@oar-sh/oar 0.9.24 → 0.9.26

package/server/public/app/tmux-inspector-view.js

@@ -14,17 +14,22 @@ let inspectorState = {
   listenersBound: false,
 };
 
-const XTERM_STYLE_CANDIDATES = [
-  'https://cdn.jsdelivr.net/npm/xterm@5.5.0/css/xterm.min.css',
-  'https://unpkg.com/xterm@5.5.0/css/xterm.min.css',
+// The files index.html loads, and unpkg as the fallback: one package version
+// and one hash per file, so either CDN must serve the same bytes.
+const XTERM_STYLE_INTEGRITY = 'sha384-8Xk9wy/gzEDUKrXtrmCFa2bBuK3BpjpDuL/p0SeKQX19Khl/M+lHOgD/CyYf7efP';
+const XTERM_SCRIPT_INTEGRITY = 'sha384-M169f14mRZOXm3hD/v2Ti0ThIT/RnAQagXA9nlE15yHAtrW19gdePJh/HaTzUOe/';
+const XTERM_FIT_SCRIPT_INTEGRITY = 'sha384-iF+jqbuti4XlB64clWgFWYEscb+UnSRv3VgVikGYZu+otNFnSHr7y7NcKfBnGizn';
+export const XTERM_STYLE_CANDIDATES = [
+  { url: 'https://cdn.jsdelivr.net/npm/@xterm/xterm@5.5.0/css/xterm.css', integrity: XTERM_STYLE_INTEGRITY },
+  { url: 'https://unpkg.com/@xterm/xterm@5.5.0/css/xterm.css', integrity: XTERM_STYLE_INTEGRITY },
 ];
-const XTERM_SCRIPT_CANDIDATES = [
-  'https://cdn.jsdelivr.net/npm/xterm@5.5.0/lib/xterm.min.js',
-  'https://unpkg.com/xterm@5.5.0/lib/xterm.min.js',
+export const XTERM_SCRIPT_CANDIDATES = [
+  { url: 'https://cdn.jsdelivr.net/npm/@xterm/xterm@5.5.0/lib/xterm.js', integrity: XTERM_SCRIPT_INTEGRITY },
+  { url: 'https://unpkg.com/@xterm/xterm@5.5.0/lib/xterm.js', integrity: XTERM_SCRIPT_INTEGRITY },
 ];
-const XTERM_FIT_SCRIPT_CANDIDATES = [
-  'https://cdn.jsdelivr.net/npm/xterm-addon-fit@0.10.0/lib/xterm-addon-fit.min.js',
-  'https://unpkg.com/xterm-addon-fit@0.10.0/lib/xterm-addon-fit.min.js',
+export const XTERM_FIT_SCRIPT_CANDIDATES = [
+  { url: 'https://cdn.jsdelivr.net/npm/@xterm/addon-fit@0.10.0/lib/addon-fit.js', integrity: XTERM_FIT_SCRIPT_INTEGRITY },
+  { url: 'https://unpkg.com/@xterm/addon-fit@0.10.0/lib/addon-fit.js', integrity: XTERM_FIT_SCRIPT_INTEGRITY },
 ];
 
 let xtermLoadPromise = null;
@@ -64,7 +69,7 @@ function stripAnsiControlCodes(input = '') {
     .replace(/\r(?!\n)/g, '');
 }
 
-function loadScript(src) {
+function loadScript(src, integrity = '') {
   return new Promise((resolve, reject) => {
     const timeoutMs = 3500;
     let settled = false;
@@ -101,6 +106,10 @@ function loadScript(src) {
     }
     const script = document.createElement('script');
     script.src = src;
+    if (integrity) {
+      script.integrity = integrity;
+      script.crossOrigin = 'anonymous';
+    }
     script.async = true;
     script.onload = () => {
       script.dataset.loaded = 'true';
@@ -114,9 +123,9 @@ function loadScript(src) {
   });
 }
 
-function ensureStylesheet(urlCandidates = []) {
-  for (const href of urlCandidates) {
-    const hrefText = String(href || '').trim();
+function ensureStylesheet(candidates = []) {
+  for (const { url, integrity } of candidates) {
+    const hrefText = String(url || '').trim();
     if (!hrefText) continue;
     const already = Array.from(document.querySelectorAll('link[rel="stylesheet"]'))
       .some((node) => String(node.getAttribute('href') || '').trim() === hrefText);
@@ -124,6 +133,10 @@ function ensureStylesheet(urlCandidates = []) {
     const link = document.createElement('link');
     link.rel = 'stylesheet';
     link.href = hrefText;
+    if (integrity) {
+      link.integrity = integrity;
+      link.crossOrigin = 'anonymous';
+    }
     document.head.appendChild(link);
     return;
   }
@@ -131,11 +144,11 @@ function ensureStylesheet(urlCandidates = []) {
 
 async function loadFirstSuccessful(candidates = []) {
   let lastError = null;
-  for (const candidate of candidates) {
-    const src = String(candidate || '').trim();
+  for (const { url, integrity } of candidates) {
+    const src = String(url || '').trim();
     if (!src) continue;
     try {
-      await loadScript(src);
+      await loadScript(src, integrity);
       return true;
     } catch (error) {
       lastError = error;

package/server/public/app/viewer-gallery.mjs

@@ -32,7 +32,29 @@ export function galleryAt(gallery, index) {
 
 export function galleryPositionLabel(gallery) {
   if (!gallery || !Array.isArray(gallery.items) || !gallery.items.length) return '';
-  return `${gallery.index + 1} / ${gallery.items.length}`;
+  return `${gallery.index + 1} / ${gallery.items.length}${galleryHasMore(gallery) ? '+' : ''}`;
+}
+
+// A paged gallery (the media gallery) knows only the pages loaded so far:
+// `hasMore` says more items follow and `loadMore()` fetches the next page
+// as `{ items, hasMore }`. Stepping past the last loaded item loads it.
+
+export function galleryHasMore(gallery) {
+  return Boolean(gallery && gallery.hasMore && typeof gallery.loadMore === 'function');
+}
+
+/** Whether a step of `delta` can land somewhere: a neighbour, or a page still to load. */
+export function galleryCanStep(gallery, delta) {
+  if (galleryNeighborIndex(gallery, delta) !== -1) return true;
+  return Number(delta) > 0 && galleryHasMore(gallery) && Number(gallery.index) === gallery.items.length - 1;
+}
+
+/** The gallery with a loaded page appended (items it already has are not added twice). */
+export function extendGallery(gallery, page) {
+  if (!gallery) return null;
+  const known = new Set(gallery.items.map((item) => item.key).filter(Boolean));
+  const added = (Array.isArray(page?.items) ? page.items : []).filter((item) => !item?.key || !known.has(item.key));
+  return { ...gallery, items: [...gallery.items, ...added], hasMore: Boolean(page?.hasMore) && added.length > 0 };
 }
 
 /** The items on either side of the open one, nearest first. */