tracker

20.2 KB

1. // project.hl — tracker.worldapi.org: STEP 1 (tracker.worldapi.org#1), an empty shell. Login copied unchanged from
2. // calendar.worldapi.org (rejected once for a centered sign-in and no header selector — architect, 2026-09-27):
3. // ident only, no own passwords (README "How apps use ident" of ident.worldapi.org), the identity selector in the
4. // header (components/main.hl). No shows, no data yet — later steps come from the creator (CONCEPT.md).
5. //
6. // the header's ident-selector / "Log in with ident" -> <ident>/login?key=&return=<this app>/login/callback
7. // /login/callback?ident_code=<code> the app's server exchanges the code for the identity's short id
8. // (POST <ident>/api/exchange) and signs this app's OWN session in
9. // (session.user = { id = <users @id> }, users.hl)
10. // the header's "Log out" button signs this app's session out via the face trackerLogOut (components/main.hl)
11. // — ident's own session, and the browser's ident cookie, are untouched
12. //
13. // Config (env; no committed secret — the first deploy registers this app in ident and sets these, done by the
14. // architect, as with ident's own .env for SMTP):
15. // TRACKER_PORT (45008), TRACKER_URL (this app's own public address, for the return URL),
16. // IDENT_URL (https://ident.worldapi.org), TRACKER_KEY (pk_…), TRACKER_SECRET (sk_…)
17. import WebFramework from 'hl:web'
18. import { Response } from 'hl:http1'
19. import { randomBytes } from 'hl:crypto'
20. import { env } from 'hl:proc'
21. import { readBytes, exists } from 'hl:fs'
22. import { now, timestamp, every } from 'hl:time'
24. import Styles from './styles.hl'
25. import { exchangeCode, ensureUser } from './users.hl'
26. import Home from './components/home.hl'
27. import LoginFailed from './components/loginfailed.hl'
28. import Show from './components/show.hl'
29. import Unwatched from './components/unwatched.hl'
30. import Schedule from './components/schedule.hl'
31. import MyShows from './components/myshows.hl'
32. import MyMovies from './components/mymovies.hl'
33. import Movies from './components/movies.hl'
34. import AllShows from './components/allshows.hl'
35. import Search from './components/search.hl'
36. import Person from './components/person.hl'
37. import Genre from './components/genre.hl'
38. import { ensureIndex, searchTitleChanged } from './search.hl'
39. import { syncEnabled, syncShow, persistSync, emptyTotals, addTotals, totalsLine, pauseMsAfter, msPerRequest, adultBackfillQueue, backfillTitle } from './tmdbsync.hl'
40. import { allFollowedShowIds } from './follows.hl'
41. import { refreshCatalogShow } from './catalog.hl'
42. import { dark, darker } from './shared/tokens.hl'
44. static appTitle = "tracker"
46. // ---- THE INSTALLABLE APP (tracker.worldapi.org#10), the same way calendar.worldapi.org does it: hl:web's own web app
47. // manifest (/__hl/manifest.webmanifest, linked from every head with the apple-touch-icon and theme-color) and service
48. // worker (/__hl/sw.js) from these settings — no JavaScript of ours. Icons in icons/ (icon.svg is the source, the PNGs
49. // are rendered from it with rsvg-convert, README "Icons"). The theme colour is the header's background (darker), the
50. // splash background the page's (dark) — both off the tokens, not written out again.
51. appThemeColor = darker.value
52. appBackgroundColor = dark.value
53. appIcons = [
54. { src = '/icons/icon-192.png' sizes = '192x192' purpose = 'any' }
55. { src = '/icons/icon-512.png' sizes = '512x512' purpose = 'any' }
56. { src = '/icons/icon-192.png' sizes = '192x192' purpose = 'maskable' }
57. { src = '/icons/icon-512.png' sizes = '512x512' purpose = 'maskable' }
58. ]
59. appTouchIcon = '/icons/apple-touch-icon.png'
60. appFavicon = '/icons/favicon.svg'
61. // OFFLINE: only the shell — the header and `/` (components/main.hl says "You are offline" while the browser has no
62. // network). The data pages are not kept: without a network they get hl:web's "Unavailable offline" page.
63. offline = [ Home ]
65. styles = Styles
67. port = env('TRACKER_PORT') != null ? toNumber(env('TRACKER_PORT')) : 45008
68. watching = env('TRACKER_WATCH') != '0'
69. // read by hl:web's own manifest config (WebFramework.hl `cfg.sessionDir`), not the constructor call below
70. sessionDir = env('TRACKER_SESSIONS') != null ? env('TRACKER_SESSIONS') : null
72. // ---- THE LOGIN BUTTON'S RETURN (ident README "How apps use ident"), copied from calendar.worldapi.org's project.hl
73. // BACK TO THE PAGE: /login.js puts `?next=` into the button's return URL at the click. Only a same-origin PATH
74. // goes (one `/`, URL-safe characters, ≤ 500). Anything else → `/`.
75. nextChars = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._~/?&=%+,;@!$()*:'
76. safePath = (want) => {
77. if (want == null || hlTypeName(want) != 'String' || want == '' || want.length > 500) { return '/' }
78. if (want.slice(0, 1) != '/' || want.slice(0, 2) == '//' || want.slice(0, 7) == '/login/') { return '/' }
79. let i = 0
80. while (i < want.length) {
81. if (!nextChars.includes(want[i])) { return '/' }
82. i = i + 1
83. }
84. return want
85. }
87. // A FAILED LOGIN is a page (components/loginfailed.hl): the reason is parked in the session, then → /login/failed
88. failed = (req, why) => {
89. let s = req.session
90. let fresh = s == null
91. if (fresh) { s = server.sessions.mint() }
92. s.data.loginError = why
93. server.sessions.save(s)
94. let res = new Response('login failed: ' + why, { status = 302 headers = { 'Location' = '/login/failed' 'Cache-Control' = 'no-store' 'Content-Type' = 'text/plain; charset=utf-8' } })
95. if (fresh) { res.headers['Set-Cookie'] = server.sessions.cookieHeader(s.id) }
96. return res
97. }
99. // the function route gets the cookie's session as req.session (hybriel #11); none yet → minted here
100. loginCallback = (route, req) => {
101. if (req.method != 'GET') { return failed(req, 'GET only') }
102. let q = req.query != null ? req.query : {}
103. let code = q.ident_code
104. if (code == null || code == '') { return failed(req, 'ident sent no login code') }
105. let x = exchangeCode(code)
106. if (x.error != null) { return failed(req, x.error) }
107. let u = ensureUser(x.identity)
108. if (u == null) { return failed(req, 'could not store the user') }
109. let s = req.session
110. let fresh = s == null
111. if (fresh) { s = server.sessions.mint() }
112. s.user = { id = u.id }
113. s.data.tag = randomBytes(16)
114. s.data.loginError = null
115. server.sessions.save(s)
116. let res = new Response('logged in', { status = 302 headers = { 'Location' = safePath(q.next) 'Cache-Control' = 'no-store' 'Content-Type' = 'text/plain; charset=utf-8' } })
117. if (fresh) { res.headers['Set-Cookie'] = server.sessions.cookieHeader(s.id) }
118. return res
119. }
121. // ---- /posters/<name> (tracker.worldapi.org#4): a show's poster image, served dynamically from
122. // storage/mpackdb/posters/ (the poster's file name is the show's oldId + its migrated extension,
123. // shows.hl posterName) — falls back to a placeholder svg when the real file isn't there yet (the
124. // mongo export never included the actual poster bytes, see the report's `open`).
125. postersDir = (env('TRACKER_STORAGE') != null ? env('TRACKER_STORAGE') : './storage/mpackdb') + '/posters'
126. placeholderPoster = './assets/poster-placeholder.svg'
127. posterNameChars = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_'
128. isSafePosterName = (name) => {
129. if (name == null || hlTypeName(name) != 'String' || name == '' || name.length > 100) { return false }
130. let i = 0
131. while (i < name.length) {
132. if (!posterNameChars.includes(name[i])) { return false }
133. i = i + 1
134. }
135. return true
136. }
137. endsWithStr = (s, suffix) => { return s.length >= suffix.length && s.slice(s.length - suffix.length) == suffix }
138. mimeOfPoster = (name) => {
139. if (endsWithStr(name, '.png')) { return 'image/png' }
140. if (endsWithStr(name, '.webp')) { return 'image/webp' }
141. if (endsWithStr(name, '.svg')) { return 'image/svg+xml' }
142. return 'image/jpeg'
143. }
144. posterRoute = (route, req) => {
145. let name = route.params != null ? route.params.name : null
146. if (!isSafePosterName(name)) { return new Response('bad poster name', { status = 400 headers = { 'Content-Type' = 'text/plain; charset=utf-8' } }) }
147. let path = postersDir + '/' + name
148. if (exists(path)) { return new Response(readBytes(path), { headers = { 'Content-Type' = mimeOfPoster(name) 'Cache-Control' = 'public, max-age=86400' } }) }
149. return new Response(readBytes(placeholderPoster), { headers = { 'Content-Type' = 'image/svg+xml' 'Cache-Control' = 'public, max-age=3600' } })
150. }
152. // ---- /profiles/<name> (tracker.worldapi.org#16): a person's photo, from storage/mpackdb/profiles/ (people.hl syncProfile
153. // downloads it on the first visit of the person page) — the same checks and placeholder as /posters/<name>
154. profilesDir = (env('TRACKER_STORAGE') != null ? env('TRACKER_STORAGE') : './storage/mpackdb') + '/profiles'
155. profileRoute = (route, req) => {
156. let name = route.params != null ? route.params.name : null
157. if (!isSafePosterName(name)) { return new Response('bad photo name', { status = 400 headers = { 'Content-Type' = 'text/plain; charset=utf-8' } }) }
158. let path = profilesDir + '/' + name
159. if (exists(path)) { return new Response(readBytes(path), { headers = { 'Content-Type' = mimeOfPoster(name) 'Cache-Control' = 'public, max-age=86400' } }) }
160. return new Response(readBytes(placeholderPoster), { headers = { 'Content-Type' = 'image/svg+xml' 'Cache-Control' = 'public, max-age=3600' } })
161. }
163. // ---- the old addresses of the personal lists (tracker.worldapi.org#8): they all live under /my/ now —
164. // a permanent redirect so old links keep working (architect's decision)
165. movedTo = (path) => { return new Response('moved to ' + path, { status = 301 headers = { 'Location' = path 'Content-Type' = 'text/plain; charset=utf-8' } }) }
166. unwatchedMoved = (route, req) => { return movedTo('/my/unwatched') }
167. scheduleMoved = (route, req) => { return movedTo('/my/schedule') }
168. // mission 058: the show page's genre pills linked `/genre/<x>` (no page there) — the genre pages are `/genres/<x>`
169. genreMoved = (route, req) => {
170. let g = route.params != null ? route.params.genre : null
171. return movedTo(isSafePosterName(g) ? '/genres/' + g : '/')
172. }
174. routes = [
175. { pattern = "/favicon.ico" file = "./icons/favicon.ico" headers = { 'Cache-Control' = 'no-cache' } }
176. // the installable app (tracker.worldapi.org#10): the icons (manifest and service worker are hl:web's own, from appIcons / offline)
177. { pattern = "/icons/icon-192.png" file = "./icons/icon-192.png" headers = { 'Cache-Control' = 'no-cache' } }
178. { pattern = "/icons/icon-512.png" file = "./icons/icon-512.png" headers = { 'Cache-Control' = 'no-cache' } }
179. { pattern = "/icons/apple-touch-icon.png" file = "./icons/apple-touch-icon.png" headers = { 'Cache-Control' = 'no-cache' } }
180. { pattern = "/icons/favicon.svg" file = "./icons/favicon.svg" headers = { 'Cache-Control' = 'no-cache' } }
181. { pattern = "/login/callback" function = loginCallback }
182. { pattern = "/login/failed" component = LoginFailed }
183. { pattern = "/login.js" file = "./login.js" headers = { 'Cache-Control' = 'no-cache' } }
184. { pattern = "/posters/:name" function = posterRoute }
185. // tracker.worldapi.org#13: every movie / every series, 24 per page — the page is a PATH segment (`/movies/page/2`), a
186. // page component cannot read `?page=` (hybriel#11) — and the movies the user follows
187. { pattern = "/movies" component = Movies }
188. { pattern = "/movies/page/:page" component = Movies }
189. { pattern = "/shows" component = AllShows }
190. { pattern = "/shows/page/:page" component = AllShows }
191. { pattern = "/shows/:slug" component = Show }
192. { pattern = "/my/shows" component = MyShows }
193. { pattern = "/my/movies" component = MyMovies }
194. { pattern = "/my/unwatched" component = Unwatched }
195. { pattern = "/my/schedule" component = Schedule }
196. { pattern = "/unwatched" function = unwatchedMoved }
197. { pattern = "/schedule" function = scheduleMoved }
198. // tracker.worldapi.org#14: the search — `/search/<text>` (hl:web gives a page no query string, so not `?q=`)
199. { pattern = "/search/:q?" component = Search }
200. // tracker.worldapi.org#16: a person's page (the show page's cast and the search link here) and their photo
201. { pattern = "/person/:slug" component = Person }
202. { pattern = "/profiles/:name" function = profileRoute }
203. // mission 058 (tracker.worldapi.org#25): a genre's movies and series, like /movies (the page in the path)
204. { pattern = "/genres/:genre" component = Genre }
205. { pattern = "/genres/:genre/page/:page" component = Genre }
206. { pattern = "/genre/:genre" function = genreMoved }
207. { pattern = "/" component = Home }
208. ]
210. // WHO GETS THE PUSH: the login state reaches the tabs of one session (components/main.hl trackerSignedIn/Out).
211. tagOf = (session) => { return session != null && session.data != null ? session.data.tag : null }
212. audience = {
213. trackerSignedIn = (tag, session) => { return tag != null && tagOf(session) == tag }
214. trackerSignedOut = (tag, session) => { return tag != null && tagOf(session) == tag }
215. }
217. // cookies are per host, not per port: an own name keeps this app's session apart from
218. // ident's own (and from any other worldapi app sharing a dev host), see ident README "Design
219. // tokens" / hybriel#10 hybriel#17.
220. sessionCookie = 'trackersid'
221. // tracker.worldapi.org#14: the search index (search.hl) is built once here at boot (~0.6 s on the real data), not by the
222. // first search
223. searchIndexReady = ensureIndex()
224. server = new WebFramework(routes = routes, styles = styles, port = port, sessionCookie = sessionCookie, watchMode = watching)
226. // ---- THE DAILY TMDB SYNC (tracker.worldapi.org#9, tmdbsync.hl) --------------------------------------
227. // Once a day at TRACKER_SYNC_HOUR (UTC, default 4 — hl:time has no time zones; the container runs UTC) every
228. // followed show is synced from TMDB. hl:web serves ONE request at a time, so the run never takes the server
229. // for itself: a 1-second clock does ONE show per tick (1–3 TMDB requests + maybe its poster) and returns — the
230. // requests that queued meanwhile are served between two ticks, and a tick never starts inside a page render.
231. // After a show that made n requests the next waits n × 260 ms (TMDB: ≤ 40 requests / 10 s) + 550 ms per TVmaze lookup
232. // (≤ 20 / 10 s, tracker.worldapi.org#12).
233. // TRACKER_SYNC=0 switches it off; without TMDB_READ_TOKEN it is off too (logged once).
234. syncHour = env('TRACKER_SYNC_HOUR') != null ? toNumber(env('TRACKER_SYNC_HOUR')) : 4
235. syncOn = env('TRACKER_SYNC') != '0' && syncEnabled
236. syncQueue = []
237. syncAt = 0
238. syncDay = ''
239. syncNextAt = 0
240. syncTotals = emptyTotals()
241. syncTick = () => {
242. let t = now()
243. if (syncQueue.length == 0) {
244. let stamp = timestamp(t)
245. let day = stamp.slice(0, 10)
246. if (toNumber(stamp.slice(11, 13)) != syncHour || day == syncDay) { return null }
247. syncDay = day
248. syncQueue = allFollowedShowIds()
249. syncAt = t
250. syncNextAt = 0
251. syncTotals = emptyTotals()
252. console.log('tmdb sync: start, ' + syncQueue.length + ' followed shows')
253. return null
254. }
255. if (t < syncNextAt) { return null }
256. let id = syncQueue[0]
257. let rest = []
258. let i = 1
259. while (i < syncQueue.length) { rest.push(syncQueue[i]) i = i + 1 }
260. syncQueue = rest
261. let r = syncShow(id)
262. // the public lists (catalog.hl, tracker.worldapi.org#13): this show's place by its newest released episode; the sync
263. // also brings TMDB's adult flag (mission 054) → the search's view of it too
264. refreshCatalogShow(id)
265. searchTitleChanged(id)
266. let took = now() - t
267. syncTotals = addTotals(syncTotals, r)
268. if (r.error != '') { console.log('tmdb sync: ' + r.error) }
269. // a step blocks every request meanwhile (Saturday Night Live, 53 seasons, 4 requests: ~1.7 s) — say so in the log
270. if (took > 1500) { console.log('tmdb sync: slow step, show ' + id + ', ' + r.requests + ' requests, ' + took + ' ms') }
271. syncNextAt = now() + pauseMsAfter(r)
272. if (syncQueue.length == 0 || syncTotals.shows % 10 == 0) { persistSync() }
273. if (syncQueue.length == 0) { console.log('tmdb sync done: ' + totalsLine(syncTotals) + ' seconds=' + ((now() - syncAt) / 1000)) }
274. return null
275. }
277. // ---- THE ADULT-FLAG BACKFILL (mission 054, tmdbsync.hl backfillTitle) -----------------------------------
278. // The public lists and the search show only titles TMDB says are not adult (shows.hl isPublicTitle; unknown = hidden). At
279. // start the app collects every title whose flag is still unknown and asks TMDB for ONE title per step — like the daily
280. // sync, on the same clock, so requests queued meanwhile are served between two steps: one details request (adult,
281. // poster_path, external ids) + the poster file when missing, then a pause of 260 ms per TMDB API request (≤ 40 / 10 s;
282. // the poster comes from TMDB's image host, not the API, and is not counted). Each answered title goes into the lists
283. // (catalog.hl refreshCatalogShow) and the search at once. RESUMES after a restart: the queue is built from what is
284. // still unknown. Stops when the queue is empty; titles TMDB answers 404 for are marked (`adultCheck`) and stay hidden; a
285. // passing failure (no answer, 429, 5xx) goes to the back of the queue, at most 2 more tries per start.
286. // While the daily sync runs, the backfill waits. Log: start, every TRACKER_BACKFILL_LOG_EVERY (500) titles, done.
287. // TRACKER_BACKFILL=0 switches it off; without TMDB_READ_TOKEN it is off too.
288. backfillOn = env('TRACKER_BACKFILL') != '0' && syncEnabled
289. backfillLogEvery = env('TRACKER_BACKFILL_LOG_EVERY') != null ? toNumber(env('TRACKER_BACKFILL_LOG_EVERY')) : 500
290. backfillQueue = null
291. backfillPos = 0
292. backfillDone = false
293. backfillAt = 0
294. backfillNextAt = 0
295. backfillTries = {}
296. backfillTotals = { titles = 0 adult = 0 notAdult = 0 unknown = 0 posters = 0 ids = 0 requests = 0 errors = 0 retries = 0 }
297. backfillLine = () => {
298. let b = backfillTotals
299. return b.titles + '/' + backfillQueue.length + ' titles, adult=' + b.adult + ' notAdult=' + b.notAdult + ' unknown=' + b.unknown + ' posters=' + b.posters
300. + ' ids=' + b.ids + ' requests=' + b.requests + ' errors=' + b.errors + ' retries=' + b.retries + ' seconds=' + ((now() - backfillAt) / 1000)
301. }
302. backfillTick = () => {
303. if (backfillDone) { return null }
304. let t = now()
305. if (backfillQueue == null) {
306. backfillQueue = adultBackfillQueue()
307. backfillAt = t
308. console.log('adult backfill: start, ' + backfillQueue.length + ' titles without an adult flag (' + (now() - t) + ' ms to find them)')
309. if (backfillQueue.length == 0) { backfillDone = true console.log('adult backfill: nothing to do') }
310. return null
311. }
312. if (t < backfillNextAt) { return null }
313. let id = backfillQueue[backfillPos]
314. backfillPos = backfillPos + 1
315. let r = backfillTitle(id)
316. if (r.retry && (backfillTries[id] == null || backfillTries[id] < 2)) {
317. backfillTries[id] = backfillTries[id] == null ? 1 : backfillTries[id] + 1
318. let q = backfillQueue
319. q.push(id)
320. backfillQueue = q
321. backfillTotals.retries = backfillTotals.retries + 1
322. } else {
323. backfillTotals.titles = backfillTotals.titles + 1
324. if (r.adult == true) { backfillTotals.adult = backfillTotals.adult + 1 } else if (r.adult == false) { backfillTotals.notAdult = backfillTotals.notAdult + 1 } else { backfillTotals.unknown = backfillTotals.unknown + 1 }
325. }
326. backfillTotals.posters = backfillTotals.posters + r.posters
327. backfillTotals.ids = backfillTotals.ids + r.ids
328. backfillTotals.requests = backfillTotals.requests + r.requests
329. backfillTotals.errors = backfillTotals.errors + r.errors
330. if (r.error != '') { console.log('adult backfill: ' + r.error) }
331. if (r.adult != null) {
332. refreshCatalogShow(id)
333. searchTitleChanged(id)
334. }
335. let took = now() - t
336. if (took > 1500) { console.log('adult backfill: slow step, show ' + id + ', ' + took + ' ms') }
337. backfillNextAt = now() + r.requests * msPerRequest
338. let finished = backfillPos >= backfillQueue.length
339. if (finished || backfillPos % 25 == 0) { persistSync() }
340. if (!finished && backfillTotals.titles > 0 && backfillTotals.titles % backfillLogEvery == 0 && !r.retry) { console.log('adult backfill: ' + backfillLine()) }
341. if (finished) {
342. backfillDone = true
343. console.log('adult backfill done: ' + backfillLine())
344. }
345. return null
346. }
348. // ONE clock for both (a tick every 0.1 s): the daily sync's step once a second as before; the backfill's steps in between,
349. // only while no daily run is going on
350. clockOn = syncOn || backfillOn
351. clockTicks = 0
352. if (syncOn) { console.log('tmdb sync: daily at ' + syncHour + ':00 UTC') } else { console.log('tmdb sync: off (' + (syncEnabled ? 'TRACKER_SYNC=0' : 'no TMDB_READ_TOKEN') + ')') }
353. if (!backfillOn) { console.log('adult backfill: off (' + (syncEnabled ? 'TRACKER_BACKFILL=0' : 'no TMDB_READ_TOKEN') + ')') }
354. if (clockOn) {
355. syncClock = every(0.1)
356. on syncClock.tick(x) {
357. clockTicks = clockTicks + 1
358. let busy = syncQueue.length > 0
359. if (syncOn && clockTicks % 10 == 0) { syncTick() }
360. if (backfillOn && !busy && syncQueue.length == 0) { backfillTick() }
361. return null
362. }
363. }
365. on Error(e) { console.log('error absorbed: ' + e.message) }