dsh-usage-badge 0.1.5 → 0.1.6

package/lib/webdav.js

@@ -259,6 +259,65 @@ const transport = (url, { method, headers, body, timeout }) =>
     req.end()
   })
 
+/**
+ * The one place a WebDAV base URL is judged and normalised.
+ *
+ * Exported so the **save route** can refuse exactly what the client refuses. When the two had their own
+ * copies of this rule the host accepted addresses the client could never use — a query string, embedded
+ * credentials, `ftp:` — and the panel stored one and displayed it while the sync could not run at all.
+ * Two copies of a rule drift; one copy cannot.
+ *
+ * @param {string} baseUrl
+ * @param {{allowTrailingSlashFix?:boolean}} [options] `allowTrailingSlashFix` appends the slash a
+ *   collection needs instead of refusing the address, which is what a person typing a host:port means.
+ *   It is the **second** parameter on purpose: a single destructured parameter silently ignores a string
+ *   argument and falls back to the permissive default, which is the opposite of failing loudly.
+ * @returns {{ok:true, url:string, insecure:boolean} | {ok:false, reason:string}}
+ */
+export function normalizeWebdavUrl(baseUrl, options = {}) {
+  const { allowTrailingSlashFix = true } = options ?? {}
+  const text = String(baseUrl ?? '').trim()
+  let url
+  try {
+    url = new URL(text)
+  } catch {
+    return { ok: false, reason: `this is not a URL: ${baseUrl}` }
+  }
+  if (url.protocol !== 'http:' && url.protocol !== 'https:') {
+    return { ok: false, reason: `the URL must be http or https, got ${url.protocol}` }
+  }
+  // **A host has to be there.** `new URL('http:///dav')` does not fail: WHATWG drops the empty authority
+  // and reads `dav` as the host, so a missing hostname silently retargets the address at another machine.
+  // Whoever typed three slashes meant to fill something in, not to point somewhere else.
+  const afterScheme = text.includes('://') ? text.slice(text.indexOf('://') + 3) : ''
+  if (afterScheme === '' || afterScheme.startsWith('/')) {
+    return { ok: false, reason: 'the URL has no host — it has to look like http://nas:19347/dav/' }
+  }
+  if (url.username || url.password) {
+    return { ok: false, reason: 'put the username and password in their own fields, not in the URL' }
+  }
+  if (url.search) return { ok: false, reason: 'the URL must not carry a query string' }
+  if (url.hash) return { ok: false, reason: 'the URL must not carry a #fragment' }
+  // An encoded slash is not a slash to the server: Apache's default `AllowEncodedSlashes` policy answers
+  // `%2f` with a 404, and appending a real slash after it produces a path nobody meant. Refused by name so
+  // the field says why, instead of being accepted and 404ing at the first request.
+  if (/%2f/i.test(url.pathname)) {
+    return { ok: false, reason: 'the URL contains an encoded slash (%2f), which this server family rejects by default — write the "/" literally' }
+  }
+  // `new URL('http://nas:19347').pathname` is `"/"`, not `""`: the root is a collection and already ends
+  // in its slash, so this is false for a bare host and nothing is appended. Only a **path** below the root
+  // that lacks the slash (`/dav`) reaches the branch.
+  if (!/\/$/.test(url.pathname)) {
+    if (!allowTrailingSlashFix) {
+      // The target is a collection; a WebDAV server answers a slash-less directory with a 301, and
+      // chasing that redirect is what makes a missing slash look like a wrong password.
+      return { ok: false, reason: `the URL must end with "/" (a collection), got ${baseUrl}` }
+    }
+    url.pathname = `${url.pathname}/`
+  }
+  return { ok: true, url: url.toString(), insecure: url.protocol === 'http:' }
+}
+
 /**
  * A WebDAV client bound to one server and one set of credentials.
  *
@@ -275,25 +334,18 @@ export class WebDavClient {
    *   digest HA1, which needs no plaintext at all).
    */
   constructor({ baseUrl, username, password = null, passwordHash = null, allowInsecureTls = false, timeoutMs = CONNECT_TIMEOUT_MS, uploadTimeoutMs = UPLOAD_TIMEOUT_MS, userAgent = 'dsh-usage-badge' }) {
-    const url = new URL(baseUrl)
-    if (url.protocol !== 'http:' && url.protocol !== 'https:') {
-      throw new Error(`the WebDAV URL must be http or https, got ${url.protocol}`)
-    }
-    if (url.username || url.password) {
-      throw new Error('put the username and password in their own fields, not in the URL')
-    }
-    if (url.search || url.hash) throw new Error('the WebDAV URL must not carry a query or fragment')
-    if (!/\/$/.test(url.pathname)) {
-      // Not normalised silently: the alias target is a directory, and a missing slash is a
-      // common cause of 301s that look like authentication failures.
-      throw new Error(`the WebDAV URL must end with "/" (a collection), got ${baseUrl}`)
-    }
-    if (url.protocol === 'http:' && !allowInsecureTls) {
+    // The same judgement the save route uses, in one place. `allowTrailingSlashFix` is off here on
+    // purpose: a person typing `host:port` should have the slash added for them by the route, but a client
+    // constructed from a stored configuration must be handed an address that is already right — silently
+    // changing it here would hide a configuration that was written wrong.
+    const judged = normalizeWebdavUrl(baseUrl, { allowTrailingSlashFix: false })
+    if (!judged.ok) throw new Error(judged.reason)
+    if (judged.insecure && !allowInsecureTls) {
       // Digest over plain HTTP is not a secret leak by itself, but it is brute-forceable by a
       // passive eavesdropper. Say so once here; the panel says it again.
       this.insecureWarning = 'this WebDAV URL is plain http://; digest authentication over an unencrypted connection is brute-forceable by anyone who can watch it'
     }
-    this.baseUrl = url
+    this.baseUrl = new URL(judged.url)
     this.username = username
     this.password = password
     this.passwordHash = passwordHash

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-usage-badge",
-  "version": "0.1.5",
+  "version": "0.1.6",
   "description": "DeepSeek Harness 的用量徽标插件：侧边栏底部一行显示当天的 token 总量与估算费用，点开可看 24 小时 / 近 7 日 / 近 30 日 / 近 12 个月 / 按年用量，按 provider 筛选，并按 DeepSeek 官方定价与中国法定节假日计价。A usage badge plugin for DeepSeek Harness: today's tokens and estimated spend in the sidebar, with 24h / 7d / 30d / 12-month and per-year charts, official DeepSeek pricing and Chinese public holidays.",
   "type": "module",
   "main": "lib/index.js",