl.question(question)).trim();
+  } finally {
+    rl.close();
+  }
+}
+
+/**
+ * Ask where the media is, refusing the answers that must be refused, and
+ * keep the answer. Empty when the person gave up or gave nothing usable
+ * three times.
+ */
+export async function askLibrary(
+  ask: (question: string) => Promise<string> = askLine,
+  home = homedir(),
+  say: (line: string) => void = (line) => console.log(line),
+): Promise<string> {
+  const suggestions = suggestedLibraries(home);
+  say("Where is your media? nixamp serves one folder and nothing outside it.");
+  for (const path of suggestions) say(`  ${path}`);
+  const fallback = suggestions[0] ?? "";
+  for (let attempt = 0; attempt < 3; attempt += 1) {
+    const typed = await ask(fallback ? `Folder [${fallback}]: ` : "Folder: ");
+    const chosen = (typed || fallback).replace(/^~(?=$|\/)/, home);
+    if (!chosen) continue;
+    const full = resolve(chosen);
+    const why = forbiddenLibrary(full, home);
+    if (why) {
+      say(`  nixamp will not serve ${why}. Pick a folder with your media in it.`);
+      continue;
+    }
+    if (!existsSync(full) || !statSync(full).isDirectory()) {
+      say(`  ${full} is not a folder here.`);
+      continue;
+    }
+    writeLibrary(full);
+    say(`  Serving ${full}. Change it any time with \`nixamp library <folder>\`.`);
+    return full;
+  }
+  return "";
+}
+
+/**
+ * The library to use: the saved one, or -- when there is somebody to ask --
+ * the one they name now. "" when there is neither.
+ */
+export async function chooseLibrary(interactive: boolean, ask?: (question: string) => Promise<string>): Promise<string> {
+  const saved = readLibrary();
+  if (saved) return saved;
+  if (!interactive) return "";
+  return askLibrary(ask);
+}
+
+/** `nixamp library [folder]`: say where the media is, or set it. */
+export async function libraryCommand(argv: string[]): Promise<number> {
+  const [given] = argv;
+  if (!given) {
+    const saved = readLibrary();
+    if (!saved) {
+      console.log("nixamp: no library set. `nixamp library ~/Music` sets it, and `nixamp daemon start` serves it.");
+      return 1;
+    }
+    console.log(saved);
+    return 0;
+  }
+  const full = resolve(given.replace(/^~(?=$|\/)/, homedir()));
+  const why = forbiddenLibrary(full);
+  if (why) {
+    console.error(`nixamp: will not serve ${why}. Pick a folder with your media in it.`);
+    return 64;
+  }
+  if (!existsSync(full) || !statSync(full).isDirectory()) {
+    console.error(`nixamp: ${full} is not a folder here.`);
+    return 66;
+  }
+  writeLibrary(full);
+  console.log(`nixamp will serve ${full}. Start it with \`nixamp daemon start\`.`);
+  return 0;
+}

package/src/main.ts

@@ -77,6 +77,8 @@ const HELP = `nixamp — it really whips the terminal's ass.
   nixamp login [--with github]  sign in to nixamp.com, in a browser or here
   nixamp logout / whoami        forget it, or check it
   nixamp token create|list|revoke  tokens for a machine that cannot sign in
+  nixamp dns [set|rm]           names under your handle, for your servers
+  nixamp library [folder]       where the media is; the daemon serves this and nothing outside it
   nixamp server list|add|remove  the machines you run, kept against your account
   nixamp opendir list|add|remove  folders found on the web, published for everyone
   nixamp update [version]        re-run the installer, keeping your choices
@@ -190,6 +192,18 @@ NIXAMP_TOKEN in the environment is a signed-in nixamp with no login at all.
 A token is shown once because the server keeps only its hash. Put it in the
 environment as NIXAMP_TOKEN, or keep it here with \`nixamp login --token\`.
 Signing out does not touch it: that is what it is for.
+`,
+  dns: `nixamp dns — names under your handle, for your servers.
+
+  nixamp dns                     every name on your account, and where it points
+  nixamp dns set NAME            NAME.<handle>.nixamp.com, pointed at this machine
+  nixamp dns set NAME --a IP --aaaa IP   pointed somewhere you name; "off" clears one
+  nixamp dns set NAME --ttl N    how long resolvers may keep it (seconds)
+  nixamp dns rm NAME             take the name away
+
+The DNS keys stay on nixamp.com. A signed-in \`nixamp serve\` names itself
+this way on start and picks up the handle's certificate, so a server is
+https://NAME.<handle>.nixamp.com with nothing typed here.
 `,
   daemon: `nixamp daemon — a nixamp that outlives the terminal that started it.
 
@@ -250,9 +264,44 @@ async function runDaemon(argv: string[]): Promise<number> {
   const [action = "status", ...rest] = argv;
   const entry = fileURLToPath(new URL("./main.js", import.meta.url));
 
+  // The daemon has to know where the media is. Told a folder, that folder is
+  // kept as the library so the next start needs no telling; told nothing, the
+  // saved library is used, or asked for when there is somebody to ask.
+  const withLibrary = async (args: string[]): Promise<string[] | null> => {
+    const { forbiddenLibrary, chooseLibrary, writeLibrary } = await import("./library.ts");
+    const { parseServeArgs } = await import("./server.ts");
+    const { isRemote } = await import("./sources.ts");
+    let given = "";
+    try {
+      given = parseServeArgs(args).root;
+    } catch {
+      // A bad flag is the daemon's to report, in its own words.
+      return args;
+    }
+    if (given) {
+      if (!isRemote(given)) {
+        const why = forbiddenLibrary(given);
+        if (why) {
+          console.error(`nixamp: will not serve ${why}. Pick a folder with your media in it.`);
+          return null;
+        }
+        writeLibrary(given);
+      }
+      return args;
+    }
+    const library = await chooseLibrary(process.stdin.isTTY === true);
+    if (!library) {
+      console.error("nixamp: which folder? `nixamp library ~/Music` once, then `nixamp daemon start`.");
+      return null;
+    }
+    return [library, ...args];
+  };
+
   if (action === "start") {
+    const args = await withLibrary(rest);
+    if (args === null) return 64;
     try {
-      const state = await d.start(rest, entry);
+      const state = await d.start(args, entry);
       for (const line of d.daemonLines(state)) console.log(line);
       return 0;
     } catch (error) {
@@ -268,8 +317,12 @@ async function runDaemon(argv: string[]): Promise<number> {
   }
 
   if (action === "restart") {
+    // With no arguments the flags it was started with are replayed, library
+    // included; with arguments, the library rule applies as for start.
+    const args = rest.length === 0 ? rest : await withLibrary(rest);
+    if (args === null) return 64;
     try {
-      const state = await d.restart(rest, entry);
+      const state = await d.restart(args, entry);
       for (const line of d.daemonLines(state)) console.log(line);
       return 0;
     } catch (error) {
@@ -331,7 +384,13 @@ export async function main(): Promise<void> {
 
   if (first === "serve") {
     const { serve } = await import("./server.ts");
-    await serve(rest, version());
+    try {
+      await serve(rest, version());
+    } catch (error) {
+      // A refusal is a sentence, not a stack trace.
+      console.error((error as Error).message);
+      process.exitCode = 64;
+    }
     return;
   }
   if (first === "daemon") {
@@ -346,6 +405,13 @@ export async function main(): Promise<void> {
   if (first === "login" || first === "signup") {
     const { login } = await import("./session.ts");
     process.exitCode = await login(first === "signup" ? [...rest, "--signup"] : rest);
+    // Signed in is the moment a machine is about to be a server, so it is
+    // the moment to ask where the media is -- once, kept beside the keys.
+    if (process.exitCode === 0 && process.stdin.isTTY) {
+      const { chooseLibrary } = await import("./library.ts");
+      const library = await chooseLibrary(true);
+      if (library) console.log("  Start serving it with `nixamp daemon start`.");
+    }
     return;
   }
   if (first === "opendir" || first === "opendirs") {
@@ -363,6 +429,16 @@ export async function main(): Promise<void> {
     process.exitCode = await tokens(rest);
     return;
   }
+  if (first === "dns") {
+    const { dns } = await import("./session.ts");
+    process.exitCode = await dns(rest);
+    return;
+  }
+  if (first === "library") {
+    const { libraryCommand } = await import("./library.ts");
+    process.exitCode = await libraryCommand(rest);
+    return;
+  }
   if (first === "logout" || first === "whoami") {
     const session = await import("./session.ts");
     process.exitCode = first === "logout" ? session.logout() : await session.whoami();
@@ -377,8 +453,16 @@ export async function main(): Promise<void> {
 
   // resolve() would turn https://host/x into /cwd/https:/host/x, so a URL is
   // left exactly as it was typed.
-  const asked = first ?? ".";
+  // The saved library before the current directory, and never a folder the
+  // server would refuse: `d` hands this same folder to a daemon.
+  const { forbiddenLibrary, readLibrary } = await import("./library.ts");
+  const asked = first ?? (readLibrary() || ".");
   const target = isRemote(asked) ? asked : resolve(asked);
+  const why = isRemote(target) ? "" : forbiddenLibrary(target);
+  if (why) {
+    console.error(`nixamp: will not play ${why}. Pick a folder with your media in it, or set one: nixamp library ~/Music`);
+    process.exit(64);
+  }
   const tools = detectTools();
   // The noise it makes when it wakes up. Started before the library is walked
   // so it plays over the wait rather than after it, and never awaited: a

package/src/names.ts

@@ -0,0 +1,239 @@
+/**
+ * An account's names: the servers it runs, each with a hostname under its handle.
+ *
+ * `server2.chovy.nixamp.com` used to be a record somebody typed into the
+ * registrar by hand, which is why the second machine came up as a bare IP
+ * over http. A name is now a row against the account, mirrored into the zone
+ * as an A and an AAAA record, and the account may make, change and drop as
+ * many as it reasonably needs without anybody holding a registrar key.
+ *
+ * The database row is the truth and the zone follows it: the zone is written
+ * first, so a registrar that refuses is an error to the caller and nothing is
+ * stored, rather than a row that claims a name the world cannot resolve.
+ */
+import type { Queryable } from "./follows.ts";
+import { isReserved } from "./handles.ts";
+import { isIPv4, isIPv6, type DnsZone } from "./dns.ts";
+
+export interface NameRecord {
+  label: string;
+  host: string;
+  a: string;
+  aaaa: string;
+  ttl: number;
+  createdAt: number;
+  updatedAt: number;
+}
+
+/** An error with the HTTP status it deserves, so a route can pass it straight on. */
+export class NameError extends Error {
+  constructor(
+    public status: number,
+    message: string,
+  ) {
+    super(message);
+  }
+}
+
+/**
+ * Names nobody may give a server, over and above the handles nobody may take:
+ * the mail and discovery names a client resolves on its own, anything an
+ * underscore marks as a protocol record, and anything punycode-shaped.
+ */
+const RESERVED_LABELS = new Set([
+  "www", "mail", "mx", "smtp", "imap", "pop", "ns1", "ns2", "ftp",
+  "_dmarc", "_acme-challenge", "autoconfig", "autodiscover",
+]);
+
+/**
+ * The label a server may have: two to thirty of [a-z0-9-], not starting or
+ * ending with a hyphen, lowercased for the caller who typed it in capitals.
+ * "" when it is not one, so a route can say so in one sentence.
+ */
+export function validLabel(value: unknown): string {
+  if (typeof value !== "string") return "";
+  const label = value.trim().toLowerCase();
+  if (!/^[a-z0-9][a-z0-9-]{0,28}[a-z0-9]$/.test(label)) return "";
+  if (label.startsWith("_") || label.startsWith("xn--")) return "";
+  if (RESERVED_LABELS.has(label) || isReserved(label)) return "";
+  return label;
+}
+
+const TABLE = "dns_names";
+
+const SCHEMA = `
+  CREATE TABLE IF NOT EXISTS ${TABLE} (
+    account_id  TEXT NOT NULL,
+    handle      TEXT NOT NULL,
+    label       TEXT NOT NULL,
+    a           TEXT NOT NULL DEFAULT '',
+    aaaa        TEXT NOT NULL DEFAULT '',
+    ttl         INTEGER NOT NULL DEFAULT 600,
+    created_at  TIMESTAMPTZ NOT NULL DEFAULT now(),
+    updated_at  TIMESTAMPTZ NOT NULL DEFAULT now(),
+    PRIMARY KEY (handle, label)
+  );
+  CREATE INDEX IF NOT EXISTS ${TABLE}_account ON ${TABLE} (account_id);
+`;
+
+export const MIN_TTL = 600;
+export const MAX_TTL = 86_400;
+/** Enough for a rack, not enough for a squatter. */
+export const DEFAULT_PER_ACCOUNT = 20;
+
+interface Row {
+  account_id: string;
+  handle: string;
+  label: string;
+  a: string;
+  aaaa: string;
+  ttl: number;
+  created_at: unknown;
+  updated_at: unknown;
+}
+
+function when(value: unknown): number {
+  if (value instanceof Date) return value.getTime();
+  const parsed = new Date(String(value ?? 0)).getTime();
+  return Number.isFinite(parsed) ? parsed : 0;
+}
+
+export class Names {
+  private ready: Promise<void> | null = null;
+
+  constructor(
+    private readonly db: Queryable,
+    private readonly dns: DnsZone,
+    private readonly limits: { perAccount?: number } = {},
+  ) {}
+
+  private async ensure(): Promise<void> {
+    this.ready ??= this.db.query(SCHEMA).then(() => undefined);
+    await this.ready;
+  }
+
+  private host(handle: string, label: string): string {
+    return `${label}.${handle}.${this.dns.zone}`;
+  }
+
+  private record(handle: string, row: Row): NameRecord {
+    return {
+      label: row.label,
+      host: this.host(handle, row.label),
+      a: row.a ?? "",
+      aaaa: row.aaaa ?? "",
+      ttl: Number(row.ttl) || MIN_TTL,
+      createdAt: when(row.created_at),
+      updatedAt: when(row.updated_at),
+    };
+  }
+
+  async list(accountId: string, handle: string): Promise<NameRecord[]> {
+    await this.ensure();
+    const { rows } = await this.db.query(
+      `SELECT account_id, handle, label, a, aaaa, ttl, created_at, updated_at
+       FROM ${TABLE} WHERE account_id = $1 AND handle = $2 ORDER BY created_at`,
+      [accountId, handle],
+    );
+    return (rows as unknown as Row[]).map((row) => this.record(handle, row));
+  }
+
+  /** The row for one name, whoever owns it. */
+  private async find(handle: string, label: string): Promise<Row | null> {
+    const { rows } = await this.db.query(
+      `SELECT account_id, handle, label, a, aaaa, ttl, created_at, updated_at
+       FROM ${TABLE} WHERE handle = $1 AND label = $2`,
+      [handle, label],
+    );
+    return (rows[0] as unknown as Row | undefined) ?? null;
+  }
+
+  /**
+   * Make or change a name. `null` for a family takes that record away,
+   * `undefined` leaves it as it was, so a server that has only ever had an
+   * IPv4 address can be given an IPv6 one without restating the first.
+   */
+  async set(
+    accountId: string,
+    handle: string,
+    wanted: unknown,
+    want: { a?: string | null; aaaa?: string | null; ttl?: number },
+  ): Promise<NameRecord> {
+    const label = validLabel(wanted);
+    if (label === "") throw new NameError(400, "that is not a name a server can have");
+    if (want.a !== undefined && want.a !== null && !isIPv4(want.a)) {
+      throw new NameError(400, "that is not an IPv4 address");
+    }
+    if (want.aaaa !== undefined && want.aaaa !== null && !isIPv6(want.aaaa)) {
+      throw new NameError(400, "that is not an IPv6 address");
+    }
+    await this.ensure();
+
+    const existing = await this.find(handle, label);
+    if (existing !== null && existing.account_id !== accountId) {
+      throw new NameError(409, "that name belongs to somebody else");
+    }
+    if (existing === null) {
+      const { rows } = await this.db.query(
+        `SELECT count(*)::int AS n FROM ${TABLE} WHERE account_id = $1`,
+        [accountId],
+      );
+      const have = Number((rows[0] as { n?: unknown } | undefined)?.n ?? 0);
+      const limit = this.limits.perAccount ?? DEFAULT_PER_ACCOUNT;
+      if (have >= limit) throw new NameError(422, `an account may have ${limit} names, and this one has ${have}`);
+    }
+
+    // What the name will point at once this is done.
+    const a = want.a === undefined ? (existing?.a ?? "") : (want.a ?? "");
+    const aaaa = want.aaaa === undefined ? (existing?.aaaa ?? "") : (want.aaaa ?? "");
+    if (a === "" && aaaa === "") throw new NameError(400, "give an address");
+    const ttl = Math.min(MAX_TTL, Math.max(MIN_TTL, Math.floor(want.ttl ?? existing?.ttl ?? MIN_TTL)));
+
+    // The zone first. A registrar that says no is the caller's problem to hear
+    // about now, not a row that claims a name the world cannot resolve.
+    const host = this.host(handle, label);
+    try {
+      if (a !== "") await this.dns.set(host, "A", a, ttl);
+      else if (existing !== null && existing.a !== "") await this.dns.remove(host, "A");
+      if (aaaa !== "") await this.dns.set(host, "AAAA", aaaa, ttl);
+      else if (existing !== null && existing.aaaa !== "") await this.dns.remove(host, "AAAA");
+    } catch (error) {
+      throw new NameError(502, `the zone did not take that record: ${(error as Error).message}`);
+    }
+
+    const { rows } = await this.db.query(
+      `INSERT INTO ${TABLE} (account_id, handle, label, a, aaaa, ttl)
+       VALUES ($1, $2, $3, $4, $5, $6)
+       ON CONFLICT (handle, label) DO UPDATE
+         SET a = EXCLUDED.a, aaaa = EXCLUDED.aaaa, ttl = EXCLUDED.ttl, updated_at = now()
+       RETURNING account_id, handle, label, a, aaaa, ttl, created_at, updated_at`,
+      [accountId, handle, label, a, aaaa, ttl],
+    );
+    const row = rows[0] as unknown as Row | undefined;
+    return this.record(handle, row ?? {
+      account_id: accountId, handle, label, a, aaaa, ttl,
+      created_at: existing?.created_at ?? new Date(), updated_at: new Date(),
+    });
+  }
+
+  /** Take a name away. False when it is not this account's to take. */
+  async remove(accountId: string, handle: string, wanted: unknown): Promise<boolean> {
+    const label = validLabel(wanted);
+    if (label === "") return false;
+    await this.ensure();
+    const existing = await this.find(handle, label);
+    if (existing === null || existing.account_id !== accountId) return false;
+
+    const host = this.host(handle, label);
+    try {
+      await this.dns.remove(host, "A");
+      await this.dns.remove(host, "AAAA");
+    } catch (error) {
+      throw new NameError(502, `the zone did not let go of that record: ${(error as Error).message}`);
+    }
+    await this.db.query(`DELETE FROM ${TABLE} WHERE account_id = $1 AND handle = $2 AND label = $3`, [
+      accountId, handle, label,
+    ]);
+    return true;
+  }
+}