hfs 0.26.7 → 0.26.8

package/src/api.accounts.js

@@ -1,59 +0,0 @@
-"use strict";
-// This file is part of HFS - Copyright 2021-2022, Massimo Melina <a@rejetto.com> - License https://www.gnu.org/licenses/gpl-3.0.txt
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-const api_helpers_1 = require("./api.helpers");
-const apiMiddleware_1 = require("./apiMiddleware");
-const perm_1 = require("./perm");
-const lodash_1 = __importDefault(require("lodash"));
-const const_1 = require("./const");
-function prepareAccount(ac) {
-    return ac && {
-        ...lodash_1.default.omit(ac, ['password', 'hashed_password', 'srp']),
-        username: ac.username,
-        hasPassword: (0, perm_1.accountHasPassword)(ac),
-        adminActualAccess: (0, perm_1.accountCanLoginAdmin)(ac),
-    };
-}
-const apis = {
-    get_usernames() {
-        return { list: Object.keys((0, perm_1.getAccounts)()) };
-    },
-    get_account({ username }, ctx) {
-        return prepareAccount((0, perm_1.getAccount)(username || (0, perm_1.getCurrentUsername)(ctx)))
-            || new apiMiddleware_1.ApiError(404);
-    },
-    get_accounts() {
-        return { list: Object.values((0, perm_1.getAccounts)()).map(prepareAccount) };
-    },
-    get_admins() {
-        return { list: Object.values((0, perm_1.getAccounts)()).map(prepareAccount).filter(ac => ac === null || ac === void 0 ? void 0 : ac.adminActualAccess).map(ac => ac.username) };
-    },
-    set_account({ username, changes }) {
-        const { admin } = changes;
-        if (admin === null)
-            changes.admin = undefined;
-        else if (admin !== undefined && typeof admin !== 'boolean')
-            return new apiMiddleware_1.ApiError(400, "invalid admin");
-        return (0, perm_1.setAccount)(username, changes) ? {} : new apiMiddleware_1.ApiError(400);
-    },
-    add_account({ username, ...rest }) {
-        if ((0, perm_1.getAccount)(username))
-            return new apiMiddleware_1.ApiError(const_1.FORBIDDEN);
-        if (!(0, perm_1.addAccount)(username, rest))
-            return new apiMiddleware_1.ApiError(400);
-        return {};
-    },
-    del_account({ username }) {
-        return (0, perm_1.delAccount)(username) ? {} : new apiMiddleware_1.ApiError(400);
-    },
-    async change_password_others({ username, newPassword }) {
-        return (0, api_helpers_1.changePasswordHelper)((0, perm_1.getAccount)(username), newPassword);
-    },
-    async change_srp_others({ username, salt, verifier }) {
-        return (0, api_helpers_1.changeSrpHelper)((0, perm_1.getAccount)(username), salt, verifier);
-    }
-};
-exports.default = apis;

package/src/api.auth.js

@@ -1,130 +0,0 @@
-"use strict";
-// This file is part of HFS - Copyright 2021-2022, Massimo Melina <a@rejetto.com> - License https://www.gnu.org/licenses/gpl-3.0.txt
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.change_srp = exports.change_password = exports.refresh_session = exports.logout = exports.loginSrp2 = exports.srpStep1 = exports.loginSrp1 = exports.login = void 0;
-const perm_1 = require("./perm");
-const crypt_1 = require("./crypt");
-const apiMiddleware_1 = require("./apiMiddleware");
-const tssrp6a_1 = require("tssrp6a");
-const const_1 = require("./const");
-const misc_1 = require("./misc");
-const api_helpers_1 = require("./api.helpers");
-const adminApis_1 = require("./adminApis");
-const middlewares_1 = require("./middlewares");
-const srp6aNimbusRoutines = new tssrp6a_1.SRPRoutines(new tssrp6a_1.SRPParameters());
-const ongoingLogins = {}; // store data that doesn't fit session object
-// centralized log-in state
-async function loggedIn(ctx, username) {
-    const s = ctx.session;
-    if (!s)
-        return ctx.throw(500, 'session');
-    if (username === false) {
-        delete s.username;
-        ctx.cookies.set('csrf', '');
-        return;
-    }
-    s.username = username;
-    await (0, middlewares_1.prepareState)(ctx, async () => { }); // updating the state is necessary to send complete session data so that frontend shows admin button
-    delete s.login;
-    ctx.cookies.set('csrf', (0, misc_1.randomId)(), { signed: false, httpOnly: false });
-}
-function makeExp() {
-    return { exp: new Date(Date.now() + const_1.SESSION_DURATION) };
-}
-const login = async ({ username, password }, ctx) => {
-    if (!username || !password) // some validation
-        return new apiMiddleware_1.ApiError(400);
-    username = username.toLocaleLowerCase(); // normalize username, to be case-insensitive
-    const acc = (0, perm_1.getAccount)(username);
-    if (!acc)
-        return new apiMiddleware_1.ApiError(const_1.UNAUTHORIZED);
-    if (!acc.hashed_password)
-        return new apiMiddleware_1.ApiError(406);
-    if (!await (0, crypt_1.verifyPassword)(acc.hashed_password, password))
-        return new apiMiddleware_1.ApiError(const_1.UNAUTHORIZED);
-    if (!ctx.session)
-        return new apiMiddleware_1.ApiError(500);
-    await loggedIn(ctx, username);
-    return { ...makeExp(), redirect: acc.redirect };
-};
-exports.login = login;
-const loginSrp1 = async ({ username }, ctx) => {
-    if (!username)
-        return new apiMiddleware_1.ApiError(400);
-    username = username.toLocaleLowerCase();
-    const account = (0, perm_1.getAccount)(username);
-    if (!ctx.session)
-        return new apiMiddleware_1.ApiError(500);
-    if (!account) // TODO simulate fake account to prevent knowing valid usernames
-        return new apiMiddleware_1.ApiError(const_1.UNAUTHORIZED);
-    try {
-        const { step1, ...rest } = await srpStep1(account);
-        const sid = Math.random();
-        ongoingLogins[sid] = step1;
-        setTimeout(() => delete ongoingLogins[sid], 60000);
-        ctx.session.login = { username, sid };
-        return rest;
-    }
-    catch (code) {
-        return new apiMiddleware_1.ApiError(code);
-    }
-};
-exports.loginSrp1 = loginSrp1;
-async function srpStep1(account) {
-    if (!account.srp)
-        throw 406; // unacceptable
-    const [salt, verifier] = account.srp.split('|');
-    const srpSession = new tssrp6a_1.SRPServerSession(srp6aNimbusRoutines);
-    const step1 = await srpSession.step1(account.username, BigInt(salt), BigInt(verifier));
-    return { step1, salt, pubKey: String(step1.B) }; // cast to string cause bigint can't be jsonized
-}
-exports.srpStep1 = srpStep1;
-const loginSrp2 = async ({ pubKey, proof }, ctx) => {
-    var _a;
-    if (!ctx.session)
-        return new apiMiddleware_1.ApiError(500);
-    if (!ctx.session.login)
-        return new apiMiddleware_1.ApiError(409);
-    const { username, sid } = ctx.session.login;
-    const step1 = ongoingLogins[sid];
-    try {
-        const M2 = await step1.step2(BigInt(pubKey), BigInt(proof));
-        await loggedIn(ctx, username);
-        return {
-            proof: String(M2),
-            redirect: (_a = ctx.state.account) === null || _a === void 0 ? void 0 : _a.redirect,
-            ...await (0, exports.refresh_session)({}, ctx)
-        };
-    }
-    catch (e) {
-        return new apiMiddleware_1.ApiError(const_1.UNAUTHORIZED, String(e));
-    }
-    finally {
-        delete ongoingLogins[sid];
-    }
-};
-exports.loginSrp2 = loginSrp2;
-const logout = async ({}, ctx) => {
-    if (!ctx.session)
-        return new apiMiddleware_1.ApiError(500);
-    loggedIn(ctx, false);
-    // 401 is a convenient code for OK: the browser clears a possible http authentication (hopefully), and Admin automatically triggers login dialog
-    return new apiMiddleware_1.ApiError(401);
-};
-exports.logout = logout;
-const refresh_session = async ({}, ctx) => {
-    return !ctx.session ? new apiMiddleware_1.ApiError(500) : {
-        username: (0, perm_1.getCurrentUsername)(ctx),
-        adminUrl: (0, adminApis_1.ctxAdminAccess)(ctx) ? const_1.ADMIN_URI : undefined,
-        ...makeExp(),
-    };
-};
-exports.refresh_session = refresh_session;
-const change_password = async ({ newPassword }, ctx) => {
-    return (0, api_helpers_1.changePasswordHelper)(ctx.state.account, newPassword);
-};
-exports.change_password = change_password;
-const change_srp = async ({ salt, verifier }, ctx) => {
-    return (0, api_helpers_1.changeSrpHelper)(ctx.state.account, salt, verifier);
-};
-exports.change_srp = change_srp;

package/src/api.file_list.js

@@ -1,103 +0,0 @@
-"use strict";
-// This file is part of HFS - Copyright 2021-2022, Massimo Melina <a@rejetto.com> - License https://www.gnu.org/licenses/gpl-3.0.txt
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.file_list = void 0;
-const vfs_1 = require("./vfs");
-const apiMiddleware_1 = require("./apiMiddleware");
-const promises_1 = require("fs/promises");
-const plugins_1 = require("./plugins");
-const misc_1 = require("./misc");
-const lodash_1 = __importDefault(require("lodash"));
-const file_list = async ({ path, offset, limit, search, omit, sse }, ctx) => {
-    let node = await (0, vfs_1.urlToNode)(path || '/', ctx);
-    const list = new apiMiddleware_1.SendListReadable();
-    if (!node)
-        return fail(404);
-    if (!(0, vfs_1.hasPermission)(node, 'can_read', ctx))
-        return fail((0, vfs_1.cantReadStatusCode)(node));
-    if ((0, misc_1.dirTraversal)(search))
-        return fail(418);
-    if (node.default)
-        return (sse ? list.custom : lodash_1.default.identity)({ redirect: path }); // sse will wrap the object in a 'custom' message, otherwise we plainly return the object
-    if (!await (0, vfs_1.nodeIsDirectory)(node))
-        return fail(405); // method not allowed on target
-    offset = Number(offset);
-    limit = Number(limit);
-    const filter = (0, misc_1.pattern2filter)(search);
-    const walker = (0, vfs_1.walkNode)(node, ctx, search ? Infinity : 0);
-    const onDirEntryHandlers = (0, plugins_1.mapPlugins)(plug => plug.onDirEntry);
-    if (!sse)
-        return { list: await (0, misc_1.asyncGeneratorToArray)(produceEntries()) };
-    setTimeout(async () => {
-        for await (const entry of produceEntries())
-            list.add(entry);
-        list.close();
-    });
-    return list;
-    function fail(code) {
-        if (!sse)
-            return new apiMiddleware_1.ApiError(code);
-        list.error(code);
-        list.close();
-        return list;
-    }
-    async function* produceEntries() {
-        for await (const sub of walker) {
-            if (ctx.aborted)
-                break;
-            if (!filter((0, vfs_1.getNodeName)(sub)))
-                continue;
-            const entry = await nodeToDirEntry(sub);
-            if (!entry)
-                continue;
-            const cbParams = { entry, ctx, listPath: path, node: sub };
-            try {
-                if (onDirEntryHandlers.some(cb => cb(cbParams) === false))
-                    continue;
-            }
-            catch (e) {
-                console.log("a plugin with onDirEntry is causing problems:", e);
-            }
-            if (offset) {
-                --offset;
-                continue;
-            }
-            if (omit) {
-                if (omit !== 'c')
-                    ctx.throw(400, 'omit');
-                if (!entry.m)
-                    entry.m = entry.c;
-                delete entry.c;
-            }
-            yield entry;
-            if (limit && !--limit)
-                break;
-        }
-    }
-};
-exports.file_list = file_list;
-async function nodeToDirEntry(node) {
-    let { source, default: def } = node;
-    const name = (0, vfs_1.getNodeName)(node);
-    if (!source)
-        return name ? { n: name + '/' } : null;
-    if (def)
-        return { n: name };
-    try {
-        const st = await (0, promises_1.stat)(source);
-        const folder = st.isDirectory();
-        const { ctime, mtime } = st;
-        return {
-            n: name + (folder ? '/' : ''),
-            c: ctime,
-            m: Math.abs(+mtime - +ctime) < 1000 ? undefined : mtime,
-            s: folder ? undefined : st.size,
-        };
-    }
-    catch (_a) {
-        return null;
-    }
-}

package/src/api.helpers.js

@@ -1,32 +0,0 @@
-"use strict";
-// This file is part of HFS - Copyright 2021-2022, Massimo Melina <a@rejetto.com> - License https://www.gnu.org/licenses/gpl-3.0.txt
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.changeSrpHelper = exports.changePasswordHelper = void 0;
-const perm_1 = require("./perm");
-const apiMiddleware_1 = require("./apiMiddleware");
-const const_1 = require("./const");
-async function changePasswordHelper(account, newPassword) {
-    if (!newPassword) // clear text version
-        return Error('missing parameters');
-    if (!account)
-        return new apiMiddleware_1.ApiError(const_1.UNAUTHORIZED);
-    await (0, perm_1.updateAccount)(account, account => {
-        account.password = newPassword;
-    });
-    return {};
-}
-exports.changePasswordHelper = changePasswordHelper;
-async function changeSrpHelper(account, salt, verifier) {
-    if (perm_1.allowClearTextLogin.get())
-        return new apiMiddleware_1.ApiError(406);
-    if (!salt || !verifier)
-        return Error('missing parameters');
-    if (!account)
-        return new apiMiddleware_1.ApiError(const_1.UNAUTHORIZED);
-    await (0, perm_1.updateAccount)(account, account => {
-        (0, perm_1.saveSrpInfo)(account, salt, verifier);
-        delete account.hashed_password; // remove leftovers
-    });
-    return {};
-}
-exports.changeSrpHelper = changeSrpHelper;

package/src/api.monitor.js

@@ -1,102 +0,0 @@
-"use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-const lodash_1 = __importDefault(require("lodash"));
-const connections_1 = require("./connections");
-const misc_1 = require("./misc");
-const apiMiddleware_1 = require("./apiMiddleware");
-const throttler_1 = require("./throttler");
-const perm_1 = require("./perm");
-const apis = {
-    async disconnect({ ip, port, wait }) {
-        const match = lodash_1.default.matches({ ip, port });
-        const c = (0, connections_1.getConnections)().find(c => match(getConnAddress(c)));
-        const waiter = (0, misc_1.pendingPromise)();
-        c === null || c === void 0 ? void 0 : c.socket.end(waiter.resolve);
-        if (wait)
-            await waiter;
-        return { result: Boolean(c) };
-    },
-    get_connections({}, ctx) {
-        const list = new apiMiddleware_1.SendListReadable({ addAtStart: (0, connections_1.getConnections)().map(c => serializeConnection(c)) });
-        const throttledUpdate = lodash_1.default.throttle(update, 1000 / 20); // try to avoid clogging with updates
-        const state = Symbol('state'); // undefined=added, Timeout=add-pending, false=removed
-        return list.events(ctx, {
-            connection(conn) {
-                conn[state] = setTimeout(() => add(conn), 100);
-            },
-            connectionClosed(conn) {
-                if (cancel(conn))
-                    return;
-                list.remove(serializeConnection(conn, true));
-                conn[state] = false;
-            },
-            connectionUpdated(conn, change) {
-                if (!change.ctx)
-                    return throttledUpdate(conn, change);
-                Object.assign(change, fromCtx(change.ctx));
-                change.ctx = undefined;
-                if (!add(conn))
-                    throttledUpdate(conn, change);
-            },
-        });
-        function add(conn) {
-            if (!cancel(conn))
-                return;
-            list.add(serializeConnection(conn));
-            return true;
-        }
-        function cancel(conn) {
-            if (!conn[state])
-                return;
-            clearTimeout(conn[state]);
-            conn[state] = undefined;
-            return true;
-        }
-        function update(conn, change) {
-            if (conn[state] === false)
-                return;
-            list.update(serializeConnection(conn, true), change);
-        }
-        function serializeConnection(conn, minimal) {
-            var _a;
-            const { socket, started, secure } = conn;
-            return Object.assign(getConnAddress(conn), !minimal && {
-                v: (((_a = socket.remoteFamily) === null || _a === void 0 ? void 0 : _a.endsWith('6')) ? 6 : 4),
-                got: socket.bytesRead,
-                sent: socket.bytesWritten,
-                started,
-                secure: (secure || undefined),
-                ...fromCtx(conn.ctx),
-            });
-        }
-        function fromCtx(ctx) {
-            return ctx && {
-                user: (0, perm_1.getCurrentUsername)(ctx),
-                archive: ctx.state.archive,
-                path: (ctx.fileSource || ctx.state.archive) && ctx.path // only for downloading files
-            };
-        }
-    },
-    async *get_connection_stats() {
-        while (1) {
-            yield {
-                outSpeed: throttler_1.totalOutSpeed,
-                inSpeed: throttler_1.totalInSpeed,
-                got: throttler_1.totalGot,
-                sent: throttler_1.totalSent,
-                connections: (0, connections_1.getConnections)().length
-            };
-            await (0, misc_1.wait)(1000);
-        }
-    },
-};
-exports.default = apis;
-function getConnAddress(conn) {
-    return {
-        ip: conn.ip,
-        port: conn.socket.remotePort,
-    };
-}

package/src/api.plugins.js

@@ -1,127 +0,0 @@
-"use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-const plugins_1 = require("./plugins");
-const lodash_1 = __importDefault(require("lodash"));
-const assert_1 = __importDefault(require("assert"));
-const misc_1 = require("./misc");
-const apiMiddleware_1 = require("./apiMiddleware");
-const events_1 = __importDefault(require("./events"));
-const promises_1 = require("fs/promises");
-const github_1 = require("./github");
-const apis = {
-    get_plugins({}, ctx) {
-        const list = new apiMiddleware_1.SendListReadable({ addAtStart: [...(0, plugins_1.mapPlugins)(serialize), ...(0, plugins_1.getAvailablePlugins)()] });
-        return list.events(ctx, {
-            pluginInstalled: p => list.add(serialize(p)),
-            'pluginStarted pluginStopped pluginUpdated': p => {
-                const { id, ...rest } = serialize(p);
-                list.update({ id }, rest);
-            },
-            pluginUninstalled: id => list.remove({ id }),
-        });
-        function serialize(p) {
-            const o = 'getData' in p ? Object.assign(lodash_1.default.pick(p, ['id', 'started']), p.getData())
-                : { ...p }; // _.defaults mutates object, and we don't want that
-            return lodash_1.default.defaults(o, { started: null, badApi: null }); // nulls should be used to be sure to overwrite previous values,
-        }
-    },
-    async get_plugin_updates() {
-        const list = new apiMiddleware_1.SendListReadable();
-        setTimeout(async () => {
-            for (const [folder, repo] of Object.entries((0, github_1.getFolder2repo)()))
-                try {
-                    if (!repo)
-                        continue;
-                    const online = await (0, github_1.readOnlinePlugin)(await (0, github_1.getRepoInfo)(repo));
-                    if (!online.apiRequired || online.badApi)
-                        continue;
-                    const disk = (0, plugins_1.getPluginInfo)(folder);
-                    if (online.version > disk.version)
-                        list.add(online);
-                }
-                catch (err) {
-                    list.error(err.code || err.message);
-                }
-            list.close();
-        });
-        return list;
-    },
-    async set_plugin({ id, enabled, config }) {
-        (0, assert_1.default)(id, 'id');
-        if (enabled !== undefined)
-            (0, plugins_1.enablePlugin)(id, enabled);
-        if (config)
-            (0, plugins_1.setPluginConfig)(id, config);
-        return {};
-    },
-    async get_plugin({ id }) {
-        return {
-            enabled: plugins_1.enablePlugins.get().includes(id),
-            config: {
-                ...(0, misc_1.objSameKeys)((0, plugins_1.getPluginConfigFields)(id) || {}, v => v === null || v === void 0 ? void 0 : v.defaultValue),
-                ...plugins_1.pluginsConfig.get()[id]
-            }
-        };
-    },
-    search_online_plugins({ text }, ctx) {
-        return new apiMiddleware_1.SendListReadable({
-            async doAtStart(list) {
-                try {
-                    const folder2repo = (0, github_1.getFolder2repo)();
-                    for await (const pl of (0, github_1.searchPlugins)(text)) {
-                        const repo = pl.id;
-                        const folder = lodash_1.default.findKey(folder2repo, x => x === repo);
-                        const installed = folder && (0, plugins_1.getPluginInfo)(folder);
-                        Object.assign(pl, {
-                            installed: lodash_1.default.includes(folder2repo, repo),
-                            update: installed && installed.version < pl.version,
-                        });
-                        list.add(pl);
-                        // watch for events about this plugin, until this request is closed
-                        ctx.req.on('close', (0, misc_1.onOff)(events_1.default, {
-                            pluginInstalled: p => {
-                                if (p.repo === repo)
-                                    list.update({ id: repo }, { installed: true });
-                            },
-                            pluginUninstalled: folder => {
-                                if (repo === (0, github_1.getFolder2repo)()[folder])
-                                    list.update({ id: repo }, { installed: false });
-                            },
-                            pluginUpdated: p => {
-                                if (p.repo === repo)
-                                    list.update({ id: repo }, { update: p.version < pl.version });
-                            },
-                            ['pluginDownload_' + repo](status) {
-                                list.update({ id: repo }, { downloading: status !== null && status !== void 0 ? status : null });
-                            }
-                        }));
-                    }
-                }
-                catch (err) {
-                    list.error(err.code || err.message);
-                }
-                list.ready();
-            }
-        });
-    },
-    async download_plugin(pl) {
-        const res = await (0, github_1.downloadPlugin)(pl.id, pl.branch);
-        return typeof res === 'string' ? (0, plugins_1.getPluginInfo)(res) : res;
-    },
-    async update_plugin(pl) {
-        await (0, github_1.downloadPlugin)(pl.id, pl.branch, true);
-        return {};
-    },
-    async uninstall_plugin({ id }) {
-        while ((0, plugins_1.isPluginRunning)(id)) {
-            (0, plugins_1.enablePlugin)(id, false);
-            await (0, misc_1.wait)(500);
-        }
-        await (0, promises_1.rm)(plugins_1.PATH + '/' + id, { recursive: true, force: true });
-        return {};
-    }
-};
-exports.default = apis;