dsh-usage-badge 0.1.5 → 0.1.6

package/lib/index.js

@@ -23,6 +23,7 @@ import { join } from 'node:path'
 import { createCacheStore } from './cache-store.js'
 import { createAggregator, mergeRecords, resolveDshHome } from './fold.js'
 import { SyncEngine, acquireLock, readSyncDocument, releaseLock, safeDeviceId } from './sync.js'
+import { normalizeWebdavUrl } from './webdav.js'
 import { describeCalendar, loadBundledTable, resolveHolidayRules } from './holidays.js'
 import { OFFICIAL_SOURCES, applyOfficialPricing, fetchOfficialPricing } from './official-pricing.js'
 import {
@@ -454,6 +455,23 @@ function readPricing(paths) {
 }
 
 /** Read a request body, bounded. An oversized one is a 413, not a server error. */
+/**
+ * Read a JSON request body, reporting a malformed one as the caller's mistake.
+ *
+ * A bare `JSON.parse` throws a `SyntaxError` with no status, which the route wrapper can only answer with a
+ * 500 — and a 500 for a body the client got wrong sends whoever is debugging it looking at the host.
+ */
+async function readJsonBody(req) {
+  const text = (await readBody(req)) || '{}'
+  try {
+    return JSON.parse(text)
+  } catch (error) {
+    const bad = new Error(`the request body is not JSON: ${error?.message ?? error}`)
+    bad.statusCode = 400
+    throw bad
+  }
+}
+
 function readBody(req) {
   return new Promise((resolvePromise, rejectPromise) => {
     const chunks = []
@@ -648,6 +666,7 @@ export function apply(ctx) {
    * forgotten key away from putting a credential in an HTTP response.
    */
   function safeSyncConfig(config = {}) {
+    const ha1 = String(config.ha1 ?? '')
     return {
       enabled: Boolean(config.enabled),
       url: String(config.url ?? ''),
@@ -658,8 +677,11 @@ export function apply(ctx) {
       deviceLabel: String(config.deviceLabel ?? ''),
       windowYears: Number(config.windowYears) || 0,
       instanceId: String(config.instanceId ?? ''),
-      hasCredential: Boolean(config.ha1 || config.passwordHash || config.password),
-      credentialPrefix: config.ha1 ? `${String(config.ha1).slice(0, 6)}…` : '',
+      hasCredential: Boolean(ha1),
+      // Only a real HA1 counts. `password` and `passwordHash` are fields an older build could leave behind,
+      // and `connect()` cannot use either — claiming a credential exists would enable 立即同步 and then
+      // fail with "no WebDAV credential is configured" the moment it was pressed.
+      credentialPrefix: ha1.length >= 16 ? `${ha1.slice(0, 6)}…` : '',
     }
   }
 
@@ -692,6 +714,25 @@ export function apply(ctx) {
     }
   }
 
+  /**
+   * Every piece of work that talks to the server goes through one queue.
+   *
+   * The owner lock keeps two **processes** apart; inside one process it cannot, because the host holds it for
+   * its whole life. Without this, 立即同步 and the automatic price push run as two independent chains: a run's
+   * `PROPFIND` and a push's `GET pricing.json` would already be interleaving on the wire (measured), and both
+   * mutate the same `engine.state` and rewrite `sync.json`, so whichever finishes last decides what the panel
+   * says about the other.
+   */
+  function enqueue(instance, work) {
+    const next = (instance.chain ?? Promise.resolve()).then(work, work)
+    // The chain must survive a rejection — neither breaking on it nor leaving it unhandled.
+    instance.chain = next.then(
+      () => {},
+      () => {},
+    )
+    return next
+  }
+
   async function syncStatus() {
     // Reading the status must not create anything either, so an untouched install answers with the
     // sensible defaults rather than acquiring a lock it has no intention of using.
@@ -757,7 +798,7 @@ export function apply(ctx) {
   function runSync() {
     const instance = syncSystem()
     if (!instance.running) {
-      instance.running = (async () => {
+      instance.running = enqueue(instance, async () => {
         if (!instance.engine.store) {
           // The cache is read-only here (another instance holds the lock, a permission problem, a newer
           // schema). The sync would publish a history this process cannot even fold, so it declines
@@ -794,7 +835,7 @@ export function apply(ctx) {
           return { result: 'failed', message: String(error?.message ?? error), at: 0 }
         }
         // Nothing to release: the lock belongs to the system and lives as long as this process does.
-      })()
+      })
         .then((result) => {
           instance.last = { result: result.result, message: result.message, at: result.at ?? 0 }
           return result
@@ -863,11 +904,9 @@ export function apply(ctx) {
       pricingPushTimer = null
       const instance = syncSystem()
       if (!instance.lock?.acquired || !instance.engine.store) return
-      // Chained onto the same queue as a full run, so an edit landing mid-sync waits rather than
-      // interleaving PUTs with it. The result is recorded like any other outcome: an edit whose publish
-      // failed is exactly the thing the person would otherwise never learn about.
-      instance.pushing = (instance.pushing ?? Promise.resolve())
-        .then(() => instance.engine.pushPricing({ lock: instance.lock, instanceId: instance.instanceId }))
+      // Onto the **same** queue as a full run, so an edit landing mid-sync waits for it instead of
+      // interleaving its PUTs and its `sync.json` write with the run's.
+      instance.pushing = enqueue(instance, () => instance.engine.pushPricing({ lock: instance.lock, instanceId: instance.instanceId }))
         .then((result) => {
           log(`pricing pushed after an edit: ${result.result} — ${result.status}`)
           instance.last = { result: result.result, message: `prices: ${result.status}`, at: result.result === 'ok' ? Number(instance.engine.state.lastSyncAt) || 0 : instance.last?.at ?? 0 }
@@ -1018,7 +1057,7 @@ export function apply(ctx) {
           sendJson(res, 403, { error: 'config writes are accepted from loopback clients only' })
           return
         }
-        const patch = JSON.parse((await readBody(req)) || '{}')
+        const patch = await readJsonBody(req)
         commitPricing(mergeConfig(readRawPricing(pricingPaths).raw, patch))
         log('pricing config updated')
         sendJson(res, 200, { ok: true, effective: pricing, calendar: describeCalendar(rules) })
@@ -1039,7 +1078,7 @@ export function apply(ctx) {
           sendJson(res, 403, { error: 'config writes are accepted from loopback clients only' })
           return
         }
-        const body = JSON.parse((await readBody(req)) || '{}')
+        const body = await readJsonBody(req)
         // Apply the copy the user was looking at, reusing the recent fetch rather
         // than pulling a possibly different page under them.
         const parsed = await officialPricing(body.source ?? 'zh-cn')
@@ -1097,7 +1136,7 @@ export function apply(ctx) {
           return
         }
         const instance = syncSystem()
-        const patch = JSON.parse((await readBody(req)) || '{}')
+        const patch = await readJsonBody(req)
         const config = {}
         for (const field of ['enabled', 'url', 'username', 'allowInsecureTls', 'deviceLabel', 'deviceId', 'realm']) {
           if (patch[field] !== undefined) config[field] = patch[field]
@@ -1132,12 +1171,19 @@ export function apply(ctx) {
           config.ha1 = patch.ha1.toLowerCase()
         }
         if (typeof config.url === 'string' && config.url !== '') {
-          try {
-            new URL(config.url)
-          } catch {
-            sendJson(res, 400, { error: `the WebDAV URL is not a URL: ${config.url}` })
+          // The **same** judgement the client makes, from the same function. A copy here is what let the
+          // route accept a query string, embedded credentials and `ftp:` — addresses the client refuses —
+          // so the panel stored one, showed it, and the sync could not run at all. Two copies of a rule
+          // drift; one copy cannot.
+          const judged = normalizeWebdavUrl(config.url)
+          if (!judged.ok) {
+            sendJson(res, 400, { error: judged.reason })
             return
           }
+          // The trailing slash is **added** rather than demanded: someone typing `host:port` means the
+          // collection at that address. The panel stores what this returns, so the field ends up showing
+          // the address that will actually be used instead of the one that was typed.
+          config.url = judged.url
         }
         instance.engine.save({ config })
         log(`sync configuration updated (${instance.engine.config.enabled ? 'on' : 'off'}, device ${instance.engine.config.deviceId})`)
@@ -1151,8 +1197,13 @@ export function apply(ctx) {
           sendJson(res, 403, { error: 'sync writes are accepted from loopback clients only' })
           return
         }
+        // The client is kept across the catch so a **failure** can still report the realm the server
+        // announced. That realm is the missing piece when someone's server does not use `WebDAV`: the
+        // password was hashed against the default, so nothing can work until it is re-hashed against the
+        // real one — and without this the panel had no way to learn it.
+        let client = null
         try {
-          const client = syncSystem().engine.connect()
+          client = syncSystem().engine.connect()
           const options = await client.options()
           const devices = await syncSystem().engine.discover(client)
           sendJson(res, 200, {
@@ -1164,7 +1215,7 @@ export function apply(ctx) {
             warning: client.insecureWarning ?? null,
           })
         } catch (error) {
-          sendJson(res, 200, { ok: false, error: String(error?.message ?? error) })
+          sendJson(res, 200, { ok: false, error: String(error?.message ?? error), realm: client?.challenge?.realm ?? null })
         }
         return
       }
@@ -1198,23 +1249,38 @@ export function apply(ctx) {
     // asynchronous, and a value read after it would be whatever the environment holds by then — which a
     // test that sets an override for exactly this mount would already have taken away.
     const startupDelay = delayFor('DSH_USAGE_BADGE_STARTUP_SYNC_MS', STARTUP_SYNC_DELAY_MS)
+    // Unloading before the first fold finishes used to schedule the first sync *after* the unload: the
+    // callback ran anyway, took the lock back, and synced through a store that had already been closed
+    // (`statement has been finalized`), leaving a lock file behind for a host that was gone.
+    let disposed = false
     void warm().then(() => {
+      if (disposed) return
       scheduleStartupSync(startupDelay)
       // Fire and forget: this only fills in what the server holds, for the panel's next read.
       void refreshRemoteDevices()
     })
     return () => {
+      disposed = true
       // Any pending automatic work is dropped on unload: a push that fires while the host is going away
       // would write state for a process that no longer exists.
       if (pricingPushTimer) clearTimeout(pricingPushTimer)
       if (startupSyncTimer) clearTimeout(startupSyncTimer)
-      // **And the lock is handed back.** Not releasing it leaves `host.lock` naming this dead process,
-      // and a re-mount inside the same process — a hot reload, or a test mounting the same home twice —
-      // is then refused by this plugin's own lock, for a pid that is very much alive: its own.
+      // **And the lock is handed back.** Not releasing it leaves `host.lock` naming this dead process, and a
+      // re-mount inside the same process — a hot reload, or a test mounting the same home twice — is then
+      // refused by this plugin's own lock, for a pid that is very much alive: its own.
+      //
+      // `engine.release()` alone is not enough: a run in flight was handed the host's lock object, and the
+      // engine only releases one it acquired itself (`ownsLock`), so unloading mid-run would leave the file
+      // behind. `releaseLock` checks the pid, so this can only ever remove our own.
       if (system) {
         system.syncAbort = true
+        // Stops a run at its next step boundary. Requests already on the wire finish; the phases that would
+        // touch the store do not start.
+        system.engine.abort()
         system.engine.release()
+        if (system.running) log('unloading while a sync is in flight; it stops at its next step boundary')
       }
+      releaseLock(dataDir)
       aggregator.close()
     }
   }, 'usage-badge: warm the fold, schedule the first sync, and close the cache on unload')