tracker

10.7 KB

1. // project.hl — tracker.worldapi.org: STEP 1 (tracker.worldapi.org#1), an empty shell. Login copied unchanged from
2. // calendar.worldapi.org (rejected once for a centered sign-in and no header selector — architect, 2026-09-27):
3. // ident only, no own passwords (README "How apps use ident" of ident.worldapi.org), the identity selector in the
4. // header (components/main.hl). No shows, no data yet — later steps come from the creator (CONCEPT.md).
5. //
6. // the header's ident-selector / "Log in with ident" -> <ident>/login?key=&return=<this app>/login/callback
7. // /login/callback?ident_code=<code> the app's server exchanges the code for the identity's short id
8. // (POST <ident>/api/exchange) and signs this app's OWN session in
9. // (session.user = { id = <users @id> }, users.hl)
10. // the header's "Log out" button signs this app's session out via the face trackerLogOut (components/main.hl)
11. // — ident's own session, and the browser's ident cookie, are untouched
12. //
13. // Config (env; no committed secret — the first deploy registers this app in ident and sets these, done by the
14. // architect, as with ident's own .env for SMTP):
15. // TRACKER_PORT (45008), TRACKER_URL (this app's own public address, for the return URL),
16. // IDENT_URL (https://ident.worldapi.org), TRACKER_KEY (pk_…), TRACKER_SECRET (sk_…)
17. import WebFramework from 'hl:web'
18. import { Response } from 'hl:http1'
19. import { randomBytes } from 'hl:crypto'
20. import { env } from 'hl:proc'
21. import { readBytes, exists } from 'hl:fs'
22. import { now, timestamp, every } from 'hl:time'
24. import Styles from './styles.hl'
25. import { exchangeCode, ensureUser } from './users.hl'
26. import Home from './components/home.hl'
27. import LoginFailed from './components/loginfailed.hl'
28. import Show from './components/show.hl'
29. import Unwatched from './components/unwatched.hl'
30. import Schedule from './components/schedule.hl'
31. import MyShows from './components/myshows.hl'
32. import { syncEnabled, syncShow, persistSync, emptyTotals, addTotals, totalsLine, msPerRequest } from './tmdbsync.hl'
33. import { allFollowedShowIds } from './follows.hl'
35. static appTitle = "tracker"
37. styles = Styles
39. port = env('TRACKER_PORT') != null ? toNumber(env('TRACKER_PORT')) : 45008
40. watching = env('TRACKER_WATCH') != '0'
41. // read by hl:web's own manifest config (WebFramework.hl `cfg.sessionDir`), not the constructor call below
42. sessionDir = env('TRACKER_SESSIONS') != null ? env('TRACKER_SESSIONS') : null
44. // ---- THE LOGIN BUTTON'S RETURN (ident README "How apps use ident"), copied from calendar.worldapi.org's project.hl
45. // BACK TO THE PAGE: /login.js puts `?next=` into the button's return URL at the click. Only a same-origin PATH
46. // goes (one `/`, URL-safe characters, ≤ 500). Anything else → `/`.
47. nextChars = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._~/?&=%+,;@!$()*:'
48. safePath = (want) => {
49. if (want == null || hlTypeName(want) != 'String' || want == '' || want.length > 500) { return '/' }
50. if (want.slice(0, 1) != '/' || want.slice(0, 2) == '//' || want.slice(0, 7) == '/login/') { return '/' }
51. let i = 0
52. while (i < want.length) {
53. if (!nextChars.includes(want[i])) { return '/' }
54. i = i + 1
55. }
56. return want
57. }
59. // A FAILED LOGIN is a page (components/loginfailed.hl): the reason is parked in the session, then → /login/failed
60. failed = (req, why) => {
61. let s = req.session
62. let fresh = s == null
63. if (fresh) { s = server.sessions.mint() }
64. s.data.loginError = why
65. server.sessions.save(s)
66. let res = new Response('login failed: ' + why, { status = 302 headers = { 'Location' = '/login/failed' 'Cache-Control' = 'no-store' 'Content-Type' = 'text/plain; charset=utf-8' } })
67. if (fresh) { res.headers['Set-Cookie'] = server.sessions.cookieHeader(s.id) }
68. return res
69. }
71. // the function route gets the cookie's session as req.session (hybriel #11); none yet → minted here
72. loginCallback = (route, req) => {
73. if (req.method != 'GET') { return failed(req, 'GET only') }
74. let q = req.query != null ? req.query : {}
75. let code = q.ident_code
76. if (code == null || code == '') { return failed(req, 'ident sent no login code') }
77. let x = exchangeCode(code)
78. if (x.error != null) { return failed(req, x.error) }
79. let u = ensureUser(x.identity)
80. if (u == null) { return failed(req, 'could not store the user') }
81. let s = req.session
82. let fresh = s == null
83. if (fresh) { s = server.sessions.mint() }
84. s.user = { id = u.id }
85. s.data.tag = randomBytes(16)
86. s.data.loginError = null
87. server.sessions.save(s)
88. let res = new Response('logged in', { status = 302 headers = { 'Location' = safePath(q.next) 'Cache-Control' = 'no-store' 'Content-Type' = 'text/plain; charset=utf-8' } })
89. if (fresh) { res.headers['Set-Cookie'] = server.sessions.cookieHeader(s.id) }
90. return res
91. }
93. // ---- /posters/<name> (tracker.worldapi.org#4): a show's poster image, served dynamically from
94. // storage/mpackdb/posters/ (the poster's file name is the show's oldId + its migrated extension,
95. // shows.hl posterName) — falls back to a placeholder svg when the real file isn't there yet (the
96. // mongo export never included the actual poster bytes, see the report's `open`).
97. postersDir = (env('TRACKER_STORAGE') != null ? env('TRACKER_STORAGE') : './storage/mpackdb') + '/posters'
98. placeholderPoster = './assets/poster-placeholder.svg'
99. posterNameChars = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_'
100. isSafePosterName = (name) => {
101. if (name == null || hlTypeName(name) != 'String' || name == '' || name.length > 100) { return false }
102. let i = 0
103. while (i < name.length) {
104. if (!posterNameChars.includes(name[i])) { return false }
105. i = i + 1
106. }
107. return true
108. }
109. endsWithStr = (s, suffix) => { return s.length >= suffix.length && s.slice(s.length - suffix.length) == suffix }
110. mimeOfPoster = (name) => {
111. if (endsWithStr(name, '.png')) { return 'image/png' }
112. if (endsWithStr(name, '.webp')) { return 'image/webp' }
113. if (endsWithStr(name, '.svg')) { return 'image/svg+xml' }
114. return 'image/jpeg'
115. }
116. posterRoute = (route, req) => {
117. let name = route.params != null ? route.params.name : null
118. if (!isSafePosterName(name)) { return new Response('bad poster name', { status = 400 headers = { 'Content-Type' = 'text/plain; charset=utf-8' } }) }
119. let path = postersDir + '/' + name
120. if (exists(path)) { return new Response(readBytes(path), { headers = { 'Content-Type' = mimeOfPoster(name) 'Cache-Control' = 'public, max-age=86400' } }) }
121. return new Response(readBytes(placeholderPoster), { headers = { 'Content-Type' = 'image/svg+xml' 'Cache-Control' = 'public, max-age=3600' } })
122. }
124. // ---- the old addresses of the personal lists (tracker.worldapi.org#8): they all live under /my/ now —
125. // a permanent redirect so old links keep working (architect's decision)
126. movedTo = (path) => { return new Response('moved to ' + path, { status = 301 headers = { 'Location' = path 'Content-Type' = 'text/plain; charset=utf-8' } }) }
127. unwatchedMoved = (route, req) => { return movedTo('/my/unwatched') }
128. scheduleMoved = (route, req) => { return movedTo('/my/schedule') }
130. routes = [
131. { pattern = "/favicon.ico" direct = "" }
132. { pattern = "/login/callback" function = loginCallback }
133. { pattern = "/login/failed" component = LoginFailed }
134. { pattern = "/login.js" file = "./login.js" headers = { 'Cache-Control' = 'no-cache' } }
135. { pattern = "/posters/:name" function = posterRoute }
136. { pattern = "/shows/:slug" component = Show }
137. { pattern = "/my/shows" component = MyShows }
138. { pattern = "/my/unwatched" component = Unwatched }
139. { pattern = "/my/schedule" component = Schedule }
140. { pattern = "/unwatched" function = unwatchedMoved }
141. { pattern = "/schedule" function = scheduleMoved }
142. { pattern = "/" component = Home }
143. ]
145. // WHO GETS THE PUSH: the login state reaches the tabs of one session (components/main.hl trackerSignedIn/Out).
146. tagOf = (session) => { return session != null && session.data != null ? session.data.tag : null }
147. audience = {
148. trackerSignedIn = (tag, session) => { return tag != null && tagOf(session) == tag }
149. trackerSignedOut = (tag, session) => { return tag != null && tagOf(session) == tag }
150. }
152. // cookies are per host, not per port: an own name keeps this app's session apart from
153. // ident's own (and from any other worldapi app sharing a dev host), see ident README "Design
154. // tokens" / hybriel#10 hybriel#17.
155. sessionCookie = 'trackersid'
156. server = new WebFramework(routes = routes, styles = styles, port = port, sessionCookie = sessionCookie, watchMode = watching)
158. // ---- THE DAILY TMDB SYNC (tracker.worldapi.org#9, tmdbsync.hl) --------------------------------------
159. // Once a day at TRACKER_SYNC_HOUR (UTC, default 4 — hl:time has no time zones; the container runs UTC) every
160. // followed show is synced from TMDB. hl:web serves ONE request at a time, so the run never takes the server
161. // for itself: a 1-second clock does ONE show per tick (1–3 TMDB requests + maybe its poster) and returns — the
162. // requests that queued meanwhile are served between two ticks, and a tick never starts inside a page render.
163. // After a show that made n requests the next waits n × 260 ms (TMDB: ≤ 40 requests / 10 s).
164. // TRACKER_SYNC=0 switches it off; without TMDB_READ_TOKEN it is off too (logged once).
165. syncHour = env('TRACKER_SYNC_HOUR') != null ? toNumber(env('TRACKER_SYNC_HOUR')) : 4
166. syncOn = env('TRACKER_SYNC') != '0' && syncEnabled
167. syncQueue = []
168. syncAt = 0
169. syncDay = ''
170. syncNextAt = 0
171. syncTotals = emptyTotals()
172. syncTick = () => {
173. let t = now()
174. if (syncQueue.length == 0) {
175. let stamp = timestamp(t)
176. let day = stamp.slice(0, 10)
177. if (toNumber(stamp.slice(11, 13)) != syncHour || day == syncDay) { return null }
178. syncDay = day
179. syncQueue = allFollowedShowIds()
180. syncAt = t
181. syncNextAt = 0
182. syncTotals = emptyTotals()
183. console.log('tmdb sync: start, ' + syncQueue.length + ' followed shows')
184. return null
185. }
186. if (t < syncNextAt) { return null }
187. let id = syncQueue[0]
188. let rest = []
189. let i = 1
190. while (i < syncQueue.length) { rest.push(syncQueue[i]) i = i + 1 }
191. syncQueue = rest
192. let r = syncShow(id)
193. let took = now() - t
194. syncTotals = addTotals(syncTotals, r)
195. if (r.error != '') { console.log('tmdb sync: ' + r.error) }
196. // a step blocks every request meanwhile (Saturday Night Live, 53 seasons, 4 requests: ~1.7 s) — say so in the log
197. if (took > 1500) { console.log('tmdb sync: slow step, show ' + id + ', ' + r.requests + ' requests, ' + took + ' ms') }
198. syncNextAt = now() + r.requests * msPerRequest
199. if (syncQueue.length == 0 || syncTotals.shows % 10 == 0) { persistSync() }
200. if (syncQueue.length == 0) { console.log('tmdb sync done: ' + totalsLine(syncTotals) + ' seconds=' + ((now() - syncAt) / 1000)) }
201. return null
202. }
203. if (syncOn) {
204. console.log('tmdb sync: daily at ' + syncHour + ':00 UTC')
205. syncClock = every(1)
206. on syncClock.tick(x) {
207. syncTick()
208. return null
209. }
210. } else {
211. console.log('tmdb sync: off (' + (syncEnabled ? 'TRACKER_SYNC=0' : 'no TMDB_READ_TOKEN') + ')')
212. }
214. on Error(e) { console.log('error absorbed: ' + e.message) }