@scrypted/server 0.114.0 → 0.115.1

package/src/rpc.ts

@@ -1,6 +1,3 @@
-import type { CompileFunctionOptions } from 'vm';
-type CompileFunction = (code: string, params?: ReadonlyArray<string>, options?: CompileFunctionOptions) => Function;
-
 export function startPeriodicGarbageCollection() {
     if (!global.gc) {
         console.warn('rpc peer garbage collection not available: global.gc is not exposed.');
@@ -253,12 +250,6 @@ export class RPCResultError extends Error {
     }
 }
 
-function compileFunction(code: string, params?: ReadonlyArray<string>, options?: CompileFunctionOptions): any {
-    params = params || [];
-    const f = `(function(${params.join(',')}) {;${code};})`;
-    return eval(f);
-}
-
 declare class WeakRef<T> {
     target: T;
     constructor(target: any);
@@ -313,7 +304,10 @@ export class RpcPeer {
     finalizers = new FinalizationRegistry(entry => this.finalize(entry as LocalProxiedEntry));
     nameDeserializerMap = new Map<string, RpcSerializer>();
     onProxyTypeSerialization = new Map<string, (value: any) => void>();
-    onProxySerialization: (value: any, proxyId: string) => any;
+    onProxySerialization: (value: any) => {
+        proxyId: string;
+        properties: any;
+    };
     constructorSerializerMap = new Map<any, string>();
     transportSafeArgumentTypes = RpcPeer.getDefaultTransportSafeArgumentTypes();
     killed: Promise<string>;
@@ -499,23 +493,6 @@ export class RpcPeer {
         });
     }
 
-    evalLocal<T>(script: string, filename?: string, coercedParams?: { [name: string]: any }): T {
-        const params = Object.assign({}, this.params, coercedParams);
-        let compile: CompileFunction;
-        try {
-            // prevent bundlers from trying to include non-existent vm module.
-            compile = module[`require`]('vm').compileFunction;
-        }
-        catch (e) {
-            compile = compileFunction;
-        }
-        const f = compile(script, Object.keys(params), {
-            filename,
-        });
-        const value = f(...Object.values(params));
-        return value;
-    }
-
     /**
      * @deprecated
      * @param result
@@ -656,7 +633,16 @@ export class RpcPeer {
 
         this.onProxyTypeSerialization.get(__remote_constructor_name)?.(value);
 
-        const __remote_proxy_id = RpcPeer.generateId();
+        const {
+            proxyId: __remote_proxy_id,
+            properties: __remote_proxy_props,
+        } = this.onProxySerialization
+                ? this.onProxySerialization(value)
+                : {
+                    proxyId: RpcPeer.generateId(),
+                    properties: RpcPeer.prepareProxyProperties(value),
+                };
+
         proxiedEntry = {
             id: __remote_proxy_id,
             finalizerId: __remote_proxy_id,
@@ -664,8 +650,6 @@ export class RpcPeer {
         this.localProxied.set(value, proxiedEntry);
         this.localProxyMap.set(__remote_proxy_id, value);
 
-        const __remote_proxy_props = this.onProxySerialization ? this.onProxySerialization(value, __remote_proxy_id) : RpcPeer.prepareProxyProperties(value);
-
         const ret: RpcRemoteProxyValue = {
             __remote_proxy_id,
             __remote_proxy_finalizer_id: __remote_proxy_id,
@@ -723,7 +707,7 @@ export class RpcPeer {
                     }
                     catch (e) {
                         // console.error('failure', rpcApply.method, e);
-                        this.createErrorResult(result, e);
+                        this.createErrorResult(result, e as Error);
                     }
 
                     this.send(result, undefined, serializationContext);
@@ -785,7 +769,7 @@ export class RpcPeer {
                     }
                     catch (e) {
                         // console.error('failure', rpcApply.method, e);
-                        this.createErrorResult(result, e);
+                        this.createErrorResult(result, e as Error);
                     }
 
                     if (!rpcApply.oneway)

package/src/runtime.ts

@@ -275,10 +275,11 @@ export class ScryptedRuntime extends PluginHttp<HttpPluginData> {
             return;
         }
 
+        const reqany = req as any;
         if ((req as any).upgradeHead)
-            this.connectRPCObjectIO.handleUpgrade(req, res.socket, (req as any).upgradeHead)
+            this.connectRPCObjectIO.handleUpgrade(reqany, res.socket, reqany.upgradeHead)
         else
-            this.connectRPCObjectIO.handleRequest(req, res);
+            this.connectRPCObjectIO.handleRequest(reqany, res);
     }
 
     async getEndpointPluginData(req: Request, endpoint: string, isUpgrade: boolean, isEngineIOEndpoint: boolean): Promise<HttpPluginData> {
@@ -422,15 +423,18 @@ export class ScryptedRuntime extends PluginHttp<HttpPluginData> {
             return;
         }
 
-        (req as any).scrypted = {
+        const reqany = req as any;
+
+        reqany.scrypted = {
             endpointRequest,
             pluginDevice,
             accessControls,
         };
+
         if ((req as any).upgradeHead)
-            pluginHost.io.handleUpgrade(req, res.socket, (req as any).upgradeHead)
+            pluginHost.io.handleUpgrade(reqany, res.socket, reqany.upgradeHead)
         else
-            pluginHost.io.handleRequest(req, res);
+            pluginHost.io.handleRequest(reqany, res);
     }
 
     handleRequestEndpoint(req: Request, res: Response, endpointRequest: HttpRequest, pluginData: HttpPluginData) {

package/src/scrypted-server-main.ts

@@ -161,6 +161,16 @@ async function start(mainFilename: string, options?: {
         callback(sha === user.passwordHash || password === user.token);
     });
 
+    // the default http-auth will returns a WWW-Authenticate header if login fails.
+    // this causes the Safari to prompt for login.
+    // https://github.com/gevorg/http-auth/blob/4158fa75f58de70fd44aa68876a8674725e0556e/src/auth/base.js#L81
+    // override the ask function to return a bare 401 instead.
+    // @ts-expect-error
+    basicAuth.ask = (res) => {
+        res.statusCode = 401;
+        res.end();
+    };
+
     const httpsServerOptions = process.env.SCRYPTED_HTTPS_OPTIONS_FILE
         ? JSON.parse(fs.readFileSync(process.env.SCRYPTED_HTTPS_OPTIONS_FILE).toString())
         : {};
@@ -219,6 +229,12 @@ async function start(mainFilename: string, options?: {
     }
 
     app.use(async (req, res, next) => {
+        // /web/component requires basic auth admin access.
+        if (req.url.startsWith('/web/component/')) {
+            next();
+            return;
+        }
+
         // the remote address may be ipv6 prefixed so use a fuzzy match.
         // eg ::ffff:192.168.2.124
         if (process.env.SCRYPTED_ADMIN_USERNAME