statebus 7.0.1 → 7.0.4

package/servers.js

@@ -37,7 +37,7 @@ function set_options (bus, options) {
         }
 }
 
-function import_server (bus, options)
+function import_server (bus, make_statebus, options)
 {   var extra_methods = {
 
     serve: function serve (options) {
@@ -76,23 +76,6 @@ function import_server (bus, options)
         try { bus.http.use(require('compression')())
               console.log('Enabled http compression!') } catch (e) {}
 
-
-        // Initialize new clients with an id.  We put the client id on
-        // req.client, and also in a cookie for the browser to see.
-        if (bus.options.client)
-            bus.express.use(function (req, res, next) {
-                req.client = require('cookie').parse(req.headers.cookie || '').client
-                if (!req.client) {
-                    req.client = (Math.random().toString(36).substring(2)
-                                  + Math.random().toString(36).substring(2)
-                                  + Math.random().toString(36).substring(2))
-            
-                    res.setHeader('Set-Cookie', 'client=' + req.client
-                                  + '; Expires=21 Oct 2025 00:0:00 GMT;')
-                }
-                next()
-            })
-
         // Initialize file sync
         ; (bus.options.sync_files || []).forEach( x => {
             if (require('fs').existsSync(x.fs_path || x.state_path))
@@ -165,27 +148,46 @@ function import_server (bus, options)
             || req.method === 'OPTIONS')
             free_the_cors(req, res)
 
+        // Initialize new clients with an id.  We put the client id on
+        // req.client, and also in a cookie for the browser to see.
+        req.peer = //req.headers.peer ||
+            require('cookie').parse(req.headers.cookie || '').peer
+        if (!req.peer) {
+            req.peer = (Math.random().toString(36).substring(2)
+                        + Math.random().toString(36).substring(2)
+                        + Math.random().toString(36).substring(2))
+
+            res.setHeader('Set-Cookie', 'peer=' + req.peer
+                          + '; Expires=21 Oct 2055 00:0:00 GMT;')
+        }
+
+        // Handle the GET or PUT request!
         if (req.method === 'GET') {
 
             // Make a temporary client bus
             var cbus = bus.bus_for_http_client(req, res)
             var cb
-            function end_it_all () {
+            function end_subscription () {
                 cbus.forget(key, cb)
-                cbus.delete_bus()
                 res.end()
+                cbus.http_unsubscribe(req)
             }
 
             braidify(req, res)
             if (req.subscribe)
-                res.startSubscription({ onClose: end_it_all })
+                res.startSubscription({ onClose: end_subscription })
             else
                 res.statusCode = 200
 
+            // We only return JSON
+            res.setHeader('Content-Type', 'application/json')
+
             // Do the get
             // cbus.honk = 'statelog'
             var key = req.path.substr(1)
+            // console.log('http_in: doing cbus.get(', key, ')')
             cbus.get(key, cb = (o) => {
+                // console.trace('http_in: Sending update of', key)
                 var body = to_http_body(o)
 
                 // If we're braiding, send via subscription
@@ -197,14 +199,11 @@ function import_server (bus, options)
 
                 // And shut down the connection if there's no subscription
                 if (!req.subscribe)
-                    end_it_all()
+                    end_subscription()
             })
         }
 
         else if (req.method === 'PUT') {
-            // Make a temporary client bus
-            var cbus = bus.bus_for_http_client(req, res)
-
             // Maybe the new state is expressed in patches
             if (req.headers.patches) {
                 console.error("We don't actually handle PUT patches yet")
@@ -231,9 +230,14 @@ function import_server (bus, options)
                         res.end()
                         return
                     }
-                    cbus.set(obj)
+
+                    // Make a temporary client bus
+                    var cbus = bus.bus_for_http_client(req, res)
+                    cbus.set(obj)   // And use it
+
                     res.statusCode = 200
                     res.end()
+                    cbus.http_unsubscribe(req)
                 })
             }
         }
@@ -243,16 +247,39 @@ function import_server (bus, options)
 
     bus_for_http_client: function (req, res) {
         var bus = this
-        if (!bus.bus_for_http_client.counter)
+        if (!bus.bus_for_http_client.counter) {
             bus.bus_for_http_client.counter = 0
-        var cbus = require('./statebus')()
+            bus.bus_for_http_client.busses = {}
+        }
+
+        // If this client has a peer ID, and we've got a bus for that peer,
+        // then re-use it!
+        if (req.peer && bus.bus_for_http_client.busses[req.peer]) {
+            var cbus = bus.bus_for_http_client.busses[req.peer]
+            cbus.client_ip = req.connection.remoteAddress
+            cbus.num_subscriptions++
+            return cbus
+        }
+
+        // Otherwise, create a new bus
+        var cbus = make_statebus()
         cbus.label = 'client_http' + bus.bus_for_http_client.counter++
         cbus.master = bus
+        cbus.num_subscriptions = 1
+        cbus.http_unsubscribe = (req) => {
+            cbus.num_subscriptions--
+            if (cbus.num_subscriptions === 0) {
+                // log('Last subscription! Killing client bus!')
+                cbus.delete_bus()
+                delete bus.bus_for_http_client.busses[req.peer]
+            }
+        }
+        bus.bus_for_http_client.busses[req.peer] = cbus
 
-        // Log in as the client
+        // And log into it as the client
         cbus.serves_auth({remoteAddress: req.connection.remoteAddress}, bus)
         bus.options.client(cbus)
-        cbus.set({key: 'current_user', client: req.client})
+        cbus.set({key: 'current_user', val: {client: req.peer}})
         return cbus
     },
 
@@ -355,7 +382,7 @@ function import_server (bus, options)
         // var client_busses = {}  // XXX work in progress
         var log = master.log
         if (client_bus_func) {
-            master.set({key: 'connections'}) // Clean out old sessions
+            master.set({key: 'connections', val: {}}) // Clean out old sessions
             var connections = master.get('connections')
         }
         var s = require('sockjs').createServer({
@@ -373,11 +400,11 @@ function import_server (bus, options)
                 //  - When disconnecting, decrement the number, and if it gets
                 //    to zero, delete the client bus.
 
-                connections[conn.id] = {client: conn.id, // client is deprecated
-                                        id: conn.id}
+                connections.val[conn.id] = {client: conn.id, // client is deprecated
+                                            id: conn.id}
                 master.set(connections)
 
-                var client = require('./statebus')()
+                var client = make_statebus()
                 client.label = 'client' + client_num++
                 master.label = master.label || 'master'
                 client.master = master
@@ -486,7 +513,7 @@ function import_server (bus, options)
                 for (var key in our_gets_in)
                     client.forget(key, sockjs_pubber)
                 if (client_bus_func) {
-                    delete connections[conn.id]; master.set(connections)
+                    delete connections.val[conn.id]; master.set(connections)
                     master.delete('connection/' + conn.id)
                     client.delete_bus()
                 }
@@ -534,12 +561,12 @@ function import_server (bus, options)
                 client('connections').to_set = function noop (t) {t.abort()}
                 client('connections').to_get = function () {
                     var result = []
-                    var conns = master.get('connections')
+                    var conns = master.get('connections').val
                     for (var connid in conns)
                         if (connid !== 'key')
                             result.push(client.get('connection/' + connid))
                     
-                    return {all: result}
+                    return {val: result}
                 }
             }
         })
@@ -555,13 +582,6 @@ function import_server (bus, options)
         WebSocket = require('websocket').w3cwebsocket
         return new WebSocket(url + '/' + bus.options.websocket_path + '/websocket')
     },
-    client_creds: function client_creds (server_url) {
-        // Right now the server just creates a different random id each time
-        // it connects.
-        return {clientid: (Math.random().toString(36).substring(2)
-                           + Math.random().toString(36).substring(2)
-                           + Math.random().toString(36).substring(2))}
-    },
 
     file_store: (function () {
         // Make a database
@@ -1307,23 +1327,24 @@ function import_server (bus, options)
         }
 
         function user_addy (u) {
+            console.error('fix this! not ported to v7 links')
             return u.name + '@' + opts.domain
         }
         function current_addy () {
             var c = client.get('current_user')
-            return c.logged_in ? user_addy(c.user) : 'public'
+            console.error('fix this! not ported to v7 links')
+            return c.val.logged_in ? user_addy(c.val.user) : 'public'
         }
         function is_author (post) {
             var from = post._.from
-            var c = client.get('current_user')
             return from.includes(current_addy())
         }
         function can_see (post) {
-            var c = client.get('current_user')
+            console.error('fix this! not ported to v7')
             var allowed = post._.to.concat(post._.cc).concat(post._.from)
             return allowed.includes(current_addy()) || allowed.includes('public')
         }
-        var drtbus = master//require('./statebus')()
+        var drtbus = master//make_statebus()
         function dirty (key) { drtbus.set({key: 'dirty-'+key, n: Math.random()}) }
         function watch_for_dirt (key) { drtbus.get('dirty-'+key) }
 
@@ -1334,7 +1355,6 @@ function import_server (bus, options)
         // Define state on client
         client('posts*').to_get = (k, rest) => {
             var args = bus.parse(rest.substr(1))
-            var c = client.get('current_user')
             args.for = current_addy()
             var e = master.get('posts_for/' + JSON.stringify(args))
             return {_: master.clone(e._).map(x=>client.get(x.key))}
@@ -1412,7 +1432,7 @@ function import_server (bus, options)
         }
 
         client('friends').to_get = t => {
-            return {_: (master.get('users').all||[])
+            return {_: (master.get('users').val||[])
                     .map(u=>client.get('email/' + user_addy(u)))
                     .concat([client.get('email/public')])
             }
@@ -1640,42 +1660,55 @@ function import_server (bus, options)
 
     serves_auth: function serves_auth (conn, master) {
         var client = this // to keep me straight while programming
-
-        function logout (key) {
+        function logout (user_key) {
             var clients = master.get('logged_in_clients')
-            for (var k in clients)
-                if (k !== 'key')
-                    if (Object.keys(clients[k]).length === 0) {
-                        client.log('Found a deleted user. Removing.', k, clients[k])
-                        delete clients[k]
-                        master.set(clients)
-                    } else if (clients[k].key === key) {
-                        client.log('Logging out!', k, clients[k])
-                        delete clients[k]
-                        master.set(clients)
-                    }
+            clients.val = clients.val || {}
+
+            for (var k in clients.val) {
+                // We used to encounter stray deleted accounts that hadn't
+                // gotten properly garbage collected, and I added some code
+                // here to remove them.
+                //
+                // However, it was a bit kludgy, and I'm rewriting the code
+                // now, and not sure if this problem still occurs.  Will watch
+                // and see.  Meanwhile, I'm commenting the code out.
+                //
+                // if (Object.keys(clients.val[k]).length === 0) {
+                //     client.log('Found a deleted user. Removing.', k, clients.val[k])
+                //     delete clients.val[k]
+                //     master.set(clients)
+                // }
+                if (clients.val[k].link === user_key) {
+                    client.log('Logging out!', k, clients.val[k])
+                    delete clients.val[k]
+                    master.set(clients)
+                }
+            }
         }
 
         // Initialize master
         if (!master.auth_initialized) {
+
+            // A hash for fast lookup of a user's password
             master('users/passwords').to_get = function (k) {
+                // We compute it from the 'users' state
                 master.log('users/passwords.to_get: Computing!')
-                var result = {key: 'users/passwords'}
+                var result = {key: 'users/passwords', val: {}}
                 var users = master.get('users')
-                users.all = users.all || []
-                for (var i=0; i<users.all.length; i++) {
-                    var u = master.get(users.all[i])
-                    if (!(u.login || u.name)) {
-                        console.error('upass: this user has bogus name/login', u.key, u.name, u.login)
+                users.val = users.val || []
+                for (var i=0; i<users.val.length; i++) {
+                    var u = master.get(users.val[i].link)
+                    if (!(u.val.login || u.val.name)) {
+                        console.error('upass: this user has bogus name/login', u.key, u.val.name, u.val.login)
                         continue
                     }
-                    var login = (u.login || u.name).toLowerCase()
+                    var login = (u.val.login || u.val.name).toLowerCase()
                     console.assert(login, 'Missing login for user', u)
-                    if (result.hasOwnProperty(login)) {
+                    if (result.val.hasOwnProperty(login)) {
                         console.error("upass: this user's name is bogus, dude.", u.key)
                         continue
                     }
-                    result[login] = {user: u.key, pass: u.pass}
+                    result.val[login] = {user: u.key, pass: u.val.pass}
                 }
                 return result
             }
@@ -1686,26 +1719,25 @@ function import_server (bus, options)
                 master.log('Deleteinggg!!!', key)
                 // Remove from users.all
                 var users = master.get('users')
-                users.all = users.all.filter(u => u.key && u.key !== key)
+                users.val = users.val.filter(u => u.link && u.link !== key)
                 master.set(users)
 
                 // Log out
                 master.log('Logging out', key)
                 logout(key)
 
-                // Remove connection
-                master.log('Removing connections for', key)
-                var conns = master.get('connections')
-                for (var k in conns) {
-                    console.log('Trying key', k)
-                    if (k !== 'key')
-                        if (conns[k].user && !conns[k].user.key) {
-                            console.log('Cleaning keyless user', conss[k].user)
-                            delete conns[k].user
-                            master.set(conns)
-                            continue
-                        }
-                }
+                // // Remove connection
+                // master.log('Removing connections for', key)
+                // var conns = master.get('connections')
+                // for (var k in conns.val) {
+                //     console.log('Trying key', k)
+                //     if (conns.val[k].user && !conns.val[k].user.key) {
+                //         console.log('Cleaning keyless user', conss.val[k].user)
+                //         delete conns.val[k].user
+                //         master.set(conns)
+                //         continue
+                //     }
+                // }
 
                 master.log('Dirtying users/passwords for', key)
                 master.dirty('users/passwords')
@@ -1717,9 +1749,9 @@ function import_server (bus, options)
 
         // Authentication functions
         function authenticate (login, pass) {
-            var userpass = master.get('users/passwords')[login.toLowerCase()]
+            var userpass = master.get('users/passwords').val[login.toLowerCase()]
             master.log('authenticate: we see', {
-                passwords: master.get('users/passwords'),
+                passwords: master.get('users/passwords').val,
                 hash_to_match: userpass && userpass.pass,
                 password_guess: pass
             })
@@ -1730,7 +1762,7 @@ function import_server (bus, options)
 
             // console.log('comparing passwords', pass, userpass.pass)
             if (require('bcrypt-nodejs').compareSync(pass, userpass.pass))
-                return master.get(userpass.user)
+                return userpass.user
         }
         function create_account (params) {
             if (typeof (params.login || params.name) !== 'string')
@@ -1743,7 +1775,7 @@ function import_server (bus, options)
                 throw 'invalid name, login, pass, or email'
 
             var passes = master.get('users/passwords')
-            if (passes.hasOwnProperty(login))
+            if (passes.val.hasOwnProperty(login))
                 throw 'there is already a user with that login or name'
 
             // Hash password
@@ -1763,60 +1795,81 @@ function import_server (bus, options)
                 key = 'user/' + Math.random().toString(36).substring(7,13)
 
             // Make account object
-            var new_account = {key: key,
-                               name: params.name,
-                               login: params.login,
-                               pass: params.pass,
-                               email: params.email }
-            for (var k in new_account) if (!new_account[k]) delete new_account[k]
+            var new_account = {
+                key: key, val: {
+                    name: params.name,
+                    login: params.login,
+                    pass: params.pass,
+                    email: params.email
+                }
+            }
+            for (var k in new_account.val)    // Clean out falsy fields
+                if (!new_account.val[k])
+                    delete new_account.val[k]
             master.set(new_account)
 
             var users = master.get('users')
-            users.all = users.all || []
-            users.all.push(new_account)
-            passes[login] = {user: new_account.key, pass: new_account.pass}
+            users.val = users.val || []
+            users.val.push({link: new_account.key})
+            passes.val[login] = {user: new_account.key, pass: new_account.val.pass}
             master.set(users)
             master.set(passes)
         }
 
         // Current User
         client('current_user').to_get = function (k) {
-            client.log('* getting: current_user')
-            if (!conn.client) return
-            var u = master.get('logged_in_clients')[conn.client]
-            u = u && user_obj(u.key, true)
-            return {user: u || null, logged_in: !!u}
+            if (!conn.client)
+                return {val: {error: 'no client'}}
+
+            var u = (master.get('logged_in_clients').val || {})[conn.client]
+            var result = {val: {user: u || null, logged_in: !!u}}
+            return result
         }
 
         client('current_user').to_set = function (o, t) {
+            var val = o.val
+            if (typeof val !== 'object') {
+                console.error('current_user: set to something not an object:', val)
+                t.abort()
+                return
+            }
             function error (msg) {
+                console.error(msg)
                 client.set.abort(o)
                 var c = client.get('current_user')
-                c.error = msg
+                c.val.error = msg
                 client.set.fire(c)
             }
 
             client.log('* saving: current_user!')
-            if (o.client && !conn.client) {
+            if (val.client && !conn.client) {
                 // Set the client
-                conn.client = o.client
-                client.client_id = o.client
+                //
+                //   Note: Should this code be moved upstream, when creating a
+                //         client bus?
+                conn.client = val.client
+                client.client_id = val.client
                 client.client_ip = conn.remoteAddress
 
-                if (conn.id) {
-                    var connections = master.get('connections')
-                    connections[conn.id].user = master.get('logged_in_clients')[conn.client]
-                    master.set(connections)
-                }
+                // if (conn.id) {
+                //     var connections = master.get('connections')
+                //     var logged_in_user =
+                //         (master.get('logged_in_clients').val || {})[conn.client]
+
+                //     if (logged_in_user) {
+                //         connections.val[conn.id].user = {link: user.link}
+                //         master.set(connections)
+                //     }
+                // }
             }
             else {
-                if (o.create_account) {
+                if (val.create_account) {
                     client.log('current_user: creating account')
                     try {
-                        create_account(o.create_account)
+                        create_account(val.create_account)
                         client.log('Success creating account!')
                         var cu = client.get('current_user')
-                        cu.create_account = null
+                        cu.val.create_account = null
                         client.set.fire(cu)
                     } catch (e) {
                         error('Cannot create that account because ' + e)
@@ -1824,29 +1877,29 @@ function import_server (bus, options)
                     }
                 }
 
-                if (o.login_as && conn.id) {
+                if (val.login_as) {
                     // Then client is trying to log in
-                    client.log('current_user: trying to log in')
-                    var creds = o.login_as
+                    var creds = val.login_as
                     var login = creds.login || creds.name
                     if (login && creds.pass) {
                         // With a username and password
-                        var u = authenticate(login, creds.pass)
+                        var user_key = authenticate(login, creds.pass)
 
-                        client.log('auth said:', u)
-                        if (u) {
+                        client.log('auth said:', user_key)
+                        if (user_key) {
                             // Success!
                             // Associate this user with this session
                             // user.log('Logging the user in!', u)
 
                             var clients     = master.get('logged_in_clients')
-                            var connections = master.get('connections')
+                            // var connections = master.get('connections')
 
-                            clients[conn.client]      = u
-                            connections[conn.id].user = u
+                            clients.val = clients.val || {}
+                            clients.val[conn.client]  = {link: user_key}
+                            // connections.val[conn.id].user = {link: user_key}
 
                             master.set(clients)
-                            master.set(connections)
+                            // master.set(connections)
 
                             client.log('current_user: success logging in!')
                         }
@@ -1861,16 +1914,17 @@ function import_server (bus, options)
                     }
                 }
 
-                else if (o.logout && conn.id) {
+                else if (val.logout) {
                     client.log('current_user: logging out')
                     var clients = master.get('logged_in_clients')
-                    var connections = master.get('connections')
+                    // var connections = master.get('connections')
 
-                    delete clients[conn.client]
-                    connections[conn.id].user = null
+                    clients.val = clients.val || {}
+                    delete clients.val[conn.client]
+                    // connections.val[conn.id].user = null
 
                     master.set(clients)
-                    master.set(connections)
+                    // master.set(connections)
                 }
             }
 
@@ -1888,11 +1942,13 @@ function import_server (bus, options)
             var user_key = o.key.match(/^user\/([^\/]+)/)
             user_key = user_key && ('user/' + user_key[1])
 
-            // Only the current user can touch themself.
-            if (!c.logged_in || c.user.key !== user_key) {
-                client.log('Only the current user can touch themself.',
-                           {logged_in: c.logged_in, as: c.user && c.user.key,
-                            touching: user_key})
+            // Only the current user can touch himself.
+            if (!c.val.logged_in || c.val.user.link !== user_key) {
+                client.log('Only the current user can touch himself.', {
+                    logged_in: c.val.logged_in,
+                    as: c.val.user && c.val.user.link,
+                    touching: user_key
+                })
                 client.set.abort(o)
                 return
             }
@@ -1908,9 +1964,14 @@ function import_server (bus, options)
             console.assert(o.key.match(/^user\/[^\/]+$/))
 
             // Validate types
-            if (!client.validate(o, {key: 'string', '?login': 'string', '?name': 'string',
-                                     '?pass': 'string', '?email': 'string', /*'?pic': 'string',*/
-                                     '*':'*'})) {
+            if (!client.validate(o, {key: 'string',
+                                     val: {
+                                         '?login': 'string',
+                                         '?name': 'string',
+                                         '?pass': 'string',
+                                         '?email': 'string',
+                                         /*'?pic': 'string',*/
+                                         '*':'*'}})) {
                 client.log('This user change fails validation.')
                 client.set.abort(o)
                 return
@@ -1921,7 +1982,7 @@ function import_server (bus, options)
             //  • That resulting login must be unique across all users
 
             // There must be at least a login or a name
-            var login = o.login || o.name
+            var login = o.val.login || o.val.name
             if (!login) {
                 client.log('User must have a login or a name')
                 client.set.abort(o)
@@ -1932,26 +1993,26 @@ function import_server (bus, options)
             var userpass = master.get('users/passwords')
 
             // Validate that the login/name is not changed to something clobberish
-            var old_login = u.login || u.name
+            var old_login = u.val.login || u.val.name
             if (old_login.toLowerCase() !== login.toLowerCase()
                 && userpass.hasOwnProperty(login)) {
                 client.log('The login', login, 'is already taken. Aborting.')
                 client.set.abort(o)         // Abort
 
                 o = client.get(o.key)      // Add error message
-                o.error = 'The login "' + login + '" is already taken'
+                o.val.error = 'The login "' + login + '" is already taken'
                 client.set.fire(o)
 
                 return                       // And exit
             }
 
             // Now we can update login and name
-            u.login = o.login
-            u.name = o.name
+            u.val.login = o.val.login
+            u.val.name = o.val.name
 
             // Hash password
-            o.pass = o.pass && require('bcrypt-nodejs').hashSync(o.pass)
-            u.pass = o.pass || u.pass
+            o.val.pass = o.val.pass && require('bcrypt-nodejs').hashSync(o.val.pass)
+            u.val.pass = o.val.pass || u.val.pass
 
             // // Users can have pictures (remove this soon)
             // // Bug: if user changes name, this picture's url doesn't change.
@@ -1970,24 +2031,24 @@ function import_server (bus, options)
 
             // For anything else, go ahead and add it to the user object
             var protected = {key:1, name:1, /*pic:1,*/ pass:1}
-            for (var k in o)
+            for (var k in o.val)
                 if (!protected.hasOwnProperty(k))
-                    u[k] = o[k]
-            for (var k in u)
-                if (!protected.hasOwnProperty(k) && !o.hasOwnProperty(k))
-                    delete u[k]
+                    u.val[k] = o.val[k]
+            for (var k in u.val)
+                if (!protected.hasOwnProperty(k) && !o.val.hasOwnProperty(k))
+                    delete u.val[k]
 
             master.set(u)
         }
         client('user/*').to_get = function user_getter (k) {
             var c = client.get('current_user')
-            client.log('* getting:', k, 'as', c.user)
+            client.log('* getting:', k, 'as', c.val.user)
 
             // Users have closet space at /user/<name>/*
             if (k.match(closet_space_key)) {
                 var obj_user = k.match(closet_space_key)[1]
                 if (k.match(private_closet_space_key)
-                    && (!c.user || obj_user !== c.user.key)) {
+                    && (!c.val.user || obj_user !== c.val.user.link)) {
                     client.log('hiding private closet data')
                     return {}
                 }
@@ -1996,16 +2057,17 @@ function import_server (bus, options)
             }
 
             // Otherwise return the actual user
-            return user_obj(k, c.logged_in && c.user.key === k)
+            return user_obj(k, c.val.logged_in && c.val.user.link === k)
         }
         client('user/*').to_delete = function () {}
         function user_obj (k, logged_in) {
             var o = master.clone(master.get(k))
             if (k.match(/^user\/([^\/]+)\/private\/(.*)$/))
                 return logged_in ? o : {key: k}
-            
-            delete o.pass
-            if (!logged_in) {delete o.email; delete o.login}
+
+            o.val = o.val || {}
+            delete o.val.pass
+            if (!logged_in) {delete o.val.email; delete o.val.login}
             return o
         }
 
@@ -2024,14 +2086,14 @@ function import_server (bus, options)
         var was_logged_in = undefined
 
         function client_prefix (current_user) {
-            return 'client/' + (current_user.logged_in
-                                 ? current_user.user.key.substr('user/'.length)
+            return 'client/' + (current_user.val.logged_in
+                                 ? current_user.val.user.link.substr('user/'.length)
                                  : client.client_id) + '/'
         }
 
-        function copy_client_to_user(client, user) {
+        function copy_client_to_user(client, user_key) {
             var old_prefix = 'client/' + client.client_id
-            var new_prefix = 'client/' + user.key.substr('user/'.length)
+            var new_prefix = 'client/' + user_key.substr('user/'.length)
 
             var keys = client.master.get('persisted_keys/' + client.client_id)
             if (!keys.val) return
@@ -2077,10 +2139,10 @@ function import_server (bus, options)
         client(_=>{
             var c = client.get('current_user')
             if (client.loading()) return
-            if (was_logged_in == false && c.logged_in)
+            if (was_logged_in == false && c.val.logged_in)
                 // User just logged in!  Let's copy his stuff over
-                copy_client_to_user(client, c.user)
-            was_logged_in = c.logged_in
+                copy_client_to_user(client, c.val.user.link)
+            was_logged_in = c.val.logged_in
         })
 
         client(prefix_to_sync).to_get = function (key) {
@@ -2138,7 +2200,7 @@ function import_server (bus, options)
         }
 
         function client_persisted_keys () {
-            if (client.get('current_user').logged_in) return
+            if (client.get('current_user').val.logged_in) return
             var result = client.master.get('persisted_keys/' + client.client_id)
             if (result && !result.val) result.val = {}
             return result
@@ -2271,7 +2333,7 @@ function import_server (bus, options)
     // Installs a GET handler at route that gets state from a getter function
     // Note: Makes too many textbusses.  Should re-use one.
     http_serve: function http_serve (route, getter) {
-        var textbus = require('./statebus')()
+        var textbus = make_statebus()
         textbus.label = 'textbus'
         var watched = new Set()
         textbus('*').to_get = (filename, old) => {